2024

The Master Slider – Responsive Touch Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the pl

The Content Blocks (Custom Post Widget) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin

The Content Blocks (Custom Post Widget) plugin for WordPress is vulnerable to Local File Inclusion in all versions up to

The WordPress Infinite Scroll – Ajax Load More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the

The Page Builder Gutenberg Blocks – CoBlocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the S

The snapctl component within snapd allows a confined snap to interact with the snapd daemon to take certain privileged a

Insufficient checks whether ReCAPTCHA was enabled made it possible to bypass the checks on the login page. This did not

Actions in the admin management of analytics models did not include the necessary token to prevent a CSRF risk.

The logout option within MFA did not include the necessary token to avoid the risk of users inadvertently being logged o

The site log report required additional encoding of event descriptions to ensure any HTML in the content is displayed in

In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user with

In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user with

In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user with

In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user with

An invalid pointer in the modbus_receive() function of libmodbus v3.1.6 allows attackers to cause a Denial of Service (D

libmodbus v3.1.6 was discovered to contain a use-after-free via the ctx->backend pointer. This vulnerability allows atta

libmodbus v3.1.6 was discovered to contain a heap overflow via the modbus_mapping_free() function.

Actions in the admin preset tool did not include the necessary token to prevent a CSRF risk.

ID numbers displayed in the lesson overview report required additional sanitizing to prevent a stored XSS risk.

The referrer URL used by MFA required additional sanitizing, rather than being used directly.

Insufficient escaping of participants' names in the participants page table resulted in a stored XSS risk when interacti

Additional sanitizing was required when opening the equation editor to prevent a stored XSS risk when editing another us

Incorrect validation of allowed event types in a calendar web service made it possible for some users to create events w

A vulnerability was found in libndp. This flaw allows a local malicious user to cause a buffer overflow in NetworkManage

HTTP request desynchronization in Ping Identity PingAccess, all versions prior to 8.0.1 affected allows an attacker to s

Insufficiently Protected Credentials vulnerability in Baxter Welch Allyn Configuration Tool may allow Remote Services wi

Sentry is a developer-first error tracking and performance monitoring platform. Sentry's Slack integration incorrectly r

An issue in coap_msg.c in Keith Cullen's FreeCoAP v.0.7 allows remote attackers to cause a Denial of Service or potentia

An unrestricted file upload vulnerability in web component of Ivanti Avalanche before 6.4.x allows an authenticated, pri

An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an authenticated attac

An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an authenticated attac

An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an authenticated attac

An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an authenticated attac

An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated att

An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated att

An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated att

An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated att

An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated att

An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated att

An unrestricted file upload vulnerability in web component of Ivanti Neurons for ITSM allows a remote, authenticated, hi

A SQL injection vulnerability in web component of Ivanti Neurons for ITSM allows a remote authenticated user to read/mod

A buffer overflow allows a low privilege user on the local machine that has the EPM Agent installed to execute arbitrary

Use of Default Cryptographic Key vulnerability in Baxter Welch Allyn Connex Spot Monitor may allow Configuration/Environ

A local privilege escalation vulnerability in Ivanti Secure Access Client for Linux before 22.7R1, allows a low privileg

A CRLF Injection vulnerability in Ivanti Connect Secure (9.x, 22.x) allows an authenticated high-privileged user to inje

A local privilege escalation vulnerability in Ivanti Secure Access Client for Windows allows a low privileged user to ex

Insufficient user input filtering leads to arbitrary file read by non-authenticated attacker, which results in sensitive

javascript-deobfuscator removes common JavaScript obfuscation techniques. In affected versions crafted payloads targetin

IBM Security Verify Access Docker 10.0.0 through 10.0.6 could allow a local user to escalate their privileges due to exe

IBM Security Verify Access Docker 10.0.0 through 10.0.6 could allow a local user to escalate their privileges due to imp