In video decoder, there is a possible out of bounds write due to improper input validation. This could lead to local denial of service with no additional execution privileges needed
AFFECTED_PRODUCTS:
Google Android,
Google Android
In jpg driver, there is a possible missing permission check. This could lead to local information disclosure with System execution privileges needed
AFFECTED_PRODUCTS:
Google Android,
Google Android,
Google Android
A vulnerability, which was classified as problematic, was found in DeepFaceLab pretrained DF.wf.288res.384.92.72.22. Affected is an unknown function of the file mainscripts/Util.py. The manipulation leads to deserialization. Local access is required to approach this attack. The exploit has been disc...
AFFECTED_PRODUCTS:
Iperov Deepfacelab
A vulnerability was found in PHPGurukul Company Visitor Management System 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file search-visitor.php. The manipulation leads to cross site scripting. The attack may be launched remotely. The exploit has b...
AFFECTED_PRODUCTS:
Phpgurukul Company Visitor Management System
A vulnerability was found in PHPGurukul Company Visitor Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file search-visitor.php. The manipulation leads to sql injection. The attack can be launched remotely. The exploit has be...
AFFECTED_PRODUCTS:
Phpgurukul Company Visitor Management System
Cross SiteScripting vulnerability in Citrix Session Recording allows attacker to perform Cross Site Scripting
AFFECTED_PRODUCTS:
Citrix Virtual Apps And Desktops,
Citrix Virtual Apps And Desktops,
Citrix Virtual Apps And Desktops
A vulnerability was found in Karjasoft Sami HTTP Server 2.0. It has been classified as problematic. Affected is an unknown function of the component HTTP HEAD Rrequest Handler. The manipulation leads to denial of service. It is possible to launch the attack remotely. The exploit has been disclosed t...
AFFECTED_PRODUCTS:
Karjasoft Sami Http Server
The Spreadsheet::ParseXLSX package before 0.30 for Perl allows XXE attacks because it neglects to use the no_xxe option of XML::Twig.
AFFECTED_PRODUCTS:
Tozt Spreadsheet\
pyLoad is a free and open-source Download Manager written in pure Python. The `pyload` API allows any API call to be made using GET requests. Since the session cookie is not set to `SameSite: strict`, this opens the library up to severe attack possibilities via a Cross-Site Request Forgery (CSRF) at...
AFFECTED_PRODUCTS:
Pyload-Ng Project Pyload Ng
A vulnerability was found in Project Worlds Visitor Management System 1.0. It has been classified as problematic. Affected is an unknown function of the file dataset.php of the component URL Handler. The manipulation of the argument name with the input "><script>alert('torada')</script> leads to cro...
AFFECTED_PRODUCTS:
Oretnom23 Visitor Management System
SonicWall Capture Client version 3.7.10, NetExtender client version 10.2.337 and earlier versions are installed with sfpmonitor.sys driver. The driver has been found to be vulnerable to Denial-of-Service (DoS) caused by Stack-based Buffer Overflow vulnerability.
AFFECTED_PRODUCTS:
SonicWall Netextender,
SonicWall Capture Client
A vulnerability was found in ZhiHuiYun up to 4.4.13 and classified as critical. This issue affects the function download_network_image of the file /app/Http/Controllers/ImageController.php of the component Search. The manipulation of the argument url leads to server-side request forgery. The attack...
AFFECTED_PRODUCTS:
Zhiyun-Tech Zhihuiyun
A vulnerability has been found in Yunyou CMS up to 2.2.6 and classified as critical. This vulnerability affects unknown code of the file /app/index/controller/Common.php. The manipulation of the argument templateFile leads to unrestricted upload. The attack can be initiated remotely. The exploit has...
AFFECTED_PRODUCTS:
Yunyou Cms Project Yunyou Cms
flaskBlog is a simple blog app built with Flask. Improper storage and rendering of the `/user/<user>` page allows a user's comments to execute arbitrary javascript code. The html template `user.html` contains the following code snippet to render comments made by a user: `<div class="content" tag="co...
AFFECTED_PRODUCTS:
Dogukanurker Flaskblog
Creditcoin is a network that enables cross-blockchain credit transactions. The Windows binary of the Creditcoin node loads a suite of DLLs provided by Microsoft at startup. If a malicious user has access to overwrite the program files directory it is possible to replace these DLLs and execute arbitr...
AFFECTED_PRODUCTS:
Gluwa Creditcoin
Improper Restriction of Operations within the Bounds of a Memory Buffer in NetScaler ADC and NetScaler Gateway allows Unauthenticated Denial of Service and Out-Of-Bounds Memory Read
AFFECTED_PRODUCTS:
Citrix Netscaler Application Delivery Controller,
Citrix Netscaler Application Delivery Controller,
Citrix Netscaler Application Delivery Controller
... (+6)
 Cross-site scripting (XSS)
AFFECTED_PRODUCTS:
Cloud Citrix Storefront,
Cloud Citrix Storefront,
Cloud Citrix Storefront
Improper Control of Generation of Code ('Code Injection') in NetScaler ADC and NetScaler Gateway allows an attacker with access to NSIP, CLIP or SNIP with management interface to perform Authenticated (low privileged) remote code execution on Management Interface.
AFFECTED_PRODUCTS:
Citrix Netscaler Application Delivery Controller,
Citrix Netscaler Application Delivery Controller,
Citrix Netscaler Application Delivery Controller
... (+6)
A Cross-site scripting (XSS) vulnerability in login page php code in Armex ABO.CMS 5.9 allows remote attackers to inject arbitrary web script or HTML via the login.php? URL part.
AFFECTED_PRODUCTS:
Abocms Abo.cms
Studio Network Solutions ShareBrowser before 7.0 on macOS mishandles signature verification, aka PMP-2636.
AFFECTED_PRODUCTS:
Studionetworksolutions Sharebrowser
A vulnerability, which was classified as problematic, was found in Sparksuite SimpleMDE up to 1.11.2. This affects an unknown part of the component iFrame Handler. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the pu...
AFFECTED_PRODUCTS:
Sparksuite Simplemde
Insecure Direct Object Reference vulnerabilities were discovered in the Avaya Aura Experience Portal Manager which may allow partial information disclosure to an authenticated non-privileged user. Affected versions include 8.0.x and 8.1.x, prior to 8.1.2 patch 0402. Versions prior to 8.0 are end of...
AFFECTED_PRODUCTS:
Avaya Aura Experience Portal
Missing Authorization vulnerability in ThemeinProgress WIP Custom Login.This issue affects WIP Custom Login: from n/a through 1.2.7.
AFFECTED_PRODUCTS:
Themeinprogress Wip Custom Login
Stupid Simple CMS <=1.2.4 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin-edit.php.
AFFECTED_PRODUCTS:
Codelyfe Stupid Simple Cms
Stupid Simple CMS <=1.2.4 is vulnerable to Cross Site Scripting (XSS) in the editing section of the article content.
AFFECTED_PRODUCTS:
Codelyfe Stupid Simple Cms
Missing Authorization vulnerability in CodePeople WP Time Slots Booking Form.This issue affects WP Time Slots Booking Form: from n/a through 1.1.76.
AFFECTED_PRODUCTS:
Codepeople Wp Time Slots Booking Form
Missing Authorization vulnerability in WP Job Portal WP Job Portal – A Complete Job Board.This issue affects WP Job Portal – A Complete Job Board: from n/a through 2.0.1.
AFFECTED_PRODUCTS:
Wpjobportal Wp Job Portal
A vulnerability in the web-based management interface of the Cisco WAP371 Wireless-AC/N Dual Radio Access Point (AP) with Single Point Setup could allow an authenticated, remote attacker to perform command injection attacks against an affected device. This vulnerability is due to improper validation...
AFFECTED_PRODUCTS:
Cisco Wap371 Firmware
A vulnerability in the web-based management interface of Cisco ThousandEyes Enterprise Agent, Virtual Appliance installation type, could allow an authenticated, remote attacker to perform a command injection and elevate privileges to root. This vulnerability is due to insufficient validation of user...
AFFECTED_PRODUCTS:
Cisco Thousandeyes Enterprise Agent
A vulnerability in the web-based management interface of Cisco Unity Connection could allow an unauthenticated, remote attacker to upload arbitrary files to an affected system and execute commands on the underlying operating system. This vulnerability is due to a lack of authentication in a specific...
AFFECTED_PRODUCTS:
Cisco Unity Connection,
Cisco Unity Connection
A vulnerability in the web-based management interface of Cisco BroadWorks Application Delivery Platform and Cisco BroadWorks Xtended Services Platform could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the interface.
This vulnerab...
AFFECTED_PRODUCTS:
Cisco Broadworks Application Delivery Platform,
Cisco Broadworks Application Delivery Platform,
Cisco Broadworks Application Delivery Platform
... (+3)
A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to perform a stored cross-site scripting (XSS) attack against a user of the interface on an affected device. This vulnerability exists because the web-based man...
AFFECTED_PRODUCTS:
Cisco Identity Services Engine,
Cisco Identity Services Engine,
Cisco Identity Services Engine
... (+87)
IBM QRadar SIEM 7.5 could disclose sensitive email information in responses from offense rules. IBM X-Force ID: 275709.
AFFECTED_PRODUCTS:
IBM Qradar Security Information And Event Manager
Missing Authorization vulnerability in MyThemeShop URL Shortener by MyThemeShop.This issue affects URL Shortener by MyThemeShop: from n/a through 1.0.17.
AFFECTED_PRODUCTS:
Mythemeshop Url Shortener
Missing Authorization vulnerability in Brainstorm Force Ultimate Addons for Beaver Builder – Lite.This issue affects Ultimate Addons for Beaver Builder – Lite: from n/a through 1.5.5.
AFFECTED_PRODUCTS:
Brainstormforce Ultimate Addons For Beaver Builder
A vulnerability in the web-based management interface of Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager (EPNM) could allow an authenticated, remote attacker to conduct SQL injection attacks on an affected system. This vulnerability is due to improper validation of user-sub...
AFFECTED_PRODUCTS:
Cisco Prime Infrastructure,
Cisco Prime Infrastructure,
Cisco Evolved Programmable Network Manager
A vulnerability in the application CLI of Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager could allow an authenticated, local attacker to gain escalated privileges. This vulnerability is due to improper processing of command line arguments to application scripts. An attacke...
AFFECTED_PRODUCTS:
Cisco Prime Infrastructure,
Cisco Prime Infrastructure,
Cisco Evolved Programmable Network Manager
A vulnerability in the web-based management interface of Cisco Prime Infrastructure could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system. This vulnerability is due to improper processing of serialized Java objects by the affected application....
AFFECTED_PRODUCTS:
Cisco Prime Infrastructure,
Cisco Prime Infrastructure,
Cisco Evolved Programmable Network Manager
A vulnerability in the web-based management interface of Cisco Prime Infrastructure could allow an authenticated, remote attacker to conduct cross-site scripting attacks. This vulnerability is due to improper validation of user-supplied input to the web-based management interface. An attacker could...
AFFECTED_PRODUCTS:
Cisco Prime Infrastructure,
Cisco Prime Infrastructure,
Cisco Evolved Programmable Network Manager
Cross-Site Request Forgery (CSRF) vulnerability in Vinoj Cardoza 3D Tag Cloud allows Stored XSS.This issue affects 3D Tag Cloud: from n/a through 3.8.
AFFECTED_PRODUCTS:
Cardozatechnologies Cardoza 3d Tag Cloud
Missing Authorization vulnerability in SedLex Traffic Manager.This issue affects Traffic Manager: from n/a through 1.4.5.
AFFECTED_PRODUCTS:
Sedlex Traffic Manager
Missing Authorization vulnerability in SedLex Image Zoom.This issue affects Image Zoom: from n/a through 1.8.8.
AFFECTED_PRODUCTS:
Sedlex Image Zoom
Missing Authorization vulnerability in Zorem Advanced Local Pickup for WooCommerce.This issue affects Advanced Local Pickup for WooCommerce: from n/a through 1.5.2.
AFFECTED_PRODUCTS:
Zorem Advanced Local Pickup For Woocommerce
An out-of-bounds memory write flaw was found in the Linux kernel’s Transport Layer Security functionality in how a user calls a function splice with a ktls socket as the destination. This flaw allows a local user to crash or potentially escalate their privileges on the system.
AFFECTED_PRODUCTS:
Linux Linux Kernel,
Linux Linux Kernel,
Linux Linux Kernel
... (+5)
A denial of service vulnerability was found in tipc_crypto_key_revoke in net/tipc/crypto.c in the Linux kernel’s TIPC subsystem. This flaw allows guests with local user privileges to trigger a deadlock and potentially crash the system.
AFFECTED_PRODUCTS:
Linux Linux Kernel,
Linux Linux Kernel,
Red Hat Enterprise Linux
... (+1)
A denial of service vulnerability due to a deadlock was found in sctp_auto_asconf_init in net/sctp/socket.c in the Linux kernel’s SCTP subsystem. This flaw allows guests with local user privileges to trigger a deadlock and potentially crash the system.
AFFECTED_PRODUCTS:
Linux Linux Kernel,
Red Hat Enterprise Linux,
Red Hat Enterprise Linux
In Progress MOVEit Transfer versions released before 2022.0.10 (14.0.10), 2022.1.11 (14.1.11), 2023.0.8 (15.0.8), 2023.1.3 (15.1.3), an input validation issue was discovered. An authenticated user can manipulate a parameter in an HTTPS transaction. The modified transaction could lead to computati...
AFFECTED_PRODUCTS:
Progress MOVEit Transfer,
Progress MOVEit Transfer,
Progress MOVEit Transfer
... (+1)
Missing Authorization vulnerability in MagneticOne Cart2Cart: Magento to WooCommerce Migration.This issue affects Cart2Cart: Magento to WooCommerce Migration: from n/a through 2.0.0.
AFFECTED_PRODUCTS:
Magneticone Magento To Woocommerce Migration
Missing Authorization vulnerability in AlgolPlus Advanced Dynamic Pricing for WooCommerce.This issue affects Advanced Dynamic Pricing for WooCommerce: from n/a through 4.1.5.
AFFECTED_PRODUCTS:
Algolplus Advanced Dynamic Pricing For Woocommerce
Missing Authorization vulnerability in Zorem Sales Report Email for WooCommerce.This issue affects Sales Report Email for WooCommerce: from n/a through 2.8.
AFFECTED_PRODUCTS:
Zorem Sales Report Email For Woocommerce