2024

nonebot2 is a cross-platform Python asynchronous chatbot framework written in Python. This security advisory pertains to

A vulnerability was found in Linksys WRT54GL 4.30.18 and classified as problematic. Affected by this issue is some unkno

wolfSSL SP Math All RSA implementation is vulnerable to the Marvin Attack, new variation of a timing Bleichenbacher styl

Sametime is impacted by a failure to invalidate sessions. The application is setting sensitive cookie values in a persi

Sametime is impacted by sensitive information passed in URL.

Sametime is impacted by a Cross Site Request Forgery (CSRF) vulnerability. Some REST APIs in the Sametime Proxy applica

Concrete CMS in version 9 before 9.2.5 is vulnerable to reflected XSS via the Image URL Import Feature due to insufficie

Concrete CMS version 9 before 9.2.5 is vulnerable to stored XSS in file tags and description attributes since administra

Concrete CMS version 9 before 9.2.5 is vulnerable to  stored XSS via the Role Name field since there is insufficient val

Improper Control of Dynamically-Managed Code Resources, Unrestricted Upload of File with Dangerous Type, Inclusion of Fu

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Solr.This issue affects Apache Solr:

Incorrect Permission Assignment for Critical Resource, Improper Control of Dynamically-Managed Code Resources vulnerabil

Insufficiently Protected Credentials vulnerability in Apache Solr. This issue affects Apache Solr: from 6.0.0 through 8

Mattermost fails to check if a custom emoji reaction exists when sending it to a post and to limit the amount of custom

Bento4 v1.6.0-640 was discovered to contain a NULL pointer dereference via the AP4_DescriptorFinder::Test() function.

Bento4 v1.6.0-640 was discovered to contain a NULL pointer dereference via the AP4_StszAtom::GetSampleSize() function.

Bento4 v1.6.0-640 was discovered to contain an out-of-memory bug via the AP4_UrlAtom::AP4_UrlAtom() function.

Bento4 v1.6.0-640 was discovered to contain an out-of-memory bug via the AP4_DataBuffer::ReallocateBuffer() function.

imlib2 v1.9.1 was discovered to mishandle memory allocation in the function init_imlib_fonts().

An issue in the imlib_free_image_and_decache function of imlib2 v1.9.1 allows attackers to cause a heap buffer overflow

An issue in the imlib_load_image_with_error_return function of imlib2 v1.9.1 allows attackers to cause a heap buffer ove

An issue in the HuginBase::PTools::setDestImage function of Hugin v2022.0.0 allows attackers to cause a heap buffer over

Improper handling of values in HuginBase::PTools::Transform::transform of Hugin 2022.0.0 leads to an assertion failure.

An issue in the HuginBase::ImageVariable<double>::linkWith function of Hugin v2022.0.0 allows attackers to cause a heap-

An issue in the HuginBase::PanoramaMemento::loadPTScript function of Hugin v2022.0.0 allows attackers to cause a heap bu

Mattermost fails to check the required permissions in the POST /api/v4/channels/stats/member_count API resulting in chan

Mattermost Jira Plugin handling subscriptions fails to check the security level of an incoming issue or limit it based o

Mattermost Jira Plugin fails to protect against logout CSRF allowing an attacker to post a specially crafted message tha

Code-projects Hotel Managment System 1.0 allows SQL Injection via the 'pid' parameter in Hotel/admin/print.php?pid=2.

Code-projects Hotel Managment System 1.0 allows SQL Injection via the 'eid' parameter in Hotel/admin/usersettingdel.php?

Code-projects Hotel Managment System 1.0, allows SQL Injection via the 'rid' parameter in Hotel/admin/roombook.php?rid=2

Code-projects Hotel Managment System 1.0, allows SQL Injection via the 'sid' parameter in Hotel/admin/show.php?sid=2.

Code-projects Simple School Managment System 1.0 allows SQL Injection via the 'id' parameter at "School/delete.php?id=5.

Code-projects Cinema Seat Reservation System 1.0 allows SQL Injection via the 'id' parameter at "/Cinema-Reservation/boo

Sourcecodester Event Student Attendance System 1.0, allows SQL Injection via the 'student' parameter.

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Oduyo Financial Te

Code-projects Simple School Managment System 1.0 allows Authentication Bypass via the username and password parameters a

Code-projects Simple School Managment System 1.0 allows SQL Injection via the 'id' parameter at "School/sub_delete.php?i

Code-projects Simple School Managment System 1.0 allows SQL Injection via the 'pass' parameter at School/teacher_login.p

Code-projects Simple School Managment System 1.0 allows SQL Injection via the 'name' parameter at School/teacher_login.p

Code-projects Simple School Managment System 1.0 allows SQL Injection via the 'aname' parameter at "School/index.php".

Code-projects Simple School Managment System 1.0 allows Authentication Bypass via the username and password parameters a

Code-projects Simple School Managment System 1.0 allows SQL Injection via the 'apass' parameter at "School/index.php."

Authorization Bypass Through User-Controlled Key vulnerability in Software Engineering Consultancy Machine Equipment Lim

In PQUIC before 5bde5bb, retention of unused initial encryption keys allows attackers to disrupt a connection with a PSK

In LiteSpeed QUIC (LSQUIC) Library before 4.0.4, DCID validation is mishandled.

In Min before 1.31.0, local files are not correctly treated as unique security origins, which allows them to improperly

An issue was discovered in MISP before 2.4.184. A client does not need to use POST to start an export generation process

An issue was discovered in MISP before 2.4.184. Organisation logo upload is insecure because of a lack of checks for the

The cause of vulnerability is improper validation of form input field “Name” on Graph page in Items section.