CRITICAL Severity CVEs

An issue was discovered in gpac version 2.3-DEV-rev588-g7edc40fee-master, allows remote attackers to execute arbitrary c

An issue was discovered in Newland Nquire 1000 Interactive Kiosk version NQ1000-II_G_V1.00.011, allows remote attackers

An improper authentication vulnerability has been reported to affect several QNAP operating system versions. If exploite

In the module "Make an offer" (makeanoffer) <= 1.7.1 from PrestaToolKit for PrestaShop, a guest can perform SQL injectio

In the module "CD Custom Fields 4 Orders" (cdcustomfields4orders) <= 1.0.0 from Cleanpresta.com for PrestaShop, a guest

pgAdmin <= 8.3 is affected by a path-traversal vulnerability while deserializing users’ sessions in the session handling

Arbitrary File Overwrite Via Path Traversal in paddlepaddle/paddle before 2.6

remote code execution in paddlepaddle/paddle 2.6.0

JFrog Artifactory versions 7.59 and above, but below 7.59.18, 7.63.18, 7.68.19, 7.71.8 are vulnerable to an issue whereb

Student Enrollment In PHP v1.0 was discovered to contain a SQL injection vulnerability via the Login function.

code-projects.org Online Job Portal 1.0 is vulnerable to SQL Injection via the Username parameter for "Employer."

In Veritas NetBackup before 8.1.2 and NetBackup Appliance before 3.1.2, the BPCD process inadequately validates the file

nGrinder before 3.5.9 allows to accept serialized Java objects from unauthenticated users, which could allow remote atta

nGrinder before 3.5.9 uses old version of SnakeYAML, which could allow remote attacker to execute arbitrary code via uns

nGrinder before 3.5.9 allows connection to malicious JMX/RMI server by default, which could be the cause of executing ar

Heap based buffer flow in zlog v1.1.0 to v1.2.17 in zlog_rule_new().The size of record_name is MAXLEN_PATH(1024) + 1 but

An issue was discovered in Lustre versions 2.13.x, 2.14.x, and 2.15.x before 2.15.4, allows attackers to escalate privil

Hotel Booking Management v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at update.php

JSONata is a JSON query and transformation language. Starting in version 1.4.0 and prior to version 1.8.7 and 2.0.4, a m

pgx is a PostgreSQL driver and toolkit for Go. SQL injection can occur if an attacker can cause a single query or bind m

go-zero is a web and rpc framework. Go-zero allows user to specify a CORS Filter with a configurable allows param - whic

CasaOS-UserService provides user management functionalities to CasaOS. Starting in version 0.4.4.3 and prior to version

eProsima Fast DDS (formerly Fast RTPS) is a C++ implementation of the Data Distribution Service standard of the Object M

In Blue Planet® products through 22.12, a misconfiguration in the SAML implementation allows for privilege escalation.

Deserialization of Untrusted Data vulnerability in Apache InLong.This issue affects Apache InLong: from 1.8.0 through 1.

Multilaser RE160 v5.07.51_pt_MTL01 and v5.07.52_pt_MTL01, Multilaser RE160V v12.03.01.08_pt and V12.03.01.09_pt, and Mul

An issue in Multilaser RE160V firmware v12.03.01.09_pt and Multilaser RE163V firmware v12.03.01.10_pt allows attackers t

An issue in Jeewms v.3.7 and before allows a remote attacker to escalate privileges via the AuthInterceptor component.

Cross Site Scripting (XSS) vulnerability in Teamwire Windows desktop client v.2.0.1 through v.2.4.0 allows a remote atta

Cross Site Scripting vulnerability in Teamwire Windows desktop client v.2.0.1 through v.2.4.0 allows a remote attacker t

Services that are running and bound to the loopback interface on the Artica Proxy are accessible through the proxy servi

The "Rich Filemanager" feature of Artica Proxy provides a web-based interface for file management capabilities. When the

VMware ESXi, Workstation, and Fusion contain a use-after-free vulnerability in the UHCI USB controller. A malicious acto

VMware ESXi, Workstation, and Fusion contain a use-after-free vulnerability in the XHCI USB controller. A malicious acto

A Server-Side Request Forgery (SSRF) in weixin.php of ChatGPT-wechat-personal commit a0857f6 allows attackers to force t

Authentication Bypass by Primary Weakness vulnerability in ZKSoftware Biometric Security Solutions UFace 5 allows Authen

swftools v0.9.2 was discovered to contain a strcpy parameter overlap via /home/swftools/src/swfc+0x48318a.

Insufficiently protected credentials (CWE-522) for third party DVR integrations to the Command Centre Server are access

Customer Support System v1 was discovered to contain a SQL injection vulnerability via the subject parameter at /custome

Customer Support System v1 was discovered to contain a SQL injection vulnerability via the username parameter at /custom

In the Linux kernel, the following vulnerability has been resolved: NFSD: Fix READDIR buffer overflow If a client send

In JetBrains TeamCity before 2023.11.4 authentication bypass allowing to perform admin actions was possible

In the Linux kernel, the following vulnerability has been resolved: inet: fully convert sk->sk_rx_dst to RCU rules syz

Memory corruption while parsing beacon/probe response frame when AP sends more supported links in MLIE.

Memory corruption while processing MBSSID beacon containing several subelement IE.

Memory corruption in Data Modem while verifying hello-verify message during the DTLS handshake.

Memory corruption in Core Services while executing the command for removing a single event listener.

In wlan driver, there is a possible out of bounds write due to improper input validation. This could lead to local escal

In wlan service, there is a possible out of bounds write due to improper input validation. This could lead to remote cod

SQL Injection vulnerability in MyPrestaModules "Product Catalog (CSV, Excel) Import" (simpleimportproduct) modules for P