CWE-116

In ArrayConcatVisitor of builtins-array.cc, there is a possible type confusion due to improper input validation. This co

Account users in Apache CloudStack by default are allowed to upload and register templates for deploying instances and v

A vulnerability was identified in Consul and Consul Enterprise (“Consul”) such that using Headers in L7 traffic intentio

Improper Encoding or Escaping of Output vulnerability in The Wikimedia Foundation Mediawiki - CSS Extension allows Code

A host whitelist parser issue in the proxy service implemented in the GravityZone Update Server allows an attacker to ca

Encoding problem in mod_proxy in Apache HTTP Server 2.4.59 and earlier allows request URLs with incorrect encoding to be

An issue in dc2niix before v.1.0.20240202 allows a local attacker to execute arbitrary code via the generated file name

Windows App Installer Spoofing Vulnerability

In shouldRestrictOverlayActivities of UsbProfileGroupSettingsManager.java, there is a possible escape from SUW due to a

In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, the fix for CVE-2024-1874 does not work if

Denial of Service (DoS) vulnerability in the DMS module. Successful exploitation of this vulnerability will affect avail

Vulnerability of parameters being not verified in the WMS module. Successful exploitation of this vulnerability may affe

Improper input validation for some Intel NUC BIOS firmware before version JY0070 may allow a privileged user to potentia

A host header injection vulnerability in the HTTP handler component of Crafty Controller allows a remote, unauthenticate

Gradio before 4.20 allows credential leakage on Windows.

There exists a Denial of service vulnerability in Tink-cc in versions prior to 2.1.3.  * An adversary can crash binari

A vulnerability was found in Romain Bourdon Wampserver all versions (discovered in v3.2.3 and v3.2.6) where unauthorized

Sharp and Toshiba Tec MFPs improperly process query parameters in HTTP requests, which may allow contamination of uninte

In OpenStack Murano through 16.0.0, when YAQL before 3.0.0 is used, the Murano service's MuranoPL extension to the YAQL

IBM Datacap Navigator 9.1.5, 9.1.6, 9.1.7, 9.1.8, and 9.1.9 is vulnerable to HTTP header injection, caused by improper v

alf.io is an open source ticket reservation system for conferences, trade shows, workshops, and meetups. Prior to versio

Envoy is a cloud-native high-performance edge/middle/service proxy. A vulnerability has been identified in Envoy that al

An issue was discovered in the Vector Skin component for MediaWiki before 1.39.5 and 1.40.x before 1.40.1. vector-toc-to

A vulnerability in the AWV (Audio, Web and Video Conferencing) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.20

Cooked is a recipe plugin for WordPress. The Cooked plugin for WordPress is vulnerable to HTML Injection in versions up

A vulnerability classified as critical has been found in Sichuan Yougou Technology KuERP up to 1.0.4. Affected is an unk

KaTeX is a JavaScript library for TeX math rendering on the web. KaTeX users who render untrusted mathematical expressio

The EventON WordPress plugin before 4.5.5, EventON WordPress plugin before 2.2.7 do not properly sanitise and escape a p

An issue was discovered in GitLab CE/EE affecting all versions starting from 8.16 prior to 17.0.6, starting from 17.1 pr

IBM Aspera Faspex 5.0.0 and 5.0.1 is vulnerable to HTTP header injection, caused by improper validation of input by the

Cacti provides an operational monitoring and fault management framework. Versions of Cacti prior to 1.2.27 contain a res

Exim through 4.97.1 misparses a multiline RFC 2231 header filename, and thus remote attackers can bypass a $mime_filenam

IBM Aspera Orchestrator 4.0.1 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST

A vulnerability in Koji was found. An unsanitized input allows for an XSS attack. Javascript code from a malicious link

OPCUAServerToolkit will write a log message once an OPC UA client has successfully connected containing the client's se

Postal is an open source SMTP server. Postal versions less than 3.0.0 are vulnerable to SMTP Smuggling attacks which may

IBM Cognos Controller 10.4.1, 10.4.2, and 11.0.0 is vulnerable to injection attacks in application logging by not saniti

A vulnerability was found in kitsada8621 Digital Library Management System 1.0. It has been classified as problematic. A

A Directory Traversal vulnerability in the Boa webserver of Vilo 5 Mesh WiFi System <= 5.16.1.33 allows remote, unauthen

An information disclosure flaw was found in ansible-core due to a failure to respect the ANSIBLE_NO_LOG configuration in

IBM App Connect Enterprise 11.0.0.1 through 11.0.0.23, 12.0.1.0 through 12.0.9.0 and IBM Integration Bus for z/OS 10.1 t

The EventON WordPress plugin before 4.5.5, EventON WordPress plugin before 2.2.7 does not sanitize and escape some of it

LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. Stored Cross-Site Scripting (XSS) can be ach

Scout is a web-based visualizer for VCF-files. Due to the lack of sanitization in the filename, it is possible bypass in

All versions of the package github.com/greenpau/caddy-security are vulnerable to HTTP Header Injection via the X-Forward

The researcher is showing that due to the way the SNMP trap log is parsed, an attacker can craft an SNMP trap with addit

TYPO3 is an enterprise content management system. Starting in version 13.0.0 and prior to version 13.1.1, the history ba

Dell Unity, versions prior to 5.4, contain a vulnerability whereby log messages can be spoofed by an authenticated atta

An issue has been discovered in GitLab EE affecting all versions starting from 16.0 prior to 17.2.8, from 17.3 prior to

Insufficient validation of filenames against control characters in Apache Subversion repositories served via mod_dav_svn