2024

Local ABL Client bypass of the required PASOE security checks may allow an attacker to commit unauthorized code injectio

Missing Authorization vulnerability in SAMPAŞ Holding AKOS (AkosCepVatandasService), SAMPAŞ Holding AKOS (TahsilatServic

BPL Personal Weighing Scale PWS-01BT IND/09/18/599 devices send sensitive information in unencrypted BLE packets. (The p

Memory safety bugs present in Firefox 129. Some of these bugs showed evidence of memory corruption and we presume that w

Multiple prompts and panels from both Firefox and the Android OS could be used to obscure the notification announcing th

Memory safety bugs present in Firefox 129, Firefox ESR 128.1, and Thunderbird 128.1. Some of these bugs showed evidence

If a site had been granted the permission to open popup windows, it could cause Select elements to appear on top of anot

A difference in the handling of StructFields and ArrayTypes in WASM could be used to trigger an exploitable type confusi

The JavaScript garbage collector could mis-color cross-compartment objects if OOM conditions were detected at the right

Firefox normally asks for confirmation before asking the operating system to find an application to handle a scheme that

Internal browser event interfaces were exposed to web content when privileged EventHandler listener callbacks ran for th

A potentially exploitable type confusion could be triggered when looking up a property name on an object being used as t

There is a MEDIUM severity vulnerability affecting CPython. Regular expressions that allowed excessive backtracking

SeaCMS v12.9 was discovered to contain a SQL injection vulnerability via the id parameter at /dmplayer/dmku/index.php?ac

A cross-site scripting (XSS) vulnerability in the component admin_collect_news.php of SeaCMS v12.9 allows attackers to e

Yandex Browser for Desktop before 24.7.1.380 has a DLL Hijacking Vulnerability because an untrusted search path is used.

This vulnerability exists in Symphony XTS Web Trading platform version 2.0.0.1_P160 due to improper access controls on A

UltiMaker Cura slicer versions 5.7.0-beta.1 through 5.7.2 are vulnerable to code injection via the 3MF format reader (/p

This vulnerability exists in Symphony XTS Web Trading platform version 2.0.0.1_P160 due to improper access controls on A

This vulnerability exists due to improper access controls on APIs in the Authentication module of Symphony XTS Web Tradi

Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Ge

VMware Fusion (13.x before 13.6) contains a code-execution vulnerability due to the usage of an insecure environment var

Dell Path to PowerProtect, versions 1.1, 1.2, contains an Exposure of Private Personal Information to an Unauthorized Ac

The improper neutralization of special elements in the parameter "host" in the CGI program of Zyxel NWA1123ACv3 firmware

A reflected cross-site scripting (XSS) vulnerability in the CGI program "dynamic_script.cgi" of Zyxel ATP series firmwar

A post-authentication command injection vulnerability in Zyxel ATP series firmware versions from V4.60 through V5.38 and

A buffer overflow vulnerability in the CGI program of Zyxel ATP series firmware versions from V4.32 through V5.38, USG F

A buffer overflow vulnerability in the library "libclinkc" of the Zyxel VMG8825-T50K firmware version 5.50(ABOM.8)C0 cou

A post-authentication command injection vulnerability in Zyxel ATP series firmware versions from V4.32 through V5.38, US

A post-authentication command injection vulnerability in Zyxel ATP series firmware versions from V5.00 through V5.38, US

A null pointer dereference vulnerability in Zyxel ATP series firmware versions from V4.32 through V5.38, USG FLEX series

A command injection vulnerability in the IPSec VPN feature of Zyxel ATP series firmware versions from V4.32 through V5.3

A vulnerability was found in SourceCodester Contact Manager with Export to VCF 1.0. It has been rated as critical. This

D-Link DAP-2310 Hardware A Firmware 1.16RC028 allows remote attackers to execute arbitrary code via a stack-based buffer

The registration process of uniFLOW Online (NT-ware product) apps, prior to and including version 2024.1.0, can be compr

ASIS (aka Aplikasi Sistem Sekolah using CodeIgniter 3) 3.0.0 through 3.2.0 allows index.php username SQL injection for A

The Electron desktop application of Rocket.Chat through 6.3.4 allows stored XSS via links in an uploaded file, related t

Cleartext Storage of Sensitive Information vulnerability in NAC Telecommunication Systems Inc. NACPremium allows Retriev

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NAC Telecommunicat

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in NAC Telecommunicat

Hoverfly is a lightweight service virtualization/ API simulation / API mocking tool for developers and testers. The `/ap

Overleaf is a web-based collaborative LaTeX editor. When installing Server Pro using the Overleaf Toolkit from before 20

Overleaf is a web-based collaborative LaTeX editor. Overleaf Community Edition and Server Pro prior to version 5.0.7 (or

Quinn is a pure-Rust, async-compatible implementation of the IETF QUIC transport protocol. As of quinn-proto 0.11, it is

HedgeDoc is an open source, real-time, collaborative, markdown notes application. When using HedgeDoc 1 with MySQL or Ma

Vim is an open source, command line text editor. Patch v9.1.0038 optimized how the cursor position is calculated and rem

gix-path is a crate of the gitoxide project dealing with git paths and their conversions. `gix-path` executes `git` to f

In the Linux kernel, the following vulnerability has been resolved: fuse: Initialize beyond-EOF page contents before se

Jellyfin is an open source self hosted media server. The Jellyfin user profile image upload accepts SVG files, allowing

audiobookshelf is a self-hosted audiobook and podcast server. A non-admin user is not allowed to create libraries (or ac