2024

The authentication method in Apache Doris versions before 2.0.0 was vulnerable to timing attacks. Users are recommended

A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2). The affected application cons

An unauthenticated remote attacker can modify configurations to perform a remote code execution, gain root rights or per

DIR-822 Rev. B Firmware v2.02KRB09 and DIR-822-CA Rev. B Firmware v2.03WWb01 suffer from a LAN-Side Unauthenticated Remo

SAP NetWeaver Administrator AS Java (Administrator Log Viewer plug-in) - version 7.50, allows an attacker with high priv

NextChat, also known as ChatGPT-Next-Web, is a cross-platform chat user interface for use with ChatGPT. Versions 2.11.2

there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote code execution with no

A malicious DNS response can trigger a number of OOB reads, writes, and other memory issues

Exported broadcast receivers allowing malicious apps to bypass broadcast protection.

In attp_build_value_cmd of att_protocol.cc, there is a possible out of bounds write due to a missing bounds check. This

Buffer overflow in identifier field of WSD probe request process of Small Office Multifunction Printers and Laser Printe

An issue was discovered in gpac version 2.3-DEV-rev588-g7edc40fee-master, allows remote attackers to execute arbitrary c

An issue was discovered in Newland Nquire 1000 Interactive Kiosk version NQ1000-II_G_V1.00.011, allows remote attackers

An improper authentication vulnerability has been reported to affect several QNAP operating system versions. If exploite

In the module "Make an offer" (makeanoffer) <= 1.7.1 from PrestaToolKit for PrestaShop, a guest can perform SQL injectio

In the module "CD Custom Fields 4 Orders" (cdcustomfields4orders) <= 1.0.0 from Cleanpresta.com for PrestaShop, a guest

pgAdmin <= 8.3 is affected by a path-traversal vulnerability while deserializing users’ sessions in the session handling

Arbitrary File Overwrite Via Path Traversal in paddlepaddle/paddle before 2.6

remote code execution in paddlepaddle/paddle 2.6.0

JFrog Artifactory versions 7.59 and above, but below 7.59.18, 7.63.18, 7.68.19, 7.71.8 are vulnerable to an issue whereb

Student Enrollment In PHP v1.0 was discovered to contain a SQL injection vulnerability via the Login function.

code-projects.org Online Job Portal 1.0 is vulnerable to SQL Injection via the Username parameter for "Employer."

In Veritas NetBackup before 8.1.2 and NetBackup Appliance before 3.1.2, the BPCD process inadequately validates the file

nGrinder before 3.5.9 allows to accept serialized Java objects from unauthenticated users, which could allow remote atta

nGrinder before 3.5.9 uses old version of SnakeYAML, which could allow remote attacker to execute arbitrary code via uns

nGrinder before 3.5.9 allows connection to malicious JMX/RMI server by default, which could be the cause of executing ar

Heap based buffer flow in zlog v1.1.0 to v1.2.17 in zlog_rule_new().The size of record_name is MAXLEN_PATH(1024) + 1 but

An issue was discovered in Lustre versions 2.13.x, 2.14.x, and 2.15.x before 2.15.4, allows attackers to escalate privil

Hotel Booking Management v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at update.php

JSONata is a JSON query and transformation language. Starting in version 1.4.0 and prior to version 1.8.7 and 2.0.4, a m

pgx is a PostgreSQL driver and toolkit for Go. SQL injection can occur if an attacker can cause a single query or bind m

go-zero is a web and rpc framework. Go-zero allows user to specify a CORS Filter with a configurable allows param - whic

CasaOS-UserService provides user management functionalities to CasaOS. Starting in version 0.4.4.3 and prior to version

eProsima Fast DDS (formerly Fast RTPS) is a C++ implementation of the Data Distribution Service standard of the Object M

In Blue Planet® products through 22.12, a misconfiguration in the SAML implementation allows for privilege escalation.

Deserialization of Untrusted Data vulnerability in Apache InLong.This issue affects Apache InLong: from 1.8.0 through 1.

Multilaser RE160 v5.07.51_pt_MTL01 and v5.07.52_pt_MTL01, Multilaser RE160V v12.03.01.08_pt and V12.03.01.09_pt, and Mul

An issue in Multilaser RE160V firmware v12.03.01.09_pt and Multilaser RE163V firmware v12.03.01.10_pt allows attackers t

An issue in Jeewms v.3.7 and before allows a remote attacker to escalate privileges via the AuthInterceptor component.

Cross Site Scripting (XSS) vulnerability in Teamwire Windows desktop client v.2.0.1 through v.2.4.0 allows a remote atta

Cross Site Scripting vulnerability in Teamwire Windows desktop client v.2.0.1 through v.2.4.0 allows a remote attacker t

Services that are running and bound to the loopback interface on the Artica Proxy are accessible through the proxy servi

The "Rich Filemanager" feature of Artica Proxy provides a web-based interface for file management capabilities. When the

VMware ESXi, Workstation, and Fusion contain a use-after-free vulnerability in the UHCI USB controller. A malicious acto

VMware ESXi, Workstation, and Fusion contain a use-after-free vulnerability in the XHCI USB controller. A malicious acto

A Server-Side Request Forgery (SSRF) in weixin.php of ChatGPT-wechat-personal commit a0857f6 allows attackers to force t

Authentication Bypass by Primary Weakness vulnerability in ZKSoftware Biometric Security Solutions UFace 5 allows Authen

swftools v0.9.2 was discovered to contain a strcpy parameter overlap via /home/swftools/src/swfc+0x48318a.

Insufficiently protected credentials (CWE-522) for third party DVR integrations to the Command Centre Server are access

Customer Support System v1 was discovered to contain a SQL injection vulnerability via the subject parameter at /custome