2024

The issue was addressed with improved memory handling. This issue is fixed in macOS Sonoma 14.2. Processing a file may l

This issue was addressed by removing the vulnerable code. This issue is fixed in tvOS 17, watchOS 10, macOS Sonoma 14, i

Nautobot is a Network Source of Truth and Network Automation Platform built as a web application. All users of Nautobot

The `ecdsa` PyPI package is a pure Python implementation of ECC (Elliptic Curve Cryptography) with support for ECDSA (El

@hono/node-server is an adapter that allows users to run Hono applications on Node.js. Since v1.3.0, @hono/node-server h

hoolock is a suite of lightweight utilities designed to maintain a small footprint when bundled. Starting in version 2.0

An issue was discovered in Contiki-NG tinyDTLS through 2018-08-30. One incorrect handshake could complete with different

In Splunk Enterprise for Windows versions below 9.0.8 and 9.1.3, Splunk Enterprise does not correctly sanitize path inpu

In Splunk Enterprise versions below 9.0.8, the Splunk RapidDiag utility discloses server responses from external applica

In Splunk versions below 9.0.8 and 9.1.3, the “mrollup” SPL command lets a low-privileged user view metrics on an index

In Splunk Enterprise versions below 9.0.8 and 9.1.3, Splunk app key value store (KV Store) improperly handles permission

IIBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 could allow an authenticated user with CONNECT p

Jensen of Scandinavia Eagle 1200AC V15.03.06.33_en was discovered to contain a command injection vulnerability in the fu

The Meris WordPress theme through 1.1.2 does not sanitise and escape some parameters before outputting them back in the

The EventON-RSVP WordPress plugin before 2.9.5 does not sanitise and escape some parameters before outputting it back in

The Import any XML or CSV File to WordPress plugin before 3.7.3 accepts all zip files and automatically extracts the zip

The Product Enquiry for WooCommerce WordPress plugin before 3.1 does not sanitise and escape some of its settings, which

The Product Enquiry for WooCommerce WordPress plugin before 3.1 does not have a CSRF check in place when deleting inquir

The WP Review Slider WordPress plugin before 13.0 does not sanitise and escape some of its settings, which could allow h

The EventPrime WordPress plugin before 3.3.6 lacks authentication and authorization, allowing unauthenticated visitors t

The WP User Profile Avatar WordPress plugin before 1.0.1 does not properly check for authorisation, allowing authors to

The SEOPress WordPress plugin before 7.3 does not sanitise and escape some of its settings, which could allow high privi

IBM DB2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.1, 10.5, and 11.1 could allow an authenticated user

IBM DB2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1 and 11.5 could allow an authenticated u

IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 is vulnerable to an insecure cryptographic algori

IBM Db2 10.1, 10.5, and 11.1 could allow a remote user to execute arbitrary code caused by installing like named jar fil

An attacker could execute unauthorized script on a legitimate site through UXSS using window.open() by opening a javascr

Using a javascript: URI with a setTimeout race condition, an attacker can execute unauthorized scripts on top origin sit

IObit Malware Fighter v11.0.0.1274 is vulnerable to a Denial of Service vulnerability by triggering the 0x8001E00C IOCTL

IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.5 under certain circumstances could allow an authen

SQL Injection vulnerability in Quest Analytics LLC IQCRM v.2023.9.5 allows a remote attacker to execute arbitrary code v

IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 could allow an authenticated user

IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 federated server is vulnerable to a denial of ser

A vulnerability was found in hongmaple octopus 1.0. It has been classified as critical. Affected is an unknown function

A vulnerability was found in Project Worlds Online Admission System 1.0 and classified as critical. This issue affects s

Authentication bypass in Fortra's GoAnywhere MFT prior to 7.4.1 allows an unauthorized user to create an admin user via

Project files may contain malicious contents which the software will use to create files on the filesystem. This allows

The Omron FINS protocol has an authenticated feature to prevent access to memory regions. Authentication is susceptible

A vulnerability has been found in CodeAstro Online Railway Reservation System 1.0 and classified as problematic. This vu

A vulnerability, which was classified as problematic, was found in CodeAstro Internet Banking System 1.0. This affects a

** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, has been found in Uniview ISC 2500-S

DedeCMS 5.7.112 has a File Upload vulnerability via uploads/dede/module_upload.php.

Autolab is a course management service that enables instructors to offer autograded programming assignments to their stu

CloudLinux CageFS 7.0.8-2 or below insufficiently restricts file paths supplied to the sendmail proxy command. This allo

CloudLinux CageFS 7.1.1-1 or below passes the authentication token as a command line argument. In some configurations th

In Spring Framework versions 6.0.15 and 6.1.2, it is possible for a user to provide specially crafted HTTP requests that

A use-after-free flaw was found in the __ext4_remount in fs/ext4/super.c in ext4 in the Linux kernel. This flaw allows a

chasquid before 1.13 allows SMTP smuggling because LF-terminated lines are accepted.

In Clojure before 1.9.0, classes can be used to construct a serialized object that executes arbitrary code upon deserial

Open redirect vulnerability in Access analysis CGI An-Analyzer released in 2023 December 31 and earlier allows a remote