2024

Nextcloud Photos is a photo management app. Users can remove photos from the album of registered users. It is recommende

Nextcloud server is a self hosted personal cloud system. Under some circumstance it was possible to bypass the second fa

user_oidc app is an OpenID Connect user backend for Nextcloud. Missing access control on the ID4me endpoint allows an at

In MintHCM 4.0.3, a registered user can execute arbitrary JavaScript code and achieve a reflected Cross-site Scripting (

LNbits is a Lightning wallet and accounts system. Paying invoices in Eclair that do not get settled within the internal

Hardcoded credentials in TerraMaster TOS firmware through 5.1 allow a remote attacker to successfully login to the mail

LB-LINK BL-W1210M v2.0 was discovered to contain a clickjacking vulnerability via the Administrator login page. Attacker

LB-LINK BL-W1210M v2.0 was discovered to store user credentials in plaintext within the router's firmware.

Incorrect access control in the UART/Serial interface on the LB-LINK BL-W1210M v2.0 router allows attackers to access th

An open redirect issue was discovered in Kibana that could lead to a user being redirected to an arbitrary website if th

A vulnerability in the IPS Manager, Central Manager, and Local Manager communication workflow allows an attacker to cont

Insecure Deserialization in some workflows of the IPS Manager allows unauthenticated remote attackers to perform arbitra

TOTOLINK A3700R V9.1.2u.6165_20211012 was discovered to contain a stack overflow via ssid5g in the function setWiFiEasyG

TOTOLINK A3700R V9.1.2u.6165_20211012 was discovered to contain a stack overflow via eport in the function setIpPortFilt

TOTOLINK A3700R V9.1.2u.6165_20211012 was discovered to contain a stack overflow via ssid5g in the function setWizardCfg

The Folders Pro plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the

The Folders and Folders Pro plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and includi

A CRLF cross-site scripting vulnerability has been identified in certain configurations of the SiteMinder Web Agent for

Missing Authorization vulnerability in Brainstorm Force ProjectHuddle Client Site.This issue affects ProjectHuddle Clien

Users with "User:edit" and "Self:api" permissions can promote or demote themselves or other users by performing changes

Certain models of ASUS routers have an arbitrary firmware upload vulnerability. An unauthenticated remote attacker can e

Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Cloud Manage

The LatePoint Plugin plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a

The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Si

Mattermost Desktop App versions <=5.7.0 fail to correctly prompt for permission when opening external URLs which allows 

Mattermost Desktop App versions <=5.7.0 fail to disable certain Electron debug flags which allows for bypassing TCC rest

Use of Web Browser Cache Containing Sensitive Information vulnerability in Apache Airflow.  Airflow did not return "Cac

The notification emails sent by Soar Cloud HR Portal contain a link with a embedded session. The expiration of the sessi

Improper neutralization of input during web page generation vulnerability in 2ClickPortal software allows reflected cros

The Where I Was, Where I Will Be plugin for WordPress is vulnerable to Remote File Inclusion in version <= 1.1.1 via the

Function vulnerabilities in the Calendar module Impact: Successful exploitation of this vulnerability will affect availa

Vulnerability of insufficient permission verification in the NearLink module Impact: Successful exploitation of this vul

Memory management vulnerability in the Gralloc module Impact: Successful exploitation of this vulnerability will affect

Out-of-bounds read vulnerability in the audio module Impact: Successful exploitation of this vulnerability will affect a

Memory management vulnerability in the boottime module Impact: Successful exploitation of this vulnerability can affect

Privilege escalation vulnerability in the AMS module Impact: Successful exploitation of this vulnerability may affect se

Vulnerability of unauthorized screenshot capturing in the WMS module Impact: Successful exploitation of this vulnerabili

The WP Go Maps (formerly WP Google Maps) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Custom JS

ASUS Download Master has a buffer overflow vulnerability. An unauthenticated remote attacker with administrative privile

The specific function parameter of ASUS Download Master does not properly filter user input. An unauthenticated remote a

The WP STAGING Pro WordPress Backup Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versi

The Inquiry cart WordPress plugin through 3.4.2 does not have CSRF check in some places, and is missing sanitisation as

The WP Prayer II WordPress plugin through 2.4.7 does not have CSRF check in place when updating its settings, which coul

The WP Prayer II WordPress plugin through 2.4.7 does not have CSRF check in place when updating its email settings, whic

The ElementsKit PRO plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including,

The SVGator WordPress plugin through 1.2.6 does not sanitize SVG file contents, which enables users with at least the a

The SVGMagic WordPress plugin through 1.1 does not sanitize SVG file contents, which enables users with at least the aut

The Social Pixel WordPress plugin through 2.1 does not sanitise and escape some of its settings, which could allow high

The AZAN Plugin WordPress plugin through 0.6 does not have CSRF check in some places, and is missing sanitisation as wel

The Amen WordPress plugin through 3.3.1 does not sanitise and escape some of its settings, which could allow high privil