2024

eNMS up to 4.7.1 is vulnerable to Directory Traversal via download/folder.

eNMS 4.4.0 to 4.7.1 is vulnerable to Directory Traversal via scan_folder.

eNMS 4.0.0 is vulnerable to Directory Traversal via get_tree_files.

Navidrome is an open source web-based music collection server and streamer. Navidrome automatically adds parameters in t

Plate is a javascript toolkit that makes it easier for you to develop with Slate, a popular framework for building text

Galaxy is a free, open-source system for analyzing data, authoring workflows, training and education, publishing tools,

An issue in Pure Data 0.54-0 and fixed in 0.54-1 allows a local attacker to escalate privileges via the set*id () functi

A vulnerability, which was classified as critical, has been found in SourceCodester Best House Rental Management System

A vulnerability classified as critical has been found in Codezips Internal Marks Calculation 1.0. Affected is an unknown

A vulnerability was found in code-projects Blood Bank Management System 1.0. It has been classified as critical. This af

A vulnerability was found in code-projects Patient Record Management System 1.0 and classified as critical. Affected by

An insufficient boundary validation in the USB code could lead to an out-of-bounds read on the heap, which could potenti

Zitadel is an open source identity management platform. ZITADEL's user account deactivation mechanism did not work corre

Zitadel is an open source identity management platform. ZITADEL's user grants deactivation mechanism did not work correc

Envoy is a cloud-native high-performance edge/middle/service proxy. Envoy's 1.31 is using `oghttp` as the default HTTP/2

The reference validator is a tool to perform advanced validation of FHIR resources for TI applications and interoperabil

Microsoft Office Visio Remote Code Execution Vulnerability

A flaw exists in the SAML signature validation method within the Keycloak XMLSignatureUtil class. The method incorrectly

There exists a use after free vulnerability in Reverb. Reverb supports the VARIANT datatype, which is supposed to repres

A stored Cross-site Scripting (XSS) vulnerability affecting 3DSwym in 3DSwymer from Release 3DEXPERIENCE R2022x through

A reflected Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator from Release 3DEX

Kastle Systems firmware prior to May 1, 2024, stored machine credentials in cleartext, which may allow an attacker to ac

Kastle Systems firmware prior to May 1, 2024, contained a hard-coded credential, which if accessed may allow an attacker

logiops through 0.3.4, in its default configuration, allows any unprivileged user to configure its logid daemon via an u

FrogCMS v0.9.5 was discovered to contain a Cross-Site Request Forgery (CSRF) via /admin/?/user/add

A SQL injection vulnerability in linlinjava litemall 1.8.0 allows a remote attacker to obtain sensitive information via

Any project that parses untrusted Protocol Buffers data containing an arbitrary number of nested groups / series of SGRO

In Brave Android prior to v1.67.116, domains in the Brave Shields popup are elided from the right instead of the left, w

Mautic allows you to update the application via an upgrade script. The upgrade logic isn't shielded off correctly, whic

Prior to this patch, a stored XSS vulnerability existed in the contact tracking and page hits report.

Dedecms V5.7.115 contains an arbitrary code execution via file upload vulnerability in the backend.

CoreDNS through 1.10.1 enables attackers to achieve DNS cache poisoning and inject fake responses via a birthday attack.

The logic in place to facilitate the update process via the user interface lacks access control to verify if permission

Stack overflow vulnerability in the Login function in the HNAP service in D-Link DCS-960L with firmware 1.09 allows atta

A vulnerability has been discovered in all versions of Smartplay headunits, which are widely used in Suzuki and Toyota c

Anbox Management Service, in versions 1.17.0 through 1.23.0, does not validate the TLS certificate provided to it by the

Triangle Microworks TMW IEC 61850 Client source code libraries before 12.2.0 lack a buffer size check when processing re

Camaleon CMS is a dynamic and advanced content management system based on Ruby on Rails. A path traversal vulnerability

Mesop is a Python-based UI framework designed for rapid web apps development. A vulnerability has been discovered and fi

Victure PC420 1.1.39 was discovered to use a weak encryption key for the file enabled_telnet.dat on the Micro SD card.

Victure PC420 1.1.39 was discovered to contain a hardcoded root password which is stored in plaintext.

exec.CommandContext in Chaosblade 0.3 through 1.7.3, when server mode is used, allows OS command execution via the cmd p

FrogCMS V0.9.5 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/?/plugin/file_mana

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Eliz Software Pane

Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the iprofileidx parameter at dialin.cgi. This

Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sPubKey parameter at dialin.cgi. This vul

Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sAct parameter at v2x00.cgi. This vulnera

Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the saveitem parameter at lan2lan.cgi. This v

Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the saveVPNProfile parameter at v2x00.cgi. Th

Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the trapcomm parameter at cgiswm.cgi. This vu