2024

The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to unauthorized access

The Jeg Elementor Kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's JKit - Countdow

ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Remote, unauthenticated at

The Parsi Date plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg with

The Booster for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wcj_produ

The Spotify Play Button for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's

The BNE Gallery Extended plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'gallery' sh

The Support SVG – Upload svg files in wordpress without hassle plugin for WordPress is vulnerable to Stored Cross-Site S

An image with a version lower than the fuse version may potentially be booted lead to improper authentication.

Wrong configuration in Touch Pal application can collect user behavior data without awareness by the user.

A race condition exists in a driver potentially leading to a use-after-free condition.

In multiple functions that process 802.11 frames, out-of-bounds reads can occur due to insufficient validation.

Buffer overwrite in the WLAN host driver by leveraging a compromised WLAN FW

On some hardware revisions where VP9 decoding is hardware-accelerated, the frame size is not programmed correctly into t

Initial xbl_sec revision does not have all the debug policy features and critical checks.

The Booking calendar, Appointment Booking System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via S

51l3nc3, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API managedoverlayimages.cgi was vulnerable

Erik de Jong, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API ftptest.cgi did not have a sufficie

Seth Fogie, member of AXIS Camera Station Pro Bug Bounty Program has found that it is possible to edit and/or remove vie

Florent Thiéry has found that selected Axis devices were vulnerable to handling certain ethernet frames which could lead

Out-of-bounds read vulnerability exists in Sharp Corporation and Toshiba Tec Corporation multiple MFPs (multifunction pr

The web interface of the affected devices process some crafted HTTP requests improperly, leading to a device crash. More

Cross-site scripting vulnerability exists in Sharp Corporation and Toshiba Tech Corporation multiple MFPs (multifunction

API keys for some cloud services are hardcoded in the "main" binary. As for the details of affected product names, model

There are several hidden accounts. Some of them are intended for maintenance engineers, and with the knowledge of their

The web interface of the affected devices is designed to hide the LDAP credentials even for administrative users. But co

Admin authentication can be bypassed with some specific invalid credentials, which allows logging in with an administrat

"sessionlist.html" and "sys_trayentryreboot.html" are accessible with no authentication. "sessionlist.html" provides log

Improper processing of some parameters of installed_emanual_list.html leads to a path traversal vulnerability. As for th

User passwords are decrypted and stored on memory before any user logged in. Those decrypted passwords can be retrieved

User passwords are decrypted and stored on memory before any user logged in. Those decrypted passwords can be retrieved

User passwords are decrypted and stored on memory before any user logged in. Those decrypted passwords can be retrieved

Affected devices create coredump files when crashed, storing them with world-readable permission. Any local user of the

The web interface of the affected devices processes a cookie value improperly, leading to a stack buffer overflow. More

Multiple plugins for WordPress are vulnerable to Reflected Cross-Site Scripting via the cminds_free_guide shortcode in v

Seth Fogie, member of the AXIS Camera Station Pro Bug Bounty Program, has found that the Incident report feature may exp

Gee-netics, member of the AXIS Camera Station Pro Bug Bounty Program has found that it is possible for a non-admin user

The The InPost Gallery plugin for WordPress is vulnerable to arbitrary shortcode execution via the inpost_gallery_get_sh

The Product Input Fields for WooCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to

The Spam protection, Anti-Spam, FireWall by CleanTalk plugin for WordPress is vulnerable to unauthorized Arbitrary Plugi

The Security & Malware scan by CleanTalk plugin for WordPress is vulnerable to unauthorized SQL Injection due to an auth

The Spam protection, Anti-Spam, FireWall by CleanTalk plugin for WordPress is vulnerable to unauthorized Arbitrary Plugi

The Everest Forms WordPress plugin before 3.0.4.2 does not sanitise and escape some of its settings, which could allow

Cross-site scripting vulnerability exists in WP Admin UI Customize versions prior to ver 1.5.14. If a malicious admin us

IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data 4.0.0 through 5.0.2 does not properly check inputs to re

IBM Workload Scheduler 9.5, 10.1, and 10.2 stores user credentials in plain text which can be read by a local user.

The Additional Order Filters for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via th

The Skt NURCaptcha plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including

Dell Wyse Management Suite, versions WMS 4.4 and prior, contain an Improper Restriction of Excessive Authentication Atte

Dell Wyse Management Suite, version WMS 4.4 and prior, contain a Missing Authorization vulnerability. A high privileged