HIGH Severity CVEs

Improper Control of Generation of Code ('Code Injection'), Cross-Site Request Forgery (CSRF), : Improper Neutralization

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache HertzBeat. This issue affects Apache

Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache HertzBeat (i

A low privileged remote attacker may modify the configuration of the CODESYS V3 service through a missing authentication

A low privileged remote attacker may modify the boot mode configuration setup of the device, leading to modification of

Deserialization of Untrusted Data vulnerability in Apache HertzBeat. This vulnerability can only be exploited by author

Zohocorp ManageEngine ADAudit Plus versions below 8123 are vulnerable to SQL Injection in the reports module.

An issue was discovered in LemonLDAP::NG before 2.20.1. An Improper Check during session refresh allows an authenticated

An issue was discovered in Veritas NetBackup before 10.5. This only applies to NetBackup components running on a Windows

The DVC from TRCore has a Path Traversal vulnerability, allowing unauthenticated remote attackers to exploit this vulner

The DVC from TRCore has a Path Traversal vulnerability, allowing unauthenticated remote attackers to exploit this vulner

AnyDesk through 8.1.0 on Windows, when Allow Direct Connections is enabled, inadvertently exposes a public IP address wi

Software installed and run as a non-privileged user may conduct improper GPU system calls to gain access to the graphics

Bitcoin Core before 0.20.0 allows remote attackers to cause a denial of service (infinite loop) via a malformed GETDATA

Bitcoin Core before 0.15.0 allows a denial of service (OOM kill of a daemon process) via a flood of minimum difficulty h

Bitcoin Core before 0.20.0 allows remote attackers to cause a denial of service (memory consumption) via a crafted INV m

In Bitcoin Core before 0.18.0, a node could be stalled for hours when processing the orphans of a crafted unconfirmed tr

Bitcoin Core before 0.21.0 allows a network split that is resultant from an integer overflow (calculating the time offse

Bitcoin Core before 24.0.1 allows remote attackers to cause a denial of service (daemon crash) via a flood of low-diffic

A flaw was found in kube-controller-manager. This issue occurs when the initial application of a HPA config YAML lacking

A flaw was found in Undertow, which incorrectly parses cookies with certain value-delimiting characters in incoming requ

A vulnerability was found in Samba where a delegated administrator with permission to create objects in Active Directory

Holy Stone Remote ID Module HSRID01, firmware distributed with the Drone Go2 mobile application before 1.1.8, allows una

In Flagsmith before 2.134.1, the get_document endpoint is not correctly protected by permissions.

In Flagsmith before 2.134.1, it is possible to bypass the ALLOW_REGISTRATION_WITHOUT_INVITE setting.

guix-daemon in GNU Guix before 5ab3c4c allows privilege escalation because build outputs are accessible by local users b

Cross-Site Request Forgery (CSRF) vulnerability in skipstorm SK WP Settings Backup sk-wp-settings-backup allows Object I

The Login using WordPress Users ( WP as SAML IDP ) plugin for WordPress is vulnerable to time-based SQL Injection via th

The Blogger 301 Redirect plugin for WordPress is vulnerable to blind time-based SQL Injection via the ‘br’ parameter in

The Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX plugin for WordPress is vulnerable to unauthorized plug

The PDF Generator Addon for Elementor Page Builder plugin for WordPress is vulnerable to Path Traversal in all versions

The Real3D Flipbook Lite – 3D FlipBook, PDF Viewer, PDF Embedder plugin for WordPress is vulnerable to arbitrary file up

The The Uix Slideshow plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and inc

The WordPress Video Robot - The Ultimate Video Importer plugin for WordPress is vulnerable to privilege escalation due t

A maliciously crafted DLL file when placed in temporary files and folders that are leveraged by the Autodesk Installer c

In setAllowOnlyVpnForUids of NetworkManagementService.java, there is a possible security settings bypass due to a missin

In createFromParcel of MediaCas.java, there is a possible parcel read/write mismatch due to improper input validation. T

In createFromParcel of ViewPager.java, there is a possible read/write serialization issue leading to a permissions bypas

Azure Stack HCI Elevation of Privilege Vulnerability

An arbitrary file download vulnerability in the component /Doc/DownloadFile of NUS-M9 ERP Management Software v3.0.0 all

A vulnerability classified as critical was found in 1000 Projects Beauty Parlour Management System 1.0. This vulnerabili

A vulnerability classified as critical has been found in 1000 Projects Beauty Parlour Management System 1.0. This affect

A vulnerability was found in 1000 Projects Portfolio Management System MCA 1.0 and classified as critical. This issue af

An issue in TOTOLINK Bluetooth Wireless Adapter A600UB allows a local attacker to execute arbitrary code via the WifiAut

NULL pointer dereference in the MMS Client in MZ Automation LibIEC1850 before commit 7afa40390b26ad1f4cf93deaa0052fe7e35

A reachable assertion in the ogs_nas_emm_decode function of Open5GS v2.7.0 allows attackers to cause a Denial of Service

Reachable assertions in the NGAP_FIND_PROTOCOLIE_BY_ID function of OpenAirInterface Magma v1.8.0 and OAI EPC Federation

Nextcloud Mail is the mail app for Nextcloud, a self-hosted productivity platform. When a user is trying to set up a mai

By default, dedicated folders of ZONEPOINT for Windows up to 2024.1 can be accessed by other users to misuse technical f

By default, dedicated folders of ZONECENTRAL for Windows up to 2024.3 or up to Q.2021.2 (ANSSI qualification submission)