2024

IBM Db2 on Cloud Pak for Data and Db2 Warehouse on Cloud Pak for Data 3.5, 4.0, 4.5, 4.6, 4.7, and 4.8 could allow a use

Zoho ManageEngine PAM360 is vulnerable to Stored XSS vulnerability. This vulnerability is applicable only in the version

In the Linux kernel, the following vulnerability has been resolved: tcp: do not accept ACK of bytes we never sent This

Improper restriction of local upload and download paths in check_sftp in Checkmk before 2.3.0p4, 2.2.0p27, 2.1.0p44, and

The WP STAGING WordPress Backup Plugin – Migration Backup Restore plugin for WordPress is vulnerable to arbitrary file u

The Essential Addons for Elementor PRO – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordP

In the Linux kernel, the following vulnerability has been resolved: ppdev: Add an error check in register_device In re

In the Linux kernel, the following vulnerability has been resolved: drm/arm/malidp: fix a possible null pointer derefer

The Fetch JFT plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to

The Playlist for Youtube WordPress plugin through 1.32 does not sanitise and escape some of its settings, which could al

The Gianism WordPress plugin through 5.1.0 does not sanitise and escape some of its settings, which could allow high pri

The Site Reviews WordPress plugin before 7.0.0 retrieves client IP addresses from potentially untrusted headers, allowin

The AppPresser plugin for WordPress is vulnerable to improper missing encryption exception handling on the 'decrypt_valu

Versions of the package mysql2 before 3.9.8 are vulnerable to Prototype Pollution due to improper user input sanitizatio

The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to Remote Code

The WordPress Tour & Travel Booking Plugin for WooCommerce – WpTravelly plugin for WordPress is vulnerable to unauthoriz

The Swiss Toolkit For WP plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1

The Login with phone number plugin for WordPress is vulnerable to authentication bypass in versions up to, and including

A vulnerability was found in SourceCodester Simple Online Bidding System 1.0. It has been classified as problematic. Aff

Nautobot is a Network Source of Truth and Network Automation Platform. A user with permissions to view Dynamic Group rec

HCL DRYiCE Optibot Reset Station is impacted by insecure encryption of One-Time Passwords (OTPs). This could allow an at

HCL DRYiCE Optibot Reset Station is impacted by insecure encryption of security questions. This could allow an attacker

An issue discovered in 360 V6G, 360 T5G, 360 T6M, and 360 P1 routers allows attackers to hijack TCP sessions which could

An issue discovered in OpenWrt 18.06, 19.07, 21.02, 22.03, and beyond allows off-path attackers to hijack TCP sessions,

A SQL injection vulnerability in Mybatis plus versions below 3.5.6 allows remote attackers to obtain database informatio

phpgurukul Men Salon Management System v2.0 is vulnerable to SQL Injection via the "username" parameter of /msms/admin/i

Umbraco Commerce is an open source dotnet ecommerce solution. In affected versions there exists a stored Cross-site scri

Umbraco Commerce is an open source dotnet web forms solution. In affected versions an authenticated user that has access

Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. In a

TCPDF version 6.6.5 and before is vulnerable to ReDoS (Regular Expression Denial of Service) if parsing an untrusted SVG

A cross-site scripting (XSS) vulnerability in Sourcecodester Laboratory Management System v1.0 allows attackers to execu

A cross-site scripting (XSS) vulnerability in Sourcecodester Laboratory Management System v1.0 allows attackers to execu

A cross-site scripting (XSS) vulnerability in Sourcecodester Laboratory Management System v1.0 allows attackers to execu

An arbitrary file upload vulnerability in /dede/file_manage_control.php of DedeCMS v5.7.114 allows attackers to execute

An issue was discovered in Apiris Kafeo 6.4.4. It permits a bypass, of the protection in place, to access to the data st

An issue was discovered in Apiris Kafeo 6.4.4. It permits DLL hijacking, allowing a user to trigger the execution of arb

Vtenext 21.02 allows an authenticated attacker to upload arbitrary files, potentially enabling them to execute remote co

An issue discovered in Wavlink QUANTUM D2G routers allows attackers to hijack TCP sessions which could lead to a denial

An issue discovered in Comfast Comfast CF-616AC routers allows attackers to hijack TCP sessions which could lead to a de

An issue discovered in D-Link DI-7003GV2 routers allows attackers to hijack TCP sessions which could lead to a denial of

An issue discovered in Ruijie EG210G-P, Ruijie EG105G-V2, Ruijie NBR, and Ruijie EG105G routers allows attackers to hija

An issue discovered in TP-LINK TL-R473GP-AC, TP-LINK XDR6020, TP-LINK TL-R479GP-AC, TP-LINK TL-R4239G, TP-LINK TL-WAR120

An issue discovered in Mercury x30g, Mercury YR1800XG routers allows attackers to hijack TCP sessions which could lead t

An issue was discovered in LIVEBOX Collaboration vDesk through v018. An Unrestricted Upload of a File with a Dangerous T

The Campbell Scientific CSI Web Server stores web authentication credentials in a file with a specific file name. Passwo

The Campbell Scientific CSI Web Server supports a command that will return the most recent file that matches a given exp

ansibleguy-webui is an open source WebUI for using Ansible. Multiple forms in versions < 0.0.21 allowed injection of HTM

CoCalc is web-based software that enables collaboration in research, teaching, and scientific publishing. In affected ve

MinIO is a High Performance Object Storage released under GNU Affero General Public License v3.0. `If-Modified-Since` an

SQL Injection in Finereport v.8.0 allows a remote attacker to obtain sensitive information