2024

Funadmin v5.0.2 has an arbitrary file read vulnerability in /curd/index/editfile.

Werkzeug is a Web Server Gateway Interface web application library. On Python < 3.11 on Windows, os.path.isabs() does no

An arbitrary file upload vulnerability in Huly Platform v0.6.295 allows attackers to execute arbitrary code via uploadin

MangoOS before 5.2.0 was discovered to contain a Client-Side Template Injection (CSTI) vulnerability via the Platform Ma

A stored cross-site scripting (XSS) vulnerability in MangoOS before 5.2.0 allows attackers to execute arbitrary web scri

The Image Map Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'save_project' function with

The Image Map Pro plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a miss

An arbitrary file upload vulnerability in Huly Platform v0.6.295 allows attackers to execute arbitrary code via uploadin

A SQL Injection vulnerability in ESAFENET CDG 5 and earlier allows an attacker to execute arbitrary code via the id para

ABB is aware of privately reported vulnerabilities in the product versions referenced in this CVE. An attacker could exp

Cross Site Scripting vulnerability in Sentry v.6.0.9 allows a remote attacker to execute arbitrary code via the z parame

Cross Site Scripting vulnerability in Blood Bank v.1 allows a remote attacker to execute arbitrary code via a crafted sc

OvalEdge 5.2.8.0 and earlier is affected by a Sensitive Data Exposure vulnerability via a GET request to /user/getUserTy

OvalEdge 5.2.8.0 and earlier is affected by multiple Stored XSS (AKA Persistent or Type II) vulnerabilities via a POST r

OvalEdge 5.2.8.0 and earlier is affected by a Sensitive Data Exposure vulnerability via a GET request to /user/getUserLi

OvalEdge 5.2.8.0 and earlier is affected by a Privilege Escalation vulnerability via a POST request to /user/assignuserr

The Kademlia DHT (go-libp2p-kad-dht 0.20.0 and earlier) used in IPFS (0.18.1 and earlier) assigns routing information fo

Zitadel is open-source identity infrastructure software. Versions prior to 2.64.1, 2.63.6, 2.62.8, 2.61.4, 2.60.4, 2.59.

smartUp, a web browser mouse gestures extension, has a universal cross-site scripting issue in the Edge and Firefox vers

A vulnerability, which was classified as critical, has been found in SourceCodester Petrol Pump Management Software 1.0.

A vulnerability classified as problematic was found in ESAFENET CDG 5. Affected by this vulnerability is the function ac

A vulnerability classified as critical has been found in ESAFENET CDG 5. Affected is the function actionViewCDGRenewFile

The WP-Members Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpme

Dell Data Lakehouse, version(s) 1.0.0.0, 1.1.0., contain(s) an Improper Access Control vulnerability. An unauthenticated

there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure wi

Android before 2024-10-05 on Google Pixel devices allows information disclosure in the ACPM component, A-315191818.

In TrustySharedMemoryManager::GetSharedMemory of ondevice/trusty/trusty_shared_memory_manager.cc, there is a possible ou

In ffu_flash_pack of ffu.c, there is a possible out of bounds read due to an integer overflow. This could lead to local

In gsc_gsa_rescue of gsc_gsa.c, there is a possible out of bounds read due to an incorrect bounds check. This could lead

In ppmp_protect_buf of drm_fw.c, there is a possible information disclosure due to a logic error in the code. This could

In ProtocolEmbmsSaiListAdapter::Init() of protocolembmsadapter.cpp, there is a possible out of bounds read due to a miss

In pmucal_rae_handle_seq_int of flexpmu_cal_rae.c, there is a possible out of bounds read due to a buffer overflow. This

In ProtocolMiscHwConfigChangeAdapter::GetData() of protocolmiscadapter.cpp, there is a possible out-of-bounds read due t

There is a possible Local bypass of user interaction due to an insecure default value. This could lead to local informat

A vulnerability was found in ESAFENET CDG 5. It has been rated as critical. This issue affects the function actionPassDe

A vulnerability was found in ESAFENET CDG 5. It has been declared as critical. This vulnerability affects the function a

The Shoutcast Icecast HTML5 Radio Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugi

The Beek Widget Extention plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions u

The Simple News plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'news' shortcode in a

The File Upload Types by WPForms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads

The WPS Telegram Chat plugin for WordPress is vulnerable to authorization bypass due to a missing capability check when

The WPS Telegram Chat plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a

N-LINE 2.0.6 and prior versions contain a code injection vulnerability. If this vulnerability is exploited, arbitrary co

The League of Legends Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in ver

The League of Legends Shortcodes plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versi

The Bamazoo – Button Generator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's dgs sh

The 10Web Social Post Feed plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_qu

Whale browser Installer before 3.1.0.0 allows an attacker to execute a malicious DLL in the user environment due to impr

Sharp and Toshiba Tec MFPs improperly validate input data in URI data registration, resulting in a stored cross-site scr

Sharp and Toshiba Tec MFPs improperly process URI data in HTTP PUT requests resulting in a path Traversal vulnerability.