2023

A misconfiguration of RSA padding implemented in the PingID Adapter for PingFederate to support Offline MFA with PingID

Improper access control in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows remote authentica

Improper access control in reporting engine of Odoo Community 14.0 through 15.0, and Odoo Enterprise 14.0 through 15.0,

A sandboxing issue in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows authenticated administ

Improper access control in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows attackers to vali

A sandboxing issue in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows authenticated administ

PrestaShop is an Open Source e-commerce web application. Prior to versions 8.0.4 and 1.7.8.9, it is possible for a user

No exception handling vulnerability which revealed sensitive or excessive information to users.

The Service Location Protocol (SLP, RFC 2608) allows an unauthenticated, remote attacker to register arbitrary services.

Nokia OneNDS 17r2 has Insecure Permissions vulnerability that allows for privilege escalation.

Sengled Dimmer Switch V0.0.9 contains a denial of service (DOS) vulnerability, which allows a remote attacker to send ma

ChurchCRM 4.5.3 was discovered to contain a CSV injection vulnerability via the Last Name and First Name input fields wh

x86 shadow paging arbitrary pointer dereference In environments where host assisted address translation is necessary but

An issue was discovered in the Open Document feature in Telindus Apsal 3.14.2022.235 b. An attacker may upload a crafted

Reflected Cross-Site Scripting (XSS) vulnerability in Denis 微信机器人高级版 plugin <= 6.0.1 versions.

The specific flaw exists within the DPT I2O Controller driver. The issue results from the lack of proper locking when pe

Vyper is a Pythonic Smart Contract Language for the ethereum virtual machine. In versions 0.3.1 through 0.3.7, the Vyper

Kiwi TCMS is an open source test management system. In kiwitcms/Kiwi v12.2 and prior and kiwitcms/enterprise v12.2 and p

`embano1/wip` is a GitHub Action written in Bash. Prior to version 2, the `embano1/wip` action uses the `github.event.p

Jellyfin is a free-software media system. Versions starting with 10.8.0 and prior to 10.8.10 and prior have a directory

Authorization Bypass Through User-Controlled Key in GitHub repository alfio-event/alf.io prior to 2.0-M4-2304.

Improper Neutralization of Special Elements Used in a Template Engine in GitHub repository alfio-event/alf.io prior to 2

Improper Neutralization of Formula Elements in a CSV File in GitHub repository alfio-event/alf.io prior to 2.0-M4-2304.

A race condition was found in the Linux kernel's RxRPC network protocol, within the processing of RxRPC bundles. This is

Laminas Diactoros provides PSR HTTP Message implementations. In versions 2.18.0 and prior, 2.19.0, 2.20.0, 2.21.0, 2.22.

Authentication Bypass in Hub Business integration in Devolutions Workspace Desktop 2023.1.1.3 and earlier on Windows and

Third Reality Smart Blind 1.00.54 contains a denial-of-service vulnerability, which allows a remote attacker to send mal

The Random Text WordPress plugin through 0.3.0 does not properly sanitize and escape a parameter before using it in a SQ

The post-authentication command injection vulnerability in the CLI command of Zyxel ATP series firmware versions 4.32 th

An issue was discovered in Telindus Apsal 3.14.2022.235 b. Unauthorized actions that could modify the application behavi

Kiwi TCMS, an open source test management system, allows users to upload attachments to test plans, test cases, etc. In

A buffer overflow vulnerability in the “sdwan_iface_ipc” binary of Zyxel ATP series firmware versions 5.10 through 5.32,

The configuration parser of Zyxel ATP series firmware versions 5.10 through 5.35, USG FLEX series firmware versions 5.00

A buffer overflow vulnerability in the “fbwifi_forward.cgi” CGI program of Zyxel USG FLEX series firmware versions 4.50

A path traversal vulnerability in the “account_print.cgi” CGI program of Zyxel USG FLEX series firmware versions 4.50 th

A post-authentication command injection vulnerability in the “account_operator.cgi” CGI program of Zyxel USG FLEX series

Session Validation attacks in Apache Superset versions up to and including 2.0.1. Installations that have not altered th

RIOT-OS, an operating system that supports Internet of Things devices, contains a network stack with the ability to proc

RIOT-OS, an operating system that supports Internet of Things devices, contains a network stack with the ability to proc

Uncaught Exception in GitHub repository eemeli/yaml prior to 2.0.0-5.

Bang Resto 1.0 was discovered to contain multiple SQL injection vulnerabilities via the btnMenuItemID, itemID, itemPrice

Ribose RNP before 0.16.3 sometimes lets secret keys remain unlocked after use.

RIOT-OS, an operating system that supports Internet of Things devices, contains a network stack with the ability to proc

RIOT-OS, an operating system that supports Internet of Things devices, contains a network stack with the ability to proc

In Meinbergs LTOS versions prior to V7.06.013, the configuration file upload function would not correctly validate the i

mp4v2 v2.0.0 was discovered to contain a heap buffer overflow via the mp4v2::impl::MP4StringProperty::~MP4StringProperty

In JetBrains Ktor before 2.3.0 path traversal in the `resolveResource` method was possible

SheetJS Community Edition before 0.19.3 allows Prototype Pollution via a crafted file. In other words. 0.19.2 and earlie

Repetier Server through 1.4.10 does not have CSRF protection.

Repetier Server through 1.4.10 allows ..%5c directory traversal for reading files that contain credentials, as demonstra