2024

The BNE Gallery Extended plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'gallery' sh

The Support SVG – Upload svg files in wordpress without hassle plugin for WordPress is vulnerable to Stored Cross-Site S

51l3nc3, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API managedoverlayimages.cgi was vulnerable

Seth Fogie, member of AXIS Camera Station Pro Bug Bounty Program has found that it is possible to edit and/or remove vie

The web interface of the affected devices is designed to hide the LDAP credentials even for administrative users. But co

Admin authentication can be bypassed with some specific invalid credentials, which allows logging in with an administrat

User passwords are decrypted and stored on memory before any user logged in. Those decrypted passwords can be retrieved

User passwords are decrypted and stored on memory before any user logged in. Those decrypted passwords can be retrieved

User passwords are decrypted and stored on memory before any user logged in. Those decrypted passwords can be retrieved

Affected devices create coredump files when crashed, storing them with world-readable permission. Any local user of the

Multiple plugins for WordPress are vulnerable to Reflected Cross-Site Scripting via the cminds_free_guide shortcode in v

Seth Fogie, member of the AXIS Camera Station Pro Bug Bounty Program, has found that the Incident report feature may exp

Gee-netics, member of the AXIS Camera Station Pro Bug Bounty Program has found that it is possible for a non-admin user

The The InPost Gallery plugin for WordPress is vulnerable to arbitrary shortcode execution via the inpost_gallery_get_sh

The Product Input Fields for WooCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to

The Everest Forms WordPress plugin before 3.0.4.2 does not sanitise and escape some of its settings, which could allow

Cross-site scripting vulnerability exists in WP Admin UI Customize versions prior to ver 1.5.14. If a malicious admin us

IBM Workload Scheduler 9.5, 10.1, and 10.2 stores user credentials in plain text which can be read by a local user.

The Additional Order Filters for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via th

The Skt NURCaptcha plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including

Dell Wyse Management Suite, version WMS 4.4 and prior, contain a Missing Authorization vulnerability. A high privileged

A vulnerability, which was classified as critical, was found in CodeAstro Hospital Management System 1.0. Affected is an

A vulnerability, which was classified as problematic, has been found in 1000 Projects Bookstore Management System 1.0. T

masterstack_imgcap v0.0.1 was discovered to contain a SQL injection vulnerability via the endpoint /submit.

In the Linux kernel, the following vulnerability has been resolved: fs: Fix uninitialized value issue in from_kuid and

In the Linux kernel, the following vulnerability has been resolved: mm: krealloc: Fix MTE false alarm in __do_krealloc

An Open Redirect vulnerability in Taiga v6.8.1 allows attackers to redirect users to arbitrary websites via appending a

Incorrect access control in Adapt Learning Adapt Authoring Tool <= 0.11.3 allows attackers with Authenticated User roles

SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. The static error.html

SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. "Unsanitized input fro

Autolab is a course management service that enables auto-graded programming assignments. From Autolab versions v.3.0.0 o

A cross-site scripting (XSS) vulnerability in the /scroll.php endpoint of LafeLabs Chaos v0.0.1 allows attackers to exec

BoidCMS is a free and open-source flat file CMS for building simple websites and blogs, developed using PHP and uses JSO

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. For users with the following

A Stored Cross-Site Scripting (XSS) vulnerability in the Management Console of BlackBerry AtHoc version 7.15 could allow

Deno is a runtime for JavaScript and TypeScript written in rust. Several cross-site scripting vulnerabilities existed in

IBM Jazz Foundation 7.0.2 and below are vulnerable to cross-site scripting. This vulnerability allows users to embed arb

IBM Jazz Foundation 7.0.2 and 7.0.3 could allow a user to change their dashboard using a specially crafted HTTP request

Incorrect authorization in the add permission component in Devolutions Remote Desktop Manager 2024.2.21 and earlier on W

Improper authentication in SQL data source MFA validation in Devolutions Remote Desktop Manager 2024.3.17 and earlier on

Incorrect authorization in the permission validation component of Devolutions Remote Desktop Manager 2024.2.21 and earli

IPP software prior to v1.71 is vulnerable to default credential vulnerability. This could lead attackers to identify and

IPP software versions prior to v1.71 do not sufficiently verify the authenticity of data, in a way that causes it to acc

Eaton Intelligent Power Manager (IPM) prior to 1.70 is vulnerable to stored Cross site scripting. The vulnerability exis

A vulnerability was found in the Keycloak Server. The Keycloak Server is vulnerable to a denial of service (DoS) attack

A vulnerability was found in welliamcao OpsManage 3.0.1/3.0.2/3.0.3/3.0.4/3.0.5. It has been rated as critical. This iss

A vulnerability was found in Codezips Free Exam Hall Seating Management System 1.0. It has been declared as problematic.

A flaw was found in Keycloak. This issue occurs because sensitive runtime values, such as passwords, may be captured dur

A vulnerability was found in the Keycloak-services package. If untrusted data is passed to the SearchQueryUtils method,

A flaw was found in OpenShift Console. A Server Side Request Forgery (SSRF) attack can happen if an attacker supplies al