2024

The Admin side data storage for Contact Form 7 plugin for WordPress is vulnerable to Cross-Site Request Forgery in all v

The Admin side data storage for Contact Form 7 plugin for WordPress is vulnerable to SQL Injection via the 'form-id' par

Sametime Connect desktop chat client includes, but does not use or require, the use of an Eclipse feature called Secure

Applications that use UriComponentsBuilder to parse an externally provided URL (e.g. through a query parameter) AND perf

** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, has been found in D-Link DIR-600M C1

A vulnerability classified as problematic was found in Limbas 5.2.14. Affected by this vulnerability is an unknown funct

A vulnerability classified as critical has been found in Totolink LR1200GB 9.1.0u.6619_B20230130/9.3.5u.6698_B20230810.

A vulnerability was found in Totolink X6000R AX3000 9.4.0cu.852_20230719. It has been rated as critical. This issue affe

A DLL injection vulnerability exists where an authenticated, low-privileged local attacker could modify application fil

A Stack Based Buffer Overflow vulnerability in Tenda AC9 v.3.0 with firmware version v.15.03.06.42_multi allows a remote

Stack Based Buffer Overflow vulnerability in Tenda AC9 v.3.0 with firmware version v.15.03.06.42_multi allows a remote a

A Stack Based Buffer Overflow vulnerability in tenda AC9 AC9 v.3.0 with firmware version v.15.03.06.42_multi allows a re

### Summary On all Label Studio versions prior to 1.11.0, data imported via file upload feature is not properly sanitize

Stack Based Buffer Overflow vulnerability in Tenda AC9 v.3.0 with firmware version v.15.03.06.42_multi allows a remote a

The ACME-challenge endpoint in Appwrite 0.5.0 through 0.12.x before 0.12.2 allows remote attackers to read arbitrary loc

A reflected Cross-Site Scripting (XSS) vulnerability in FUEL CMS 1.5.2allows attackers to run arbitrary code via crafted

A vulnerability, which was classified as critical, was found in TemmokuMVC up to 2.3. Affected is the function get_img_u

A vulnerability, which was classified as problematic, has been found in Bdtask Bhojon Best Restaurant Management Softwar

A vulnerability classified as critical was found in van_der_Schaar LAB AutoPrognosis 0.1.21. This vulnerability affects

The `mjml` PyPI package, found at the `FelixSchwarz/mjml-python` GitHub repo, is an unofficial Python port of MJML, a ma

baserCMS is a website development framework. Prior to version 5.0.9, there is a cross-site scripting vulnerability in th

An issue in flvmeta v.1.2.2 allows a local attacker to cause a denial of service via the flvmeta/src/flv.c:375:21 functi

Tuleap is an open source suite to improve management of software developments and collaboration. Prior to version 15.5.9

The CodeQL CLI repo holds binaries for the CodeQL command line interface (CLI). Prior to version 2.16.3, an XML parser u

WayOS IBR-7150 <17.06.23 is vulnerable to Cross Site Scripting (XSS).

SKINsoft S-Museum 7.02.3 allows Unrestricted File Upload via the Add Media function. Unlike in CVE-2024-25801, the attac

Discourse Calendar adds the ability to create a dynamic calendar in the first post of a topic on the open-source discuss

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix UAF issue in ksmbd_tcp_new_connection()

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix re-attachment branch in bpf_tracing_prog_a

In the Linux kernel, the following vulnerability has been resolved: erofs: fix inconsistent per-file compression format

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject variable offset alu on PTR_TO_FLOW_KEYS

In the Linux kernel, the following vulnerability has been resolved: LoongArch: BPF: Prevent out-of-bounds memory access

In the Linux kernel, the following vulnerability has been resolved: net: netdevsim: don't try to destroy PHC on VFs PH

In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrum_acl_tcam: Fix stack corruption Whe

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix accesses to uninit stack slots Privileged

In the Linux kernel, the following vulnerability has been resolved: powerpc/pseries/memhp: Fix access beyond end of drm

In the Linux kernel, the following vulnerability has been resolved: perf/x86/intel/uncore: Fix NULL pointer dereference

In the Linux kernel, the following vulnerability has been resolved: mtd: Fix gluebi NULL pointer dereference caused by

In the Linux kernel, the following vulnerability has been resolved: gfs2: Fix kernel NULL pointer dereference in gfs2_r

In the Linux kernel, the following vulnerability has been resolved: bpf: Defer the free of inner map when necessary Wh

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix a race condition between btf_put() and map

In the Linux kernel, the following vulnerability has been resolved: media: pvrusb2: fix use after free on context disco

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid dirent corruption As Al reporte

In the Linux kernel, the following vulnerability has been resolved: apparmor: avoid crash when parsed profile name is e

The Access Point functionality in eapol_auth_key_handle in eapol.c in iNet wireless daemon (IWD) before 2.14 allows atta

The implementation of PEAP in wpa_supplicant through 2.10 allows authentication bypass. For a successful attack, wpa_sup

cmseasy V7.7.7.9 has an arbitrary file deletion vulnerability in lib/admin/template_admin.php.

Hertzbeat is a real-time monitoring system. In the implementation of `JmxCollectImpl.java`, `JMXConnectorFactory.connect

Hertzbeat is a real-time monitoring system. At the interface of `/define/yml`, SnakeYAML is used as a parser to parse ym

Hertzbeat is a real-time monitoring system. In `CalculateAlarm.java`, `AviatorEvaluator` is used to directly execute the