CVE-2023-1668: Always-Incorrect Control Flow Implementation

A flaw was found in openvswitch OVS. When processing an IP packet with protocol 0, OVS will install the datapath flow without the action modifying the IP header. This issue results for both kernel and userspace datapath in installing a datapath flow matching all IP protocols nwproto is wildcarded...

CVE-2021-43361: Improper Neutralization of Special Elements used in an SQL Command

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in MedData HBYS allows SQL Injection.This issue affects HBYS: from unspecified before 1.1...

CVE-2026-48976: Insufficiently Protected Credentials

HomeBox is a home inventory and organization system. Prior to 0.26.0, NotifierRepository.Update in backend/internal/data/repo/reponotifier.go updates a notifier through UpdateOneIDid without requiring the record's user ID to match the authenticated user. An authenticated user who supplies another...

CVE-2026-93455: Missing Authorization

django-page-cms through 2.0.13 fails to properly validate page permissions in admin helper views, allowing any staff account to read arbitrary page content and stored media paths. Attackers with low-privilege staff credentials can enumerate content identifiers and access unpublished drafts, page...

CVE-2026-93587: Uncontrolled Resource Consumption

ImageMagick before 7.1.2-31 and before 6.9.13-56 contains a policy bypass in the PCD and, per the upstream advisory, CUBE and HALD coder: when a specific command line option is supplied, the decoder does not check a configured resource limit, which can result in extra memory allocation. A local...

CVE-2023-52181: Deserialization of Untrusted Data

Deserialization of Untrusted Data vulnerability in Presslabs Theme per user.This issue affects Theme per user: from n/a through 1.0.1...

CVE-2023-50272: Authentication Bypass Using an Alternate Path or Channel

A potential security vulnerability has been identified in HPE Integrated Lights-Out 5 iLO 5 and Integrated Lights-Out 6 iLO 6. The vulnerability could be remotely exploited to allow authentication bypass...

CVE-2023-4020: Out-of-bounds Read

An unvalidated input in a library function responsible for communicating between secure and non-secure memory in Silicon Labs TrustZone implementation allows reading/writing of memory in the secure region of memory from the non-secure region of memory...

CVE-2023-36004: Improper Authentication

Windows DPAPI Data Protection Application Programming Interface Spoofing Vulnerability...

CVE-2023-6579: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability, which was classified as critical, has been found in osCommerce 4. Affected by this issue is some unknown functionality of the file /b2b-supermarket/shopping-cart of the component POST Parameter Handler. The manipulation of the argument estimatecountryid leads to sql injection. Th...

CVE-2023-22524: Undefined Security Weakness

Certain versions of the Atlassian Companion App for MacOS were affected by a remote code execution vulnerability. An attacker could utilize WebSockets to bypass Atlassian Companion’s blocklist and MacOS Gatekeeper to allow execution of code...

CVE-2023-5210: Improper Neutralization of Input During Web Page Generation

The AMP+ Plus WordPress plugin through 3.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2023-38879: Improper Limitation of a Pathname to a Restricted Directory

The Community Edition version 9.0 of OS4ED's openSIS Classic allows remote attackers to read arbitrary files via a directory traversal vulnerability in the 'filename' parameter of 'DownloadWindow.php'...

CVE-2023-27417: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Timo Reith Affiliate Super Assistent plugin = 1.5.1 versions...

CVE-2023-46779: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in EasyRecipe plugin = 3.5.3251 versions...

CVE-2023-38472: Reachable Assertion

A vulnerability was found in Avahi. A reachable assertion exists in the avahirdataparse function...

CVE-2023-5252: Improper Neutralization of Input During Web Page Generation

The FareHarbor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 3.6.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level...

CVE-2023-37912: Privilege Context Switching Error

XWiki Rendering is a generic Rendering system that converts textual input in a given syntax into another syntax. Prior to version 14.10.6 of org.xwiki.platform:xwiki-core-rendering-macro-footnotes and org.xwiki.platform:xwiki-rendering-macro-footnotes and prior to version 15.1-rc-1 of...

CVE-2023-40425: Insertion of Sensitive Information into Log File

A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Sonoma 14, macOS Monterey 12.7.1. An app with root privileges may be able to access private information...

CVE-2023-5730: Out-of-bounds Write

Memory safety bugs present in Firefox 118, Firefox ESR 115.3, and Thunderbird 115.3. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox 119, Firefox ESR...

CVE-2023-45837: Improper Neutralization of Input During Web Page Generation

Unauth. Reflected Cross-Site Scripting XSS vulnerability in XYDAC Ultimate Taxonomy Manager plugin = 2.0 versions...

CVE-2023-39734: Improper Privilege Management

The leakage of the client secret in VISION MEAT WORKS TrackDiner10/10mc Line v13.6.1 allows attackers to obtain the channel access token and send crafted broadcast messages...

CVE-2023-4923: Cross-Site Request Forgery (CSRF)

The BEAR for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.3.3. This is due to missing or incorrect nonce validation on the woobebulkoperationsdelete function. This makes it possible for unauthenticated attackers to delete products via a forged reques...

CVE-2023-44399: Weak Password Recovery Mechanism for Forgotten Password

ZITADEL provides identity infrastructure. In versions 2.37.2 and prior, ZITADEL administrators can enable a setting called "Ignoring unknown usernames" which helps mitigate attacks that try to guess/enumerate usernames. While this settings was properly working during the authentication process it...

CVE-2020-27630: Use of Insufficiently Random Values

In Silicon Labs uC/TCP-IP 3.6.0, TCP ISNs are improperly random...

CVE-2023-39646: Improper Neutralization of Special Elements used in an SQL Command

Improper neutralization of SQL parameter in Theme Volty CMS Category Chain Slider module for PrestaShop. In the module “Theme Volty CMS Category Chain Slide"tvcmscategorychainslider up to version 4.0.1 from Theme Volty for PrestaShop, a guest can perform SQL injection in affected versions...

CVE-2023-44048: Improper Neutralization of Input During Web Page Generation

Sourcecodester Expense Tracker App v1 is vulnerable to Cross Site Scripting XSS via add category...

CVE-2023-5161: Improper Neutralization of Input During Web Page Generation

The Modal Window plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 5.3.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-lev...

CVE-2023-32649: Improper Validation of Syntactic Correctness of Input

A Denial of Service Dos vulnerability in Nozomi Networks Guardian and CMC, due to improper input validation in certain fields used in the Asset Intelligence functionality of our IDS, allows an unauthenticated attacker to crash the IDS module by sending specially crafted malformed network packets...

CVE-2023-4830: Improper Neutralization of Special Elements used in an SQL Command

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Tura Signalix allows SQL Injection. This issue affects Signalix: 7T0228...

CVE-2018-4617: Undefined Security Weakness

Rejected reason: This candidate is unused by its CNA...

CVE-2019-8859: Undefined Security Weakness

Rejected reason: This candidate is unused by its CNA...

CVE-2023-4208: Use After Free

A use-after-free vulnerability in the Linux kernel's net/sched: clsu32 component can be exploited to achieve local privilege escalation. When u32change is called on an existing filter, the whole tcfresult struct is always copied into the new instance of the filter. This causes a problem when...

CVE-2023-3849: Improper Neutralization of Input During Web Page Generation

A vulnerability, which was classified as problematic, was found in mooSocial mooDating 1.2. Affected is an unknown function of the file /find-a-match of the component URL Handler. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. The identifier of this...

CVE-2023-32481: Allocation of Resources Without Limits or Throttling

Wyse Management Suite versions prior to 4.0 contain a denial-of-service vulnerability. An authenticated malicious user can flood the configured SMTP server with numerous requests in order to deny access to the system...

CVE-2023-28054: Improper Input Validation

Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with administrator privileges may potentially exploit this vulnerability in order to modify a UEFI variable...

CVE-2023-27908: Uncontrolled Search Path Element

A maliciously crafted DLL file can be forced to write beyond allocated boundaries in the Autodesk installer when parsing the DLL files and could lead to a Privilege Escalation vulnerability...

CVE-2023-3339: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability has been found in code-projects Agro-School Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file exam-delete.php. The manipulation of the argument testid leads to sql injection. The attack can be launched remotely...

CVE-2020-20413: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability found in WUZHICMS v.4.1.0 allows a remote attacker to execute arbitrary code via the checktitle function in admin/content.php...

CVE-2023-29293: Improper Input Validation

Adobe Commerce versions 2.4.6 and earlier, 2.4.5-p2 and earlier and 2.4.4-p3 and earlier are affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An admin privileged attacker could leverage this vulnerability to impact the availability of a user's...

CVE-2020-36730: Missing Authorization

The CMP for WordPress is vulnerable to authorization bypass due to a missing capability check on the cmpgetpostdetail, niteoexportcsv, and cmpdisablecomingsoonajax functions in versions up to, and including, 3.8.1. This makes it possible for unauthenticated attackers to read posts, export...

CVE-2023-31508: Undefined Security Weakness

Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: CVE-2020-15178. Reason: This record is a duplicate of CVE-2020-15178. Notes: All CVE users should reference CVE-2020-15178 instead of this record. All references and descriptions in this record have been removed to prevent accidental usage...

CVE-2023-1747: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability has been found in IBOS up to 4.5.4 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /?r=email/api/mark&op=delFromSend. The manipulation of the argument emailids leads to sql injection. The attack can be launched remotely. The explo...

CVE-2023-23611: Missing Authorization

LTI Consumer XBlock implements the consumer side of the LTI specification enabling integration of third-party LTI provider tools. Versions 7.0.0 and above, prior to 7.2.2, are vulnerable to Missing Authorization. Any LTI tool that is integrated with on the Open edX platform can post a grade back...

CVE-2023-0332: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was found in SourceCodester Online Food Ordering System 2.0. It has been classified as critical. Affected is an unknown function of the file admin/manageuser.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit...

CVE-2022-47864: Improper Neutralization of Special Elements used in an SQL Command

Lead Management System v1.0 is vulnerable to SQL Injection via the id parameter in removeCategories.php...

CVE-2022-28281: Out-of-bounds Write

If a compromised content process sent an unexpected number of WebAuthN Extensions in a Register command to the parent process, an out of bounds write would have occurred leading to memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbird 91.8, Firefox 99, and...

CVE-2020-26356: Undefined Security Weakness

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none...

CVE-2021-43258: Unrestricted Upload of File with Dangerous Type

CartView.php in ChurchInfo 1.3.0 allows attackers to achieve remote code execution through insecure uploads. This requires authenticated access tot he ChurchInfo application. Once authenticated, a user can add names to their cart, and compose an email. Uploading an attachment for the email stores...

CVE-2022-3885: Use After Free

Use after free in V8 in Google Chrome prior to 107.0.5304.106 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...