2024

SQL injection vulnerability in the module "Complete for Create a Quote in Frontend + Backend Pro" (askforaquotemodul) <=

PHP Injection vulnerability in the module "M4 PDF Extensions" (m4pdf) up to version 3.3.2 from PrestaAddons for PrestaSh

Axiros AXESS Auto Configuration Server (ACS) 4.x and 5.0.0 is affected by an Incorrect Access Control vulnerability. An

H3C Magic R230 V100R002 was discovered to contain a hardcoded password vulnerability in /etc/shadow, which allows attack

DataGear v5.0.0 and earlier was discovered to contain a SpEL (Spring Expression Language) expression injection vulnerabi

An issue in VPL Jail System up to v4.0.2 allows attackers to execute a directory traversal via a crafted request to a pu

FreeRTOS-Plus-TCP is a lightweight TCP/IP stack for FreeRTOS. FreeRTOS-Plus-TCP versions 4.0.0 through 4.1.0 contain a b

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. The content of

An issue was discovered in VirtoSoftware Virto Bulk File Download 5.5.44 for SharePoint 2019. The Virto.SharePoint.FileD

Buffer Overflow vulnerability in ASUS router RT-AX88U with firmware versions v3.0.0.4.388_24198 allows a remote attacker

Unrestricted Upload of File with Dangerous Type vulnerability in InstaWP InstaWP Connect instawp-connect.This issue affe

Improper Control of Generation of Code ('Code Injection') vulnerability in Membership Software WishList Member X allows

Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in StylemixThemes Cons

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in StylemixThemes Consultin

Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) vulnerability in Apache StreamPipes user self-regist

Improper Control of Generation of Code ('Code Injection') vulnerability in Next4Biz CRM & BPM Software Business Process

The decrypted configuration file contains the password in cleartext which is used to configure WINSelect. It can be use

In Emacs before 29.4, org-link-expand-abbrev in lisp/ol.el expands a %(...) link abbrev even when it specifies an unsafe

CVE-2024-4320 describes a vulnerability in the parisneo/lollms software, specifically within the `ExtensionBuilder().bui

Insecure permissions in kruise v1.6.2 allows attackers to access sensitive data and escalate privileges by obtaining the

In the module RSI PDF/HTML catalog evolution (prestapdf) <= 7.0.0 from RSI for PrestaShop, a guest can perform SQL injec

Actual Analyzer through 2014-08-29 allows code execution via shell metacharacters because untrusted input is used for pa

Multiple directory traversal vulnerabilities in the TFTP Server in Distinct Intranet Servers 3.10 and earlier allow remo

When generating the systemd service units for the docker snap (and other similar snaps), snapd does not specify Delegate

Unrestricted Upload of File with Dangerous Type vulnerability in Bogdan Bendziukov Squeeze allows Code Injection.This is

Incorrect Authorization vulnerability in Artbees JupiterX Core allows Accessing Functionality Not Properly Constrained b

The file upload plugin in Adminer and AdminerEvo allows an attacker to upload a file with a table name of “..” to the ro

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Fix loop termination condition in gss_free_

The Themify – WooCommerce Product Filter plugin for WordPress is vulnerable to time-based SQL Injection via the ‘conditi

The Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce plugin f

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. When an admin d

An issue in DataLife Engine v.17.1 and before is vulnerable to SQL Injection in dboption.

In the Linux kernel, the following vulnerability has been resolved: tipc: improve size validations for received domain

The Shariff Wrapper plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 4.6.13

The Lifeline Donation plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.2.

The WP Hotel Booking plugin for WordPress is vulnerable to SQL Injection via the 'room_type' parameter of the /wphb/v1/r

A path traversal vulnerability exists in mudler/localai version 2.14.0, where an attacker can exploit the `model` parame

In the module "Custom links" (pk_customlinks) <= 2.3 from Promokit.eu for PrestaShop, a guest can perform SQL injection.

In the module "Module Live Chat Pro (All in One Messaging)" (livechatpro) <=8.4.0, a guest can perform PHP Code injectio

In the module "Theme settings" (pk_themesettings) <= 1.8.8 from Promokit.eu for PrestaShop, a guest can perform SQL inje

In the module "Channable" (channable) up to version 3.2.1 from Channable for PrestaShop, a guest can perform SQL injecti

In the module "Help Desk - Customer Support Management System" (helpdesk) up to version 2.4.0 from FME Modules for Prest

In the module "JA Marketplace" (jamarketplace) up to version 9.0.1 from JA Module for PrestaShop, a guest can upload fil

Missing Authorization vulnerability in ThemeFusion Avada.This issue affects Avada: from n/a through 7.11.1.

In the Linux kernel, the following vulnerability has been resolved: net: systemport: Add global locking for descriptor

In the Linux kernel, the following vulnerability has been resolved: gfs2: Fix potential glock use-after-free on unmount

In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: fix overwriting ct original tuple

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix seg fault in rxe_comp_queue_pkt In r

Use of potentially dangerous function issue exists in Ricoh Streamline NX PC Client. If this vulnerability is exploited,

Use of hard-coded credentials issue exists in Ricoh Streamline NX PC Client ver.3.7.2 and earlier. If this vulnerability