2024

A cross-site request forgery (CSRF) vulnerability in all versions up to 1.14.1 of the api server component of Allegro AI

Lack of authentication in all versions of the fileserver component of Allegro AI’s ClearML platform allows a remote atta

In JetBrains TeamCity before 2023.11.3 authentication bypass leading to RCE was possible

A default installation of RustDesk 1.2.3 on Windows places a WDKTestCert certificate under Trusted Root Certification Au

Memory corruption in Core while processing control functions.

D-LINK Go-RT-AC750 GORTAC750_A1_FW_v101b03 has a hardcoded password for the Alphanetworks account, which allows remote a

D-Link Go-RT-AC750 GORTAC750_A1_FW_v101b03 contains a stack-based buffer overflow via the function genacgi_main. This vu

xmall v1.1 was discovered to contain a SQL injection vulnerability via the orderDir parameter.

Buffer overflow in CPCA PCFAX number process of Office Multifunction Printers and Laser Printers(*) which may allow an a

Buffer overflow in CPCA Color LUT Resource Download process of Office Multifunction Printers and Laser Printers(*) which

Buffer overflow in SLP attribute request process of Office Multifunction Printers and Laser Printers(*) which may allow

Buffer overflow in the Address Book username process in authentication of Mobile Device Function of Office Multifunction

Buffer overflow in WSD probe request process of Office Multifunction Printers and Laser Printers(*) which may allow an a

Buffer overflow in the Address Book password process in authentication of Mobile Device Function of Office Multifunction

Buffer overflow in CPCA PDL Resource Download process of Office Multifunction Printers and Laser Printers(*) which may a

An OS command injection vulnerability in Hardy Barth cPH2 eCharge Ladestation v1.87.0 and earlier, may allow an unauthen

Directory Traversal vulnerability in Stimulsoft GmbH Stimulsoft Dashboard.JS before v.2024.1.2 allows a remote attacker

An issue in symphony v.3.6.3 and before allows a remote attacker to execute arbitrary code via the log4j component.

A local file include could be remotely triggered in Gradio due to a vulnerable user-supplied JSON value in an API reques

The Cryptocurrency Widgets – Price Ticker & Coins List plugin for WordPress is vulnerable to SQL Injection via the 'coin

The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Directory Traversal in

The Shield Security – Smart Bot Blocking & Intrusion Prevention Security plugin for WordPress is vulnerable to Local Fil

Buffer Overflow vulnerability in the function setSchedWifi in Tenda AC9 v.3.0, firmware version v.15.03.06.42_multi allo

SQL Injection vulnerability in Stock Management System 1.0 allows a remote attacker to execute arbitrary code via the id

An issue in Plone Docker Official Image 5.2.13 (5221) open-source software that could allow for remote code execution du

The FTP server used on the B&R Automation Runtime supports unsecure encryption mechanisms, such as SSLv3, TLSv1.0 and TL

An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet

An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet

The 3DPrint Lite WordPress plugin before 1.9.1.5 does not have any authorisation and does not check the uploaded file in

Sharp NEC Displays (P403, P463, P553, P703, P801, X554UN, X464UN, X554UNS, X464UNV, X474HB, X464UNS, X554UNV, X555UNS, X

In alac decoder, there is a possible information disclosure due to an incorrect bounds check. This could lead to remote

Malwarebytes Binisoft Windows Firewall Control before 6.9.9.2 allows remote attackers to execute arbitrary code via gRPC

Artifex Ghostscript before 9.53.0 has an out-of-bounds write and use-after-free in devices/vector/gdevtxtw.c (for txtwri

JFinalCMS 5.0.0 is vulnerable to SQL injection via /admin/content/data.

An issue was discovered in GTB Central Console 15.17.1-30814.NG. The method setTermsHashAction at /opt/webapp/lib/PureAp

An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited,

Dell BSAFE SSL-J version 7.0 and all versions prior to 6.5, and Dell BSAFE Crypto-J versions prior to 6.2.6.1 contain a

Unrestricted Upload of File with Dangerous Type vulnerability in National Keep Cyber Security Services CyberMath allows

IBM Tivoli Application Dependency Discovery Manager 7.3.0.0 through 7.3.0.10 is vulnerable to HTTP header injection, cau

An issue in Blurams Lumi Security Camera (A31C) v23.0406.435.4120 allows attackers to execute arbitrary code.

Heap-based buffer overflow vulnerability exists in HOME SPOT CUBE2 V102 and earlier. By processing invalid values, arbit

Central Dogma versions prior to 0.64.1 is vulnerable to Cross-Site Scripting (XSS), which could allow for the leakage of

Aprktool before 2.9.3 on Windows allows ../ and /.. directory traversal.

Before Beetl v3.15.12, the rendering template has a server-side template injection (SSTI) vulnerability. When the incomi

IBM Operational Decision Manager 8.10.3 could allow a remote authenticated attacker to execute arbitrary code on the sys

Miro Desktop 0.8.18 on macOS allows local Electron code injection via a complex series of steps that might be usable in

Vinchin Backup & Recovery v7.2 was discovered to be configured with default root credentials.

Vinchin Backup & Recovery v7.2 was discovered to use default MYSQL credentials.

Zoho ManageEngine ADAudit Plus through 7250 allows SQL Injection in the aggregate report feature.

Zoho ManageEngine ADAudit Plus through 7250 is vulnerable to SQL Injection in the report export option.