2024

The MM-email2image WordPress plugin through 0.2.5 does not validate and escape some of its shortcode attributes before o

The ENL Newsletter WordPress plugin through 1.0.1 does not sanitize and escape a parameter before using it in a SQL stat

The ENL Newsletter WordPress plugin through 1.0.1 does not have CSRF checks in some places, which could allow attackers

The ENL Newsletter WordPress plugin through 1.0.1 does not have CSRF check in some places, and is missing sanitisation a

The Bannerlid WordPress plugin through 1.1.0 does not escape generated URLs before outputting them in attributes, leadin

The Call Now Button WordPress plugin before 1.4.7 does not sanitise and escape some of its settings, which could allow

The WP Chat App WordPress plugin before 3.6.4 does not sanitise and escape some of its settings, which could allow high

The Salon booking system WordPress plugin through 9.6.5 does not sanitise and escape some of its settings, which could a

The Salon booking system WordPress plugin through 9.6.5 does not sanitise and escape some of its settings, which could a

The Salon booking system WordPress plugin through 9.6.5 does not have CSRF check in place when updating its settings, wh

The WP Google Review Slider WordPress plugin before 13.6 does not sanitise and escape some of its settings, which could

The Social Sharing Plugin WordPress plugin before 3.3.61 does not validate and escape some of its shortcode attributes

The Fancy Product Designer WordPress plugin before 6.1.8 does not sanitise and escape a parameter before outputting it b

A flaw was found in cri-o, where an arbitrary systemd property can be injected via a Pod annotation. Any user who can cr

Server-Side Template Injection (SSTI) vulnerability in inducer relate before v.2024.1 allows a remote attacker to execut

Server-Side Template Injection (SSTI) vulnerability in inducer relate before v.2024.1, allows remote attackers to execut

Setor Informatica Sistema Inteligente para Laboratorios (S.I.L.) 388 was discovered to contain a remote code execution (

Setor Informatica Sistema Inteligente para Laboratorios (S.I.L.) 388 was discovered to contain a remote code execution (

The Skylab IGX IIoT Gateway allowed users to connect to it via a limited shell terminal (IGX). However, it was discovere

cJSON v1.7.17 was discovered to contain a segmentation violation, which can trigger through the second parameter of func

An issue was discovered in PnpSmm in Insyde InsydeH2O with kernel 5.0 through 5.6. There is a possible out-of-bounds acc

An issue was discovered in Veritas Backup Exec before 22.2 HotFix 917391. Improper access controls allow for DLL Hijacki

An issue was discovered in Veritas NetBackup before 10.4. The Multi-Threaded Agent used in NetBackup can be leveraged to

An issue was discovered in Veritas Backup Exec before 22.2 HotFix 917391. The Backup Exec Deduplication Multi-threaded S

Passbolt API before 4.6.2 allows HTML injection in a URL parameter, resulting in custom content being displayed when a u

An issue was discovered in Passbolt Browser Extension before 4.6.2. It can send multiple requests to HaveIBeenPwned whil

An issue was discovered in Zammad before 6.3.0. The Zammad Upload Cache uses insecure, partially guessable FormIDs to id

An issue was discovered in Zammad before 6.3.0. An authenticated agent could perform a remote Denial of Service attack b

An issue was discovered in Zammad before 6.3.0. Users with customer access to a ticket could have accessed time accounti

angular-translate through 2.19.1 allows XSS via a crafted key that is used by the translate directive. NOTE: the vendor

In deletefiles in FDUPES before 2.2.0, a TOCTOU race condition allows arbitrary file deletion via a symlink.

python-jose through 3.3.0 allows attackers to cause a denial of service (resource consumption) during a decode via a cra

python-jose through 3.3.0 has algorithm confusion with OpenSSH ECDSA keys and other key formats. This is similar to CVE-

Portainer before 2.20.0 allows redirects when the target is not index.yaml.

ZITADEL provides users the possibility to use Time-based One-Time-Password (TOTP) and One-Time-Password (OTP) through SM

changedetection.io is an open source web page change detection, website watcher, restock monitor and notification servic

Unauthenticated file upload allows remote code execution. This issue affects UvDesk Community: from 1.0.0 through 1.1.3.

The Advanced Search WordPress plugin through 1.1.6 does not properly escape parameters appended to an SQL query, making

File Upload vulnerability in the function for employees to upload avatars in Code-Projects Simple School Management Syst

Cross Site Scripting (XSS) vulnerability in BOSSCMS v3.10 allows attackers to run arbitrary code via the header code and

Greenlight is an end-user interface for BigBlueButton servers. Versions prior to 2.13.0 have an open redirect vulnerabil

Greenlight is an end-user interface for BigBlueButton servers. Versions prior to 2.13.0 have an open redirect vulnerabil

Buffer Overflow vulnerability in Shenzhen Libituo Technology Co., Ltd LBT-T300-T400 v.3.2 allows a local attacker to exe

ThinkCMF 6.0.9 is vulnerable to File upload via UeditorController.php.

An issue discovered in Yealink VP59 Teams Editions with firmware version 91.15.0.118 allows a physically proximate attac

A flaw was found in Quay, where Quay's database is stored in plain text in mirror-registry on Jinja's config.yaml file.

A flaw was found in how Quay's database is stored in plain-text in mirror-registry on the jinja's config.yaml file. This

A flaw was found when using mirror-registry to install Quay. It uses a default database secret key, which is stored in p

A flaw was found when using mirror-registry to install Quay. It uses a default secret, which is stored in plain-text for

A flaw was found in Bombastic, which allows authenticated users to upload compressed (bzip2 or zstd) SBOMs. The API endp