2024

authentik is an open-source identity provider. Due to the usage of a non-constant time comparison for the /-/metrics/ en

authentik is an open-source identity provider. Redirect URIs in the OAuth2 provider in authentik are checked by RegEx co

authentik is an open-source identity provider. When using the client_credentials or device_code OAuth grants, it was pos

TP-Link TL-IPC42C V4.0_20211227_1.0.16 is vulnerable to command injection due to the lack of malicious code verification

Linksys E3000 1.0.06.002_US is vulnerable to command injection via the diag_ping_start function.

LLama Factory enables fine-tuning of large language models. A critical remote OS command injection vulnerability has bee

Argo Workflows Chart is used to set up argo and its needed dependencies through one command. Prior to 0.44.0, the workfl

InDesign Desktop versions 19.0, 20.0 and earlier are affected by an out-of-bounds read vulnerability that could lead to

An issue was discovered in Zimbra Collaboration (ZCS) through 10.1. A Cross-Site Scripting (XSS) vulnerability in the /h

An issue was discovered in Zimbra Collaboration (ZCS) through 10.1. A stored Cross-Site Scripting (XSS) vulnerability ex

In Zimbra Collaboration (ZCS) 9.0 and 10.0, a vulnerability in the Webmail Modern UI allows execution of stored Cross-Si

A vulnerability in Automated Logic WebCTRL 7.0 could allow an attacker to send a maliciously crafted URL, which when vis

An unrestricted upload of file with dangerous type in Automated Logic WebCTRL 7.0 could allow an unauthenticated user to

An issue was discovered in Zimbra Collaboration (ZCS) through v10.1. A Cross-Site Scripting (XSS) vulnerability exists i

An issue was discovered in webmail in Zimbra Collaboration (ZCS) through 10.1. An attacker can exploit this vulnerabilit

Open62541 v1.4.6 is has an assertion failure in fuzz_binary_decode, which leads to a crash.

An issue in alist-tvbox v1.7.1 allows a remote attacker to execute arbitrary code via the /atv-cli file.

An OS command injection vulnerability exists in the NAT parameter of GoCast 1.1.3. A specially crafted HTTP request can

An OS command injection vulnerability exists in the name parameter of GoCast 1.1.3. A specially crafted HTTP request can

Three OS command injection vulnerabilities exist in the web interface I/O configuration functionality of MC Technologies

Three OS command injection vulnerabilities exist in the web interface I/O configuration functionality of MC Technologies

Three OS command injection vulnerabilities exist in the web interface I/O configuration functionality of MC Technologies

A lack of authentication vulnerability exists in the HTTP API functionality of GoCast 1.1.3. A specially crafted HTTP re

An OS command injection vulnerability exists in the web interface configuration upload functionality of MC Technologies

A vulnerability has been found in 1000 Projects Beauty Parlour Management System 1.0 and classified as critical. This vu

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Kion Comput

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Teknogis Informati

A heap-buffer-overflow vulnerability has been identified in ntopng 6.2 in the Flow::dissectMDNS function.

A heap-buffer-overflow vulnerability was discovered in the SkipSpacesAndLineEnd function in Assimp v5.4.3. This issue oc

A vulnerability, which was classified as critical, was found in 1000 Projects Beauty Parlour Management System 1.0. This

The Anonymous Restricted Content plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up

The Simple Membership plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and in

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Smarttek In

A vulnerability, which was classified as critical, has been found in 1000 Projects Bookstore Management System 1.0. Affe

A vulnerability classified as critical was found in itsourcecode Tailoring Management System 1.0. Affected by this vulne

A vulnerability was found in AVL-DiTEST-DiagDev libdoip 1.0.0. It has been rated as problematic. This issue affects the

A vulnerability was found in idcCMS 1.60. It has been classified as problematic. This affects the function GetCityOption

The LSX Tour Operator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all vers

The Taskbuilder WordPress plugin before 3.0.5 does not sanitize user input into the 'load_orders' parameter and uses it

The Formidable Forms WordPress plugin before 6.14.1 does not sanitise and escape some of its settings, which could allo

The Ditty WordPress plugin before 3.1.47 does not sanitise and escape some of its settings, which could allow high priv

The Sky Addons for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to,

The F4 Improvements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versio

The Branda – White Label & Branding, Custom Login Page Customizer plugin for WordPress is vulnerable to Reflected Cross-

The Product Designer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versi

The Alphabetical List WordPress plugin through 1.0.3 does not have CSRF check in place when updating its settings, which

A command injection vulnerability in Brocade Fabric OS before 9.2.0c, and 9.2.1 through 9.2.1a on IP extension platforms

The CM Table Of Contents WordPress plugin before 1.2.4 does not have CSRF check when updating its settings, and is miss

Opencast is free and open source software for automated video capture and distribution. First noticed in Opencast 13 and

Apache NiFi 1.16.0 through 1.28.0 and 2.0.0-M1 through 2.0.0-M4 include optional debug logging of Parameter Context valu