2024

A vulnerability was found in cjbi wetech-cms 1.0/1.1/1.2 and classified as critical. This issue affects the function sea

Use after free in Translate in Google Chrome prior to 131.0.6778.139 allowed a remote attacker to potentially exploit he

Type Confusion in V8 in Google Chrome prior to 131.0.6778.139 allowed a remote attacker to potentially exploit heap corr

XnSoft XnView Classic RWZ File Parsing Integer Underflow Remote Code Execution Vulnerability. This vulnerability allows

GFI Archiver Store Service Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability all

GFI Archiver Telerik Web UI Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute a

GFI Archiver Core Service Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allo

Epic Games Launcher Incorrect Default Permissions Local Privilege Escalation Vulnerability. This vulnerability allows lo

Under specific circumstances, insecure permissions in Ivanti Automation before version 2024.4.0.1 allows a local authent

Under specific circumstances, insecure permissions in Ivanti Workspace Control before version 10.18.40.0 allows a local

GLPI is a free asset and IT management software package. Starting in version 10.0.0 and prior to version 10.0.17, an aut

GLPI is a free asset and IT management software package. Starting in version 0.80 and prior to version 10.0.17, an admin

GLPI is a free asset and IT management software package. Starting in version 9.1.0 and prior to version 10.0.17, a techn

Under specific circumstances, insecure permissions in Ivanti Application Control before version 2024.3 HF1, 2024.1 HF2,

Under specific circumstances, insecure permissions in Ivanti Performance Manager before version 2024.3 HF1, 2024.1 HF1,

Under specific circumstances, insecure permissions in Ivanti Security Controls before version 2024.4.1 allows a local au

File upload logic in Apache Struts is flawed. An attacker can manipulate file upload params to enable paths traversal an

GLPI is a free asset and IT management software package. Starting in version 9.3.0 and prior to version 10.0.17, an auth

The web application is not protected against cross-site request forgery attacks. Therefore, an attacker can trick users

The scanner device boots into a kiosk mode by default and opens the Scan2Net interface in a browser window. This browser

The www-data user can elevate its privileges because sudo is configured to allow the execution of the mount command as r

Users who click on a malicious link or visit a website under the control of an attacker can be infected with arbitrary J

IBM InfoSphere Information Server 11.7 could allow an authenticated user to obtain sensitive information when a detailed

The Restrict – membership, site, content and user access restrictions for WordPress plugin for WordPress is vulnerable t

IBM InfoSphere DataStage Flow Designer (InfoSphere Information Server 11.7) could allow an authenticated user to obtain

The Waymark plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘content’ parameter in all vers

The Last Viewed Posts by WPBeginner plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions

The RapidLoad – Optimize Web Vitals Automatically plugin for WordPress is vulnerable to unauthorized access of data and

The Members – Membership & User Role Editor Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure

Missing Authorization vulnerability in Ninja Team Notibar notibar allows Exploiting Incorrectly Configured Access Contro

Insufficient permissions in the TeamViewer Patch & Asset Management component prior to version 24.12 on Windows allows a

CWE-20: Improper Input Validation vulnerability exists that could lead to a denial of service and a loss of confidential

Rapid7 Insight Platform versions prior to November 13th 2024, suffer from a privilege escalation vulnerability whereby,

The WP Pipes plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘x1’ parameter in all versions

The WPC Order Notes for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up

CWE-287: Improper Authentication vulnerability exists that could cause Denial of access to the web interface when someon

Dell VxVerify, versions prior to x.40.405, contain a Plain-text Password Storage Vulnerability in the shell wrapper. A l

Dell ThinOS version 2408 contains an Improper Neutralization of Special Elements used in a Command ('Command Injection')

Dell ThinOS version 2408 contains a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability. A low privileged at

Dell Client Platform Firmware Update Utility contains an Improper Link Resolution vulnerability. A high privileged attac

When asked to both use a `.netrc` file for credentials and to follow HTTP redirects, curl could leak the password used f

IBM Aspera Faspex 5.0.0 through 5.0.7 could allow a local user to obtain sensitive information due to improper encryptio

IBM OpenPages with Watson 9.0 may write sensitive information, under specific configurations, in clear text to the syste

sigstore-python is a Python tool for generating and verifying Sigstore signatures. Versions of sigstore-python newer tha

PwnDoc is a penetration test report generator. In versions up to and including 0.5.3, an authenticated user is able to c

Action Pack is a framework for handling and responding to web requests. There is a possible Cross Site Scripting (XSS) v

Adobe Experience Manager versions 6.5.21 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability t

Adobe Framemaker versions 2020.7, 2022.5 and earlier are affected by a Stack-based Buffer Overflow vulnerability that co

Substance3D - Painter versions 10.1.1 and earlier are affected by an out-of-bounds write vulnerability that could result

Substance3D - Painter versions 10.1.1 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could