2024

In Spring Security, versions 6.1.x prior to 6.1.7 and versions 6.2.x prior to 6.2.2, an application is vulnerable to bro

Open redirect vulnerability in adaptive media administration page in Liferay DXP 2023.Q3 before patch 6, and 7.4 GA thro

Open redirect vulnerability in the Countries Management’s edit region page in Liferay Portal 7.4.3.45 through 7.4.3.101,

Liferay Portal before 7.4.3.16 and Liferay DXP before 7.2 fix pack 19, 7.3 before update 6, and 7.4 before update 16 all

The Link Library plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'll_reciprocal' parameter in

The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the

A format string vulnerability in a function of the IPSec VPN feature in Zyxel ATP series firmware versions f

A vulnerability in Node.js HTTP servers allows an attacker to send a specially crafted HTTP request with chunked encodin

The permission model protects itself against path traversal attacks by calling path.resolve() on any paths given by the

On Linux, Node.js ignores certain environment variables if those may have been set by an unprivileged user while the pro

Node.js depends on multiple built-in utility functions to normalize paths provided to node:fs functions, which can be ov

The Node.js Permission Model does not clarify in the documentation that wildcards should be only used as the last charac

Expression Language Injection vulnerability in Hitachi Global Link Manager on Windows allows Code Injection.This issue a

A format string vulnerability in Zyxel ATP series firmware versions from 4.32 through 5.37 Patch 1, USG FLEX series firm

A post-authentication command injection vulnerability in the file upload binary in Zyxel ATP series firmware versions fr

A null pointer dereference vulnerability in Zyxel ATP series firmware versions from 4.32 through 5.37 Patch

electron-pdf version 20.0.0 allows an external attacker to remotely obtain arbitrary local files. This is possible beca

Pyhtml2pdf version 0.0.6 allows an external attacker to remotely obtain arbitrary local files. This is possible because

Torrentpier version 2.4.1 allows executing arbitrary commands on the server. This is possible because the application i

Suite CRM version 7.14.2 allows including local php files. This is possible because the application is vulnerable to LF

Loomio version 2.22.0 allows executing arbitrary commands on the server. This is possible because the application is vu

Yealink Config Encrypt Tool add RSA before 1.2 has a built-in RSA key pair, and thus there is a risk of decryption by an

cbor2 provides encoding and decoding for the Concise Binary Object Representation (CBOR) (RFC 8949) serialization format

PrestaShop is an open-source e-commerce platform. Starting in version 8.1.0 and prior to version 8.1.4, PrestaShop is vu

The documentation specifies that the BT_GATT_PERM_READ_LESC and BT_GATT_PERM_WRITE_LESC defines for a Bluetooth characte

A vulnerability was found in Undertow. This vulnerability impacts a server that supports the wildfly-http-client protoco

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Brivo ACS100

Insufficiently Protected Credentials, : Improper Access Control vulnerability in Brivo ACS100, ACS300 allows Password Re

Iris is a web collaborative platform that helps incident responders share technical details during investigations. A sto

Misskey is an open source, decentralized social media platform with ActivityPub support. Prior to version 2024.2.0, when

alf.io is an open source ticket reservation system. Prior to version 2.0-Mr-2402, organization owners can view the gener

alf.io is an open source ticket reservation system. Prior to version 2.0-Mr-2402, an attacker can access data from other

Yocto Project is an open source collaboration project that helps developers create custom Linux-based systems regardless

eProsima Fast DDS (formerly Fast RTPS) is a C++ implementation of the Data Distribution Service standard of the Object M

Insufficient checks in a web service made it possible to add comments to the comments block on another user's dashboard

The link to update all installed language packs did not include the necessary token to prevent a CSRF risk.

Separate Groups mode restrictions were not honored when performing a forum export, which would export forum data for all

Separate Groups mode restrictions were not honored in the H5P attempts report, which would display users from other grou

The URL parameters accepted by forum search were not limited to the allowed parameters.

Insufficient file size checks resulted in a denial of service risk in the file picker's unzip functionality.

During the secure boot, bl2 (the second stage of the bootloader) loops over images defined in the table “bl2_mem_params_

Pimcore's Admin Classic Bundle provides a Backend UI for Pimcore. A potential security vulnerability has been discovered

Mastodon is a free, open-source social network server based on ActivityPub. Prior to versions 4.2.7, 4.1.15, 4.0.15, and

pgjdbc, the PostgreSQL JDBC Driver, allows attacker to inject SQL if using PreferQueryMode=SIMPLE. Note this is not the

Weak MySQL database root password in LaborOfficeFree affects version 19.10. This vulnerability allows an attacker to cal

Weak MySQL database root password in LaborOfficeFree affects version 19.10. This vulnerability allows an attacker to per

Encrypted database credentials in LaborOfficeFree affecting version 19.10. This vulnerability allows an attacker to read

A weak permission was found in the backup directory in LaborOfficeFree affecting version 19.10. This vulnerability allow

An integer overflow in dav1d AV1 decoder that can occur when decoding videos with large frame size. This can lead to mem

Allocation of Resources Without Limits or Throttling vulnerability in Apache Commons Compress.This issue affects Apache