2024

Incorrect permission assignment for critical resource issue exists in MosP kintai kanri V4.6.6 and earlier, which may al

Path traversal vulnerability in MosP kintai kanri V4.6.6 and earlier allows a remote attacker who can log in to the prod

OrangeHRM 3.3.3 allows admin/viewProjects sortOrder SQL injection.

In TARGIT Decision Suite 23.2.15007.0 before Autumn 2023, the session token is part of the URL and may be sent in a clea

In Avocent DSR2030 Appliance firmware 03.04.00.07 before 03.07.01.23, and SVIP1020 Appliance firmware 01.06.00.03 before

The ip package through 2.0.1 for Node.js might allow SSRF because some IP addresses (such as 127.1, 01200034567, 012.1.2

Meshery is an open source, cloud native manager that enables the design and management of Kubernetes-based infrastructur

Meshery is an open source, cloud native manager that enables the design and management of Kubernetes-based infrastructur

dbt enables data analysts and engineers to transform their data using the same practices that software engineers use to

Zoho ManageEngine ADAudit Plus versions 7260 and below allows unauthorized local agent machine users to view the session

Zoho ManageEngine ADAudit Plus versions 7260 and below allows unauthorized local agent machine users to access sensitive

Minder by Stacklok is an open source software supply chain security platform. Minder prior to version 0.0.51 is vulnerab

Zoho ManageEngine ADSelfService Plus versions below 6401 are vulnerable to the DOS attack due to the malicious LDAP inpu

MIT IdentiBot is an open-source Discord bot written in Node.js that verifies individuals' affiliations with MIT, grants

Audiobookshelf is a self-hosted audiobook and podcast server. Prior to version 2.10.0, opening an ebook with malicious s

rack-contrib provides contributed rack middleware and utilities for Rack, a Ruby web server interface. Versions of rack-

ZKsync Era is a layer 2 rollup that uses zero-knowledge proofs to scale Ethereum. Prior to version 1.3.10, there is a ve

A vulnerability, which was classified as critical, has been found in bwoodsend rockhopper up to 0.1.2. Affected by this

OpenAPI Generator allows generation of API client libraries (SDK generation), server stubs, documentation and configurat

Kaminari is a paginator for web app frameworks and object relational mappings. A security vulnerability involving insecu

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Grup Arge Energy a

configureNFS in lib/common/functions.sh in FOG through 1.5.10 allows local users to gain privileges by mounting a crafte

RhinOS 3.0-1190 is vulnerable to an XSS via the "tamper" parameter in /admin/lib/phpthumb/phpthumb.php. An attacker coul

Vulnerability in RhinOS 3.0-1190 consisting of an XSS through the "search" parameter of /portal/search.htm. This vulnera

A vulnerability in RhinOS 3.0-1190 could allow PHP code injection through the "search" parameter in /portal/search.htm.

A vulnerability had been discovered in WinNMP 19.02 consisting of an XSS attack via index page in from, subject, text an

A vulnerability had been discovered in WinNMP 19.02 consisting of an XSS attack via /tools/redis.php page in the k, hash

A heap overflow vulnerability exists in libvpx - Encoding a frame that has larger dimensions than the originally configu

An issue was discovered in Logpoint SAML Authentication before 6.0.3. An attacker can place a crafted filename in the st

The affected device expose a network service called "rftest" that is vulnerable to unauthenticated command injection on

ASKEY 5G NR Small Cell fails to properly filter user input for certain functionality, allowing remote attackers with adm

Zoho ManageEngine ServiceDesk Plus versions below 14730, ServiceDesk Plus MSP below 14720 and SupportCenter Plus below 1

Deserialization of Untrusted Data vulnerability in PMB Services PMB allows Remote Code Inclusion.This issue affects PMB:

Openfind Mail2000 does not properly filter parameters of specific CGI. Remote attackers with regular privileges can expl

The KKProgressbar2 Free WordPress plugin through 1.1.4.2 does not have CSRF checks in some places, which could allow at

The KKProgressbar2 Free WordPress plugin through 1.1.4.2 does not have CSRF check in some places, and is missing saniti

The KKProgressbar2 Free WordPress plugin through 1.1.4.2 does not sanitize and escape a parameter before using it in a

The Business Card WordPress plugin through 1.0.0 does not have CSRF checks in some places, which could allow attackers t

The Business Card WordPress plugin through 1.0.0 does not have CSRF checks in some places, which could allow attackers t

The Business Card WordPress plugin through 1.0.0 does not have CSRF checks in some places, which could allow attackers t

The Business Card WordPress plugin through 1.0.0 does not have CSRF checks in some places, which could allow attackers t

The Ditty WordPress plugin before 3.1.36 does not sanitise and escape some of its settings, which could allow high priv

In Eclipse OpenJ9 release versions prior to 0.44.0 and after 0.13.0, when running with JVM option -Xgc:concurrentScaveng

Cross-site scripting vulnerability exists in WP Booking versions prior to 2.4.5. If this vulnerability is exploited, an

Cross-site scripting vulnerability exists in Splunk Config Explorer versions prior to 1.7.16. If this vulnerability is e

Openfind Mail2000 does not properly filter parameters of specific API. Remote attackers with administrative privileges c

Pointsharp Cryptshare Server before 7.0.0 has an XSS issue that is related to notification messages.

A vulnerability classified as critical was found in itsourcecode Online Student Enrollment System 1.0. Affected by this

A vulnerability classified as critical has been found in itsourcecode Online Student Enrollment System 1.0. Affected is

A vulnerability was found in itsourcecode Online Student Enrollment System 1.0. It has been rated as critical. This issu