2024

SAP HCM Approve Timesheets Version 4 application does not perform necessary authorization checks for an authenticated us

An attacker authenticated as an administrator can use an exposed webservice to create a PDF with an embedded attachment.

An attacker authenticated as an administrator can use an exposed webservice to upload or download a custom PDF font file

Adobe Document Service allows an attacker with administrator privileges to send a crafted request from a vulnerable web

Webservice API endpoints for Assisted Service Module within SAP Commerce Cloud has information disclosure vulnerability.

SAP Product Lifecycle Costing Client (versions below 4.7.1) application loads on demand a DLL that is available with Win

Under certain conditions SAP BusinessObjects Business Intelligence platform allows an attacker to access information whi

A reflected cross-site scripting (XSS) vulnerability exists in PaperCut NG/MF. This issue can be used to execute special

Deserialization of Untrusted Data vulnerability in Drupal Core allows Object Injection.This issue affects Drupal Core: f

Deserialization of Untrusted Data vulnerability in Drupal Core allows Object Injection.This issue affects Drupal Core: f

Deserialization of Untrusted Data vulnerability in Drupal Core allows Object Injection.This issue affects Drupal Core: f

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Drupal Core

A vulnerability in Drupal Core allows Privilege Escalation.This issue affects Drupal Core: from 8.0.0 before 10.2.11, fr

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Drupal Core

Hugo is a static site generator. Starting in version 0.123.0 and prior to version 0.139.4, some HTML attributes in Markd

An issue was discovered in the web services of Digi ConnectPort LTS before 1.4.12. It allows an attacker on the local ar

An issue was discovered in Digi ConnectPort LTS before 1.4.12. A Privilege Escalation vulnerability exists in the file u

An issue was discovered in Digi ConnectPort LTS before 1.4.12. A Directory Traversal vulnerability exists in WebFS. This

An issue was discovered in Digi ConnectPort LTS before 1.4.12. A vulnerability in the file upload handling of a web appl

An Improper Certificate Validation vulnerability exists in Tenable Security Center where an authenticated, privileged at

Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 11.0.0 and prior to

Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework. Winter CMS prior to ve

unstructured v.0.14.2 and before is vulnerable to XML External Entity (XXE) via the XMLParser.

A vulnerability was found in OIDC-Client. When using the RH SSO OIDC adapter with EAP 7.x or when using the elytron-oidc

An issue in the index.js decryptCookie function of cookie-encrypter v1.0.1 allows attackers to execute a bit flipping at

A Directory Listing issue was found in Kashipara E-Learning Management System v1.0, which allows remote attackers to acc

Kashipara E-learning Management System v1.0 is vulnerable to SQL Injection in /admin/delete_class.php.

Kashipara E-learning Management System v1.0 is vulnerable to SQL Injection in /admin/delete_department.php.

A SQL Injection was found in /admin/delete_event.php in kashipara E-learning Management System v1.0, which allows remote

kashipara E-learning Management System v1.0 is vulnerable to SQL Injection in /admin/delete_teacher.php,

Kashipara E-learning Management System v1.0 is vulnerable to SQL Injection in /admin/delete_users.php.

A SQL Injection was found in /remove_sent_message.php in kashipara E-learning Management System v1.0, which allows remot

A SQL Injection was found in /admin/edit_content.php in kashipara E-learning Management System v1.0, which allows remote

A SQL Injection vulnerability was found in /admin/edit_teacher.php in kashipara E-learning Management System v1.0, which

A SQL Injection was found in /student_signup.php in kashipara E-learning Management System v1.0, which allows remote att

Kashipara E-learning Management System v1.0 is vulnerable to Remote Code Execution via File Upload in /teacher_avatar.ph

Altair is a GraphQL client for all platforms. Prior to version 8.0.5, Altair GraphQL Client's desktop app does not valid

The Trix rich text editor, prior to versions 2.1.9 and 1.3.3, is vulnerable to cross-site scripting (XSS) + mutation XSS

Tuleap is an open source suite to improve management of software developments and collaboration. In Tuleap Community Edi

eLabFTW is an open source electronic lab notebook for research labs. A vulnerability has been found starting in version

Serviceware Processes 6.0 through 7.3 before 7.4 allows attackers without valid authentication to send a specially craft

A vulnerability was found in Romain Bourdon Wampserver all versions (discovered in v3.2.3 and v3.2.6) where unauthorized

User credentials (login & password) are inserted into log files when a user tries to authenticate using a version of a W

AMI (aka American Megatrends) NTFS driver 1.0.0 (fixed in late 2021 or early 2022) has a buffer overflow. This driver is

A Stored Cross-Site Scripting (XSS) vulnerability was found in /send_message_teacher_to_student.php of kashipara E-learn

Kashipara E-learning Management System v1.0 is vulnerable to SQL Injection in /admin/delete_content.php.

Kashipara E-learning Management System v1.0 is vulnerable to SQL Injection in /admin/delete_student.php.

A SQL Injection was found in /admin/edit_user.php of kashipara E-learning Management System v1.0, which allows remote at

A maliciously crafted SKP file, when linked or imported into Autodesk Revit, can be used to cause a Heap-based Overflow.

A maliciously crafted DLL file, when placed in the same directory as an RVT file could be loaded by Autodesk Revit, and