2024

Any project that parses untrusted Protocol Buffers data containing an arbitrary number of nested groups / series of SGRO

When logging in with the correct username and incorrect weak password, the user receives the notification, that their pa

In Brave Android prior to v1.67.116, domains in the Brave Shields popup are elided from the right instead of the left, w

Mautic allows you to update the application via an upgrade script. The upgrade logic isn't shielded off correctly, whic

Prior to this patch, a stored XSS vulnerability existed in the contact tracking and page hits report.

With access to edit a Mautic form, the attacker can add Cross-Site Scripting stored in the html filed. This could be use

Prior to this patch being applied, Mautic's tracking was vulnerable to Cross-Site Scripting through the Page URL variabl

Best House Rental Management System 1.0 contains an arbitrary file upload vulnerability in the save_settings() function

Best House Rental Management System 1.0 contains an arbitrary file upload vulnerability in the update_account() function

Best House Rental Management System 1.0 contains an arbitrary file upload vulnerability in the signup() function of the

Best House Rental Management System 1.0 contains a SQL injection vulnerability in the delete_category() function of the

Dedecms V5.7.115 contains an arbitrary code execution via file upload vulnerability in the backend.

DedeCMS 5.7.115 is vulnerable to Cross Site Scripting (XSS) via the advertisement code box in the advertisement manageme

Buffer Overflow vulnerability in btstack mesh commit before v.864e2f2b6b7878c8fab3cf5ee84ae566e3380c58 allows a remote a

CoreDNS through 1.10.1 enables attackers to achieve DNS cache poisoning and inject fake responses via a birthday attack.

The logic in place to facilitate the update process via the user interface lacks access control to verify if permission

Stack overflow vulnerability in the Login function in the HNAP service in D-Link DCS-960L with firmware 1.09 allows atta

An HTML injection vulnerability in RWS MultiTrans v7.0.23324.2 and earlier allows attackers to alter the HTML-layout and

Multiple stored cross-site scripting (XSS) vulnerabilities in RWS MultiTrans v7.0.23324.2 and earlier allow attackers to

A vulnerability has been discovered in all versions of Smartplay headunits, which are widely used in Suzuki and Toyota c

Anbox Management Service, in versions 1.17.0 through 1.23.0, does not validate the TLS certificate provided to it by the

Triangle Microworks TMW IEC 61850 Client source code libraries before 12.2.0 lack a buffer size check when processing re

spicedb is an Open Source, Google Zanzibar-inspired permissions database to enable fine-grained authorization for custom

Camaleon CMS is a dynamic and advanced content management system based on Ruby on Rails. A path traversal vulnerability

Camaleon CMS is a dynamic and advanced content management system based on Ruby on Rails. An arbitrary file write vulnera

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It's possible t

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It's possible f

runofast Indoor Security Camera for Baby Monitor has a default password of password for the root account. This allows ac

Mesop is a Python-based UI framework designed for rapid web apps development. A vulnerability has been discovered and fi

An issue was discovered in Bravura Security Fabric versions 12.3.x before 12.3.5.32784, 12.4.x before 12.4.3.35110, 12.5

**UNSUPPORTED WHEN ASSIGNED** An issue was discovered in BMC Remedy Mid Tier 7.6.04. An unauthenticated remote attacker

Victure PC420 1.1.39 was discovered to use a weak encryption key for the file enabled_telnet.dat on the Micro SD card.

Victure PC420 1.1.39 was discovered to use a weak and partially hardcoded key to encrypt data.

Victure PC420 1.1.39 was discovered to contain a hardcoded root password which is stored in plaintext.

Directus is a real-time API and App dashboard for managing SQL database content. When relying on blocking access to loca

find-my-way is a fast, open source HTTP router, internally using a Radix Tree (aka compact Prefix Tree), supports route

Wiki.js is an open source wiki app built on Node.js. A disabled user can still gain access to a wiki by abusing the pass

exec.CommandContext in Chaosblade 0.3 through 1.7.3, when server mode is used, allows OS command execution via the cmd p

FrogCMS V0.9.5 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/?/plugin/file_mana

Prior to the patched version, an authenticated user of Mautic could read system files and access the internal addresses

Files or Directories Accessible to External Parties vulnerability in Eliz Software Panel allows Collect Data from Common

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Eliz Softwa

Plaintext Storage of a Password vulnerability in Eliz Software Panel allows : Use of Known Domain Credentials. This iss

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Eliz Softwa

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Eliz Software Pane

Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the iprofileidx parameter at dialin.cgi. This

Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sPubKey parameter at dialin.cgi. This vul

Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sAct parameter at v2x00.cgi. This vulnera

Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the saveitem parameter at lan2lan.cgi. This v

Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the saveVPNProfile parameter at v2x00.cgi. Th