2024

Starlette is an Asynchronous Server Gateway Interface (ASGI) framework/toolkit. Prior to version 0.40.0, Starlette treat

matrix-react-sdk is react-based software development kit for inserting a Matrix chat/VOIP client into a web page. Starti

Element is a Matrix web client built using the Matrix React SDK. Element Web versions 1.11.70 through 1.11.80 contain a

Element Desktop is a Matrix client for desktop platforms. Element Desktop versions 1.11.70 through 1.11.80 contain a vul

matrix-js-sdk is the Matrix Client-Server SDK for JavaScript and TypeScript. In matrix-js-sdk versions versions 9.11.0 t

RCE (Remote Code Execution) exists in ZoneMinder through 1.36.33 as an attacker can create a new .php log file in langua

A flaw was found in PyO3. This vulnerability causes a use-after-free issue, potentially leading to memory corruption or

The Elliptic package 6.5.7 for Node.js, in its for ECDSA implementation, does not correctly verify valid signatures if t

A vulnerability was found in code-projects Blood Bank Management System 1.0. It has been rated as critical. This issue a

A vulnerability, which was classified as critical, was found in MitraStar GPT-2541GNAC BR_g5.6_1.11(WVK.0)b26. Affected

Phpgurukul User Registration & Login and User Management System 3.2 is vulnerable to SQL Injection in /admin//search-res

A SQL Injection vulnerability was found in /password-recovery.php of PHPGurukul User Registration & Login and User Manag

A SQL Injection vulnerability was found in /search-result.php of PHPGurukul User Registration & Login and User Managemen

A HTML Injection vulnerability was found in /search-result.php of PHPGurukul User Registration & Login and User Manageme

Phpgurukul User Registration & Login and User Management System 3.2 is vulnerable to Cross Site Request Forgery (CSRF) v

A vulnerability classified as critical has been found in code-projects Pharmacy Management System 1.0. This affects an u

A vulnerability was found in SourceCodester Drag and Drop Image Upload 1.0. It has been rated as critical. Affected by t

Sensitive information manipulation due to improper authorization. The following products are affected: Acronis Cyber Pro

Cleartext transmission of sensitive information in acep-collector service. The following products are affected: Acronis

Excessive attack surface in acep-collector service due to binding to an unrestricted IP address. The following products

Excessive attack surface in acep-importer service due to binding to an unrestricted IP address. The following products a

Excessive attack surface in archive-server service due to binding to an unrestricted IP address. The following products

In the Linux kernel, the following vulnerability has been resolved: mm: avoid leaving partial pfn mappings around in er

An unauthenticated remote attacker can get read access to files in the "/tmp" directory due to missing authentication.

The devices contain two hard coded user accounts with hardcoded passwords that allow an unauthenticated remote attacker

An unauthenticated remote attacker can execute OS commands via UDP on the device due to missing authentication.

An unauthenticated local attacker can decrypt the devices config file and therefore compromise the device due to a weak

An unauthenticated remote attacker can perform a brute-force attack on the credentials of the remote service portal with

An unauthenticated local attacker can gain admin privileges by deploying a config file due to improper input validation.

A vulnerability was found in SourceCodester Online Eyewear Shop 1.0. It has been declared as critical. Affected by this

A vulnerability was found in SourceCodester Online Eyewear Shop 1.0. It has been classified as critical. Affected is an

The devices are vulnerable to session hijacking due to insufficient entropy in its session ID generation algorithm. The

Enterprise Cloud Database from Ragic does not properly validate the file type for uploads. Attackers with regular privil

Enterprise Cloud Database from Ragic does not authenticate access to specific functionality, allowing unauthenticated re

Enterprise Cloud Database from Ragic does not properly validate a specific page parameter, allowing unauthenticated remo

SQL injection vulnerability in TAI Smart Factory's QPLANT SF version 1.0. Exploitation of this vulnerability could allow

The Smart Online Order for Clover plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's moo

The device directly executes .patch firmware upgrade files on a USB stick without any prior authentication in the admin

The firmware upgrade function in the admin web interface of the Rittal IoT Interface & CMC III Processing Unit devices c

AIM LINE Marketing Platform from Esi Technology does not properly validate a specific query parameter. When the LINE Cam

The ee-class from FormosaSoft does not properly validate a specific page parameter, allowing remote attackers with regul

The ee-class from FormosaSoft does not properly validate a specific page parameter, allowing remote attackers with regul

The The AADMY – Add Auto Date Month Year Into Posts plugin for WordPress is vulnerable to arbitrary shortcode execution

Property Management System from ChanGate has a SQL Injection vulnerability, allowing unauthenticated remote attackers to

SHIRASAGI prior to v1.19.1 processes URLs in HTTP requests improperly, resulting in a path traversal vulnerability. If t

The WooCommerce plugin for WordPress is vulnerable to HTML Injection in all versions up to, and including, 9.0.2. This i

NVIDIA NeMo contains a vulnerability in SaveRestoreConnector where a user may cause a path traversal issue via an unsafe

Versions of the package markdown-to-jsx before 7.4.0 are vulnerable to Cross-site Scripting (XSS) via the src property d

The specific query functionality in the FlowMaster BPM Plus from NewType does not properly restrict user input, allowing

The FlowMaster BPM Plus system from NewType has a privilege escalation vulnerability. Remote attackers with regular priv