2024

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in DataFlowX Technology Dat

A cross-site scripting (XSS) vulnerability in the component \bean\Manager.java of Drug v1.0 allows attackers to execute

`gix-path` is a crate of the `gitoxide` project (an implementation of `git` written in Rust) dealing paths and their con

alf.io is an open source ticket reservation system for conferences, trade shows, workshops, and meetups. Prior to versio

alf.io is an open source ticket reservation system for conferences, trade shows, workshops, and meetups. Prior to versio

gnark is a fast zk-SNARK library that offers a high-level API to design circuits. Prior to version 0.11.0, commitments t

gnark is a fast zk-SNARK library that offers a high-level API to design circuits. Versions prior to 0.11.0 have a soundn

Sourcecodester Simple Forum Website v1.0 has a SQL injection vulnerability in /php-sqlite-forum/?page=manage_user&id=.

Authorization Bypass Through User-Controlled Key, Missing Authorization vulnerability in Ariva Computer Accord ORS allow

In the Linux kernel, the following vulnerability has been resolved: media: aspeed: Fix memory overwrite if timing is 16

In the Linux kernel, the following vulnerability has been resolved: media: dvb-usb-v2: af9035: Fix null-ptr-deref in af

The Frontend Post Submission Manager Lite – Frontend Posting WordPress Plugin plugin for WordPress is vulnerable to unau

The WP AdCenter – Ad Manager & Adsense Ads plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘ad

The WP-Recall – Registration, Profile, Commerce & More plugin for WordPress is vulnerable to privilege escalation/accoun

The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to blind SQL Injectio

The WP ULike WordPress plugin before 4.7.2.1 does not properly sanitize user display names when rendering on a public p

tgt (aka Linux target framework) before 1.0.93 attempts to achieve entropy by calling rand without srand. The PRNG seed

Dell SmartFabric OS10 Software, version(s) 10.5.5.4 through 10.5.5.10 and 10.5.6.x, contain(s) an Use of Hard-coded Pass

Dell SmartFabric OS10 Software, version(s) 10.5.5.4 through 10.5.5.10 and 10.5.6.x , contain(s) an Improper Neutralizati

The Image Optimizer, Resizer and CDN – Sirv plugin for WordPress is vulnerable to unauthorized modification of data due

The Newsletters plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 4.9.9.2

The Remember Me Controls plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including

The issue was addressed by suspending Persona when the virtual keyboard is active. This issue is fixed in visionOS 1.3.

In OpenStack Ironic before 26.0.1 and ironic-python-agent before 9.13.1, there is a vulnerability in image processing, i

ckeditor-plugin-openlink is a plugin for the CKEditor JavaScript text editor that extends the context menu with a possib

Credentials to access device configuration were transmitted using an unencrypted protocol. These credentials would allow

Credentials to access device configuration information stored unencrypted in flash memory. These credentials would allow

FlyCASS CASS and KCM systems did not correctly filter SQL queries, which made them vulnerable to attack by outside atta

An issue was discovered in Mbed TLS 3.x before 3.6.1. With TLS 1.3, when a server enables optional authentication of the

An issue was discovered in Mbed TLS 3.6 before 3.6.1. A stack buffer overflow in mbedtls_ecdsa_der_to_raw() and mbedtls_

An issue was discovered in Mbed TLS before 2.28.9 and 3.x before 3.6.1, in which the user-selected algorithm is not used

Improper Input Validation vulnerability in Progress LoadMaster allows OS Command Injection.This issue affects: * LoadMa

stripe-cli is a command-line tool for the payment processor Stripe. A vulnerability exists in stripe-cli starting in ver

Asterisk is an open-source private branch exchange (PBX). Prior to versions 18.24.3, 20.9.3, and 21.4.3 of Asterisk and

SuiteCRM is an open-source customer relationship management (CRM) system. Prior to version 7.14.5 and 8.6.2, insufficien

Sourcecodehero Event Management System 1.0 allows Stored Cross-Site Scripting via parameters Full Name, Address, Email,

Sourcecodehero Event Management System1.0 is vulnerable to SQL Injection via the parameter 'username' in /event/admin/lo

MindsDB is a platform for building artificial intelligence from enterprise data. Prior to version 23.12.4.2, a threat ac

RapidIdentity LTS through 2023.0.2 and Cloud through 2024.08.0 improperly restricts excessive authentication attempts an

An issue was discovered in za-internet C-MOR Video Surveillance 5.2401. Due to improper input validation, the C-MOR web

An issue was discovered in za-internet C-MOR Video Surveillance 5.2401. Sensitive information is stored in cleartext. It

An issue was discovered in za-internet C-MOR Video Surveillance 5.2401. Due to improper user input validation, it is pos

IBM Aspera Faspex 5.0.0 through 5.0.9 could allow a user to bypass intended access restrictions and conduct resource mod

IBM Aspera Faspex 5.0.0 through 5.0.9 could allow a user to bypass intended access restrictions and conduct resource mod

IBM Aspera Faspex 5.0.0 through 5.0.9 could allow a user with access to the package to obtain sensitive information thro

SQL Injection vulnerability in ESAFENET CDG 5.6 and before allows an attacker to execute arbitrary code via the id param

An issue was discovered in Trusted Firmware-M through 2.0.0. The lack of argument verification in the logging subsystem

The fix for CVE-2024-2199 in 389-ds-base was insufficient to cover all scenarios. In certain product versions, an authen

An issue was discovered in za-internet C-MOR Video Surveillance 5.2401. Due to improper user input validation, it is pos

An issue was discovered in za-internet C-MOR Video Surveillance 5.2401. Due to improper privilege management concerning