2023

All versions of the package safe-eval are vulnerable to Prototype Pollution via the safeEval function, due to improper s

In SAP NetWeaver (BI CONT ADDON) - versions 707, 737, 747, 757, an attacker can exploit a directory traversal flaw in a

An issue found in DUALSPACE Super Secuirty v.2.3.7 allows an attacker to cause a denial of service via the SharedPrefere

Wacom Driver 6.3.46-1 for Windows and lower was discovered to contain an arbitrary file deletion vulnerability.

A flaw was found in openvswitch (OVS). When processing an IP packet with protocol 0, OVS will install the datapath flow

Flask-AppBuilder versions before 4.3.0 lack rate limiting which can allow an attacker to brute-force user credentials. V

A user with non-Admin access can change a configuration file on the client to modify the Server URL.

An issue was discovered in Open Design Alliance Drawings SDK before 2024.1. A crafted DWG file can force the SDK to reus

Certain Lexmark devices through 2023-02-19 mishandle Input Validation (issue 1 of 4).

An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in macOS Monterey 12.6.5,

A use after free issue was addressed with improved memory management. This issue is fixed in Safari 16.4.1, iOS 15.7.5 a

A logic issue was addressed with improved state management. This issue is fixed in macOS Ventura 13.1, iOS 16.2 and iPad

A memory corruption issue was addressed with improved input validation. This issue is fixed in macOS Ventura 13.1. An ap

An issue in China Mobile OA Mailbox PC v2.9.23 allows remote attackers to execute arbitrary commands on a victim host vi

delight-nashorn-sandbox 0.2.4 and 0.2.5 is vulnerable to sandbox escape. When allowExitFunctions is set to false, the lo

The WP Meta SEO WordPress plugin before 4.5.5 does not validate image file paths before attempting to manipulate the ima

The WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg WordPress plugin before 2.7.9.

The JetEngine WordPress plugin before 3.1.3.1 includes uploaded files without adequately ensuring that they are not exec

SQL injection vulnerability found in PrestaShop Igbudget v.1.0.3 and before allow a remote attacker to gain privileges v

SQL injection vulnerability found in Tailor Mangement System v.1 allows a remote attacker to execute arbitrary code via

An issue found in Sales Tracker Management System v.1.0 allows a remote attacker to access sensitive information via sal

In Lua 5.4.3, an erroneous finalizer called during a tail call leads to a heap-based buffer over-read.

Nginx NJS v0.7.10 was discovered to contain a segmentation violation via the function njs_lvlhsh_find at src/njs_lvlhsh.

Nginx NJS v0.7.10 was discovered to contain an illegal memcpy via the function njs_vmcode_return at src/njs_vmcode.c.

Nginx NJS v0.7.10 was discovered to contain a segmentation violation via the function njs_dump_is_recursive at src/njs_v

Nginx NJS v0.7.10 was discovered to contain a segmentation violation via the function njs_function_frame at src/njs_func

A vulnerability classified as critical has been found in PHPGurukul Bank Locker Management System 1.0. Affected is an un

A vulnerability classified as critical was found in SourceCodester Best Online News Portal 1.0. Affected by this vulnera

A vulnerability classified as critical has been found in SourceCodester Online Computer and Laptop Store 1.0. Affected i

GDidees CMS v3.9.1 was discovered to contain a source code disclosure vulnerability by the backup feature which is acces

An improper authentication vulnerability was identified in GitHub Enterprise Server that allowed an unauthorized actor t

A vulnerability, which was classified as critical, has been found in SourceCodester Simple and Beautiful Shopping Cart S

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in impleCode Product Catalog Simple plugin <= 1.6.17 versions

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in PropertyHive plugin <= 1.5.46 versions.

Unauth. Reflected Cross-site Scripting (XSS) vulnerability in Magic Post Thumbnail plugin <= 4.1.10 versions.

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in I Thirteen Web Solution Continuous Image Carousel With Lig

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Cimatti Consulting WordPress Contact Forms by Cimatti plug

Unauth. Stored Cross-Site Scripting (XSS) vulnerability in Cimatti Consulting WordPress Contact Forms by Cimatti plugin

Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow Spark Provider.This issue affects A

Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow Drill Provider.This issue affects A

IBM TRIRIGA 4.0 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attack

Unauth. Stored Cross-Site Scripting (XSS) vulnerability in Fullworks Quick Paypal Payments plugin <= 5.7.25 versions.

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Cththemes Outdoor theme <= 3.9.6 versions.

Unauth.  Reflected Cross-Site Scripting (XSS) vulnerability in Ignazio Scimone Albo Pretorio On Line plugin <= 4.6.1 ver

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Cththemes Monolit theme <= 2.0.6 versions.

Unauth. Stored Cross-Site Scripting (XSS) vulnerability in Kiboko Labs Arigato Autoresponder and Newsletter plugin <= 2.

Dell Power Manager, versions 3.10 and prior, contains an Improper Access Control vulnerability. A low-privileged attack

siteproxy v1.0 was discovered to contain a path traversal vulnerability via the component index.js.

codefever before 2023.2.7-commit-b1c2e7f was discovered to contain a remote code execution (RCE) vulnerability via the c

In mmsdk, there is a possible escalation of privilege due to a parcel format mismatch. This could lead to local code exe