2024

The Tumult Hype Animations plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validat

The JobSearch WP Job Board plugin for WordPress is vulnerable to privilege escalation in all versions up to, and includi

Insufficient data validation in Mojo in Google Chrome prior to 129.0.6668.89 allowed a remote attacker who had compromis

OpenVidReview 1.0 is vulnerable to Incorrect Access Control. The /upload route is accessible without authentication, all

A SQL Injection vulnerability was found in /covid-tms/check_availability.php in PHPGurukul COVID 19 Testing Management S

The HttpRequest object allows to get the HTTP headers from the server's response after sending the request. The problem

A non-admin user account on the Zabbix frontend with the default User role, or with any other role that gives API access

A directory traversal vulnerability in Hewlett Packard Enterprise Insight Remote Support may allow remote code execution

qiwen-file v1.4.0 was discovered to contain a SQL injection vulnerability via the component /mapper/NoticeMapper.xml.

Improper neutralization of input during web page generation ('Cross-site Scripting') in Copilot Studio by an unauthorize

Valor Apps Easy Folder Listing Pro has a deserialization vulnerability that allows an unauthenticated, remote attacker t

`NSC_DeriveKey` inadvertently assumed that the `phKey` parameter is always non-NULL. When it was passed as NULL, a segme

A double-free issue could have occurred in `sec_pkcs7_decoder_start_decrypt()` when handling an error path. Under specif

A flaw in handling fullscreen transitions may have inadvertently caused the application to become stuck in fullscreen mo

The executable file warning was not presented when downloading .library-ms files. *Note: This issue only affected Wind

A CWE-306 "Missing Authentication for Critical Function" was discovered affecting the following devices manufactured by

A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered aff

A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered aff

A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered aff

A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered aff

A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered aff

The AppPresser – Mobile App Framework plugin for WordPress is vulnerable to privilege escalation via account takeover in

ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Remote, unauthenticated at

Wrong configuration in Touch Pal application can collect user behavior data without awareness by the user.

In multiple functions that process 802.11 frames, out-of-bounds reads can occur due to insufficient validation.

On some hardware revisions where VP9 decoding is hardware-accelerated, the frame size is not programmed correctly into t

API keys for some cloud services are hardcoded in the "main" binary. As for the details of affected product names, model

There are several hidden accounts. Some of them are intended for maintenance engineers, and with the knowledge of their

"sessionlist.html" and "sys_trayentryreboot.html" are accessible with no authentication. "sessionlist.html" provides log

The web interface of the affected devices processes a cookie value improperly, leading to a stack buffer overflow. More

The Spam protection, Anti-Spam, FireWall by CleanTalk plugin for WordPress is vulnerable to unauthorized Arbitrary Plugi

A NoSQL injection vulnerability in Adapt Learning Adapt Authoring Tool <= 0.11.3 allows unauthenticated attackers to res

An issue in the upload_documents method of libre-chat v0.0.6 allows attackers to execute a path traversal via supplying

There exists an out of bounds read/write in LibJXL versions prior to commit 9cc451b91b74ba470fd72bd48c121e9f33d24c99. Th

Affected devices beacon to eCharge cloud infrastructure asking if there are any command they should run. This communicat

An issue was discovered in the server in Veritas Enterprise Vault before 15.2, ZDI-CAN-24405. It allows remote attackers

An issue was discovered in the server in Veritas Enterprise Vault before 15.2, ZDI-CAN-24344. It allows remote attackers

An issue was discovered in the server in Veritas Enterprise Vault before 15.2, ZDI-CAN-24343. It allows remote attackers

An issue was discovered in the server in Veritas Enterprise Vault before 15.2, ZDI-CAN-24341. It allows remote attackers

An issue was discovered in the server in Veritas Enterprise Vault before 15.2, ZDI-CAN-24339. It allows remote attackers

An issue was discovered in the server in Veritas Enterprise Vault before 15.2, ZDI-CAN-24336. It allows remote attackers

An issue was discovered in the server in Veritas Enterprise Vault before 15.2, ZDI-CAN-24334. It allows remote attackers

In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, uncontrolled long string inputs to ldap_e

The WPGYM - Wordpress Gym Management System plugin for WordPress is vulnerable to arbitrary file uploads due to missing

The School Management System for Wordpress plugin for WordPress is vulnerable to arbitrary file uploads due to missing f

The FluentSMTP – WP SMTP Plugin with Amazon SES, SendGrid, MailGun, Postmark, Google and Any SMTP Provider plugin for Wo

The Social Login plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 5.9.0

NVIDIA Base Command Manager contains a missing authentication vulnerability in the CMDaemon component. A successful expl

An OS Command Injection vulnerability exists within myPRO Manager. A parameter within a command can be exploited by an u

A parameter within a command does not properly validate input within myPRO Manager which could be exploited by an unauth