2024

When parsing a multipart form (either explicitly with Request.ParseMultipartForm or implicitly with Request.FormValue, R

When following an HTTP redirect to a domain which is not a subdomain match or exact match of the initial domain, an http

Denial of service in PAM password rotation during the check-in process in Devolutions Server 2023.3.14.0 allows an authe

Improper session management in the identity provider authentication flow in Devolutions Server 2023.3.14.0 and earlier a

Improper access control in the notification feature in Devolutions Server 2023.3.14.0 and earlier allows a low privilege

Improper privilege management in Just-in-time (JIT) elevation module in Devolutions Server 2023.3.14.0 and earlier allow

Concrete CMS version 9 before 9.2.7 is vulnerable to Stored XSS via the Name field of a Group type since there is insuff

In Foxit PDF Reader before 2024.1 and PDF Editor before 2024.1, code execution via JavaScript could occur because of an

Aruba has identified certain configurations of ArubaOS that can lead to partial disclosure of sensitive information in t

An unauthenticated Denial-of-Service (DoS) vulnerability exists in the Spectrum service accessed via the PAPI protocol

There is an arbitrary file deletion vulnerability in the CLI used by ArubaOS. Successful exploitation of this vulnerabil

Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of

Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of

Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of

Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of

Services that are running and bound to the loopback interface on the Artica Proxy are accessible through the proxy servi

The "Rich Filemanager" feature of Artica Proxy provides a web-based interface for file management capabilities. When the

A memory corruption issue was addressed with improved validation. This issue is fixed in iOS 16.7.8 and iPadOS 16.7.8, i

A logic issue was addressed with improved state management. This issue is fixed in iOS 17.4 and iPadOS 17.4. A user's lo

A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in iOS 17.4 and

A memory corruption issue was addressed with improved validation. This issue is fixed in iOS 16.7.6 and iPadOS 16.7.6, i

IBM Watson CP4D Data Stores 4.6.0 through 4.6.3 could allow a user with physical access and specific knowledge of the sy

LDAP users on IBM Spectrum Virtualize 8.5 which are configured to require multifactor authentication can still authentic

IBM Aspera Faspex 5.0.0 and 5.0.1 is vulnerable to HTTP header injection, caused by improper validation of input by the

VMware ESXi, Workstation, and Fusion contain an information disclosure vulnerability in the UHCI USB controller. A malic

VMware ESXi contains an out-of-bounds write vulnerability. A malicious actor with privileges within the VMX process may

VMware ESXi, Workstation, and Fusion contain a use-after-free vulnerability in the UHCI USB controller. A malicious acto

VMware ESXi, Workstation, and Fusion contain a use-after-free vulnerability in the XHCI USB controller. A malicious acto

Deno is a JavaScript, TypeScript, and WebAssembly runtime with secure defaults. Insufficient validation of parameters in

ImageSharp is a managed, cross-platform, 2D graphics library. A heap-use-after-free flaw was found in ImageSharp's Initi

A Server-Side Request Forgery (SSRF) in weixin.php of ChatGPT-wechat-personal commit a0857f6 allows attackers to force t

pictureproxy.php in the dirk1983 mm1.ltd source code f9f4bbc allows SSRF via the url parameter. NOTE: the references sec

A Server-Side Request Forgery (SSRF) in the getFileFromRepo function of WonderCMS v3.1.3 allows attackers to force the a

A Server-Side Request Forgery (SSRF) in the installUpdateThemePluginAction function of WonderCMS v3.1.3 allows attackers

Code-projects Scholars Tracking System 1.0 is vulnerable to SQL Injection via the News Feed.

Online Flight Booking Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via th

A reflected cross-site scripting (XSS) vulnerability exists in SuperCali version 1.1.0, allowing remote attackers to exe

CMS Made Simple Version 2.2.19 is vulnerable to Cross Site Scripting (XSS). This vulnerability resides in the File Manag

CMS Made Simple version 2.2.19 is vulnerable to Server-Side Template Injection (SSTI). The vulnerability exists within t

A remote code execution vulnerability has been identified in the User Defined Tags module of CMS Made Simple version 2.2

Cross-Site Scripting (XSS) vulnerability stored in TP-Link Archer AX50 affecting firmware version 1.0.11 build 2022052.

Authentication Bypass by Primary Weakness vulnerability in ZKSoftware Biometric Security Solutions UFace 5 allows Authen

A CWE-1269 “Product Released in Non-Release Configuration” vulnerability in the Django web framework used by the web app

A CWE-613 “Insufficient Session Expiration” vulnerability in the web application, due to the session cookie “sessionid”

A CWE-646 “Reliance on File Name or Extension of Externally-Supplied File” vulnerability in the “iec61850” functionality

A CWE-425 “Direct Request ('Forced Browsing')” vulnerability in the “measure” functionality of the web application allow

A CWE-1236 “Improper Neutralization of Formula Elements in a CSV File” vulnerability in the “file_configuration” functio

A CWE-425 “Direct Request ('Forced Browsing')” vulnerability in the “file_configuration” functionality of the web applic

A CWE-434 “Unrestricted Upload of File with Dangerous Type” vulnerability in the “file_configuration” functionality of t

A CWE-552 “Files or Directories Accessible to External Parties” vulnerability in the embedded Chromium browser allows a