2024

An XML external entity injection (XXE) vulnerability in HPE Insight Remote Support may allow remote users to disclose in

A java deserialization vulnerability in HPE Remote Insight Support may allow an unauthenticated attacker to execute code

An XML external entity injection (XXE) vulnerability in HPE Insight Remote Support may allow remote users to disclose in

qiwen-file v1.4.0 was discovered to contain a SQL injection vulnerability via the component /mapper/NoticeMapper.xml.

lakeFS is an open-source tool that transforms object storage into a Git-like repository. Existing lakeFS users who have

A vulnerability was found in Tenda AC8 16.03.34.09 and classified as critical. Affected by this issue is the function ro

A vulnerability has been found in 1000 Projects Portfolio Management System MCA 1.0 and classified as critical. Affected

A vulnerability was found in CRI-O, where it can be requested to take a checkpoint archive of a container and later be a

Microsoft Dynamics 365 Sales Spoofing Vulnerability

Missing authentication for critical function in Microsoft Azure PolicyWatch allows an unauthorized attacker to elevate p

Improper neutralization of input during web page generation ('Cross-site Scripting') in Copilot Studio by an unauthorize

An improper access control vulnerability in Partner.Microsoft.com allows an a unauthenticated attacker to elevate privil

A vulnerability, which was classified as problematic, was found in SourceCodester Best House Rental Management System 1.

A vulnerability, which was classified as problematic, has been found in SourceCodester Best House Rental Management Syst

Valor Apps Easy Folder Listing Pro has a deserialization vulnerability that allows an unauthenticated, remote attacker t

An issue has been discovered in GitLab EE affecting all versions starting from 17.3 before 17.3.7, all versions starting

Insufficiently Protected Credentials vulnerability in OpenText™ AccuRev allows Authentication Bypass. When installed on

A Denial of Service (DoS) issue has been discovered in GitLab CE/EE affecting all versions prior to 12.6 prior to 17.4.5

An issue was discovered in GitLab CE/EE affecting all versions starting from 15.6 prior to 17.4.5, starting from 17.5 pr

An issue has been discovered in GitLab CE/EE affecting all versions from 8.12 before 17.4.5, 17.5 before 17.5.3, and 17.

E.D.D.I (Enhanced Dialog Driven Interface) is a middleware to connect and manage LLM API bots. A path traversal vulnerab

A cross-site scripting (XSS) vulnerability in the Article module of SPIP v4.3.3 allows authenticated attackers to execut

An authenticated arbitrary file upload vulnerability in the Documents module of SPIP v4.3.3 allows attackers to execute

sigstore-java is a sigstore java client for interacting with sigstore infrastructure. sigstore-java has insufficient ver

Fides is an open-source privacy engineering platform. The user invite acceptance API endpoint lacks server-side password

Lobe Chat is an open-source, AI chat framework. Versions of lobe-chat prior to 1.19.13 have an unauthorized ssrf vulnera

A denial of service (DoS) condition was discovered in GitLab CE/EE affecting all versions from 13.2.4 before 17.4.5, 17.

An issue was discovered in GitLab CE/EE affecting all versions from 16.9.8 before 17.4.5, 17.5 before 17.5.3, and 17.6 b

An issue has been discovered in GitLab CE/EE affecting all versions from 16.11 before 17.4.5, 17.5 before 17.5.3, and 17

Local File Inclusion (LFI) vulnerability has been discovered in TCPDF 6.7.5. This vulnerability enables a user to read a

The Sugar Calendar – Simple Event Management plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to

A CSV injection vulnerability in Taiga v6.8.1 allows attackers to execute arbitrary code via uploading a crafted CSV fil

A stored cross-site scripting (XSS) vulnerability was identified in PHPGURUKUL Vehicle Parking Management System v1.13 i

There exists a denial of service through Data corruption in gRPC-C++ - gRPC-C++ servers with transmit zero copy enabled

A log spoofing flaw was found in the Tuned package due to improper sanitization of some API arguments. This flaw allows

A script injection vulnerability was identified in the Tuned package. The `instance_create()` D-Bus function can be call

The implementation of atob in "Zabbix JS" allows to create a string with arbitrary content and use it to access internal

When a URL is added to the map element, it is recorded in the database with sequential IDs. Upon adding a new URL, the s

A vulnerability exists in NSD570 that allows any authenticated user to access all device logs disclosing login informati

A vulnerability exists in NSD570 login panel that does not restrict excessive authentication attempts. If exploited, thi

The Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid plugin for WordPress is vulnerable to Remo

The Elementor Website Builder – More than Just a Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Sc

Under certain circumstances, navigating to a webpage would result in the address missing from the location URL bar, maki

Accessing a non-secure HTTP site that uses a non-existent port may cause the SSL padlock icon in the location URL bar to

Missing thread synchronization primitives could have led to a data race on members of the PlaybackParams structure. This

A null pointer dereference may have inadvertently occurred in `pk12util`, and specifically in the `SEC_ASN1DecodeItem_Ut

`NSC_DeriveKey` inadvertently assumed that the `phKey` parameter is always non-NULL. When it was passed as NULL, a segme

A double-free issue could have occurred in `sec_pkcs7_decoder_start_decrypt()` when handling an error path. Under specif

On Android, Firefox may have inadvertently allowed viewing saved passwords without the required device PIN authenticatio

Copying sensitive information from Private Browsing tabs on Android, such as passwords, may have inadvertently stored da