CVE-2023-21726: Storing Passwords in a Recoverable Format

Windows Credential Manager User Interface Elevation of Privilege Vulnerability...

CVE-2023-21542: Improper Link Resolution Before File Access

Windows Installer Elevation of Privilege Vulnerability...

CVE-2022-38481: Improper Neutralization of Input During Web Page Generation

An issue was discovered in Mega HOPEX 15.2.0.6110 before V5CP2. The application is prone to reflected Cross-site Scripting XSS in several features...

CVE-2022-36441: Improper Access Control

An issue was discovered in Zebra Enterprise Home Screen 4.1.19. The Gboard used by different applications can be used to launch and use several other applications that are restricted by the admin...

CVE-2023-22909: Undefined Security Weakness

An issue was discovered in MediaWiki before 1.35.9, 1.36.x through 1.38.x before 1.38.5, and 1.39.x before 1.39.1. SpecialMobileHistory allows remote attackers to cause a denial of service because database queries are slow...

CVE-2022-38492: Improper Neutralization of Special Elements used in an SQL Command

An issue was discovered in EasyVista 2020.2.125.3 and 2022.1.109.0.03. One parameter allows SQL injection. Version 2022.1.110.1.02 fixes the vulnerability...

CVE-2023-0022: Improper Control of Generation of Code

SAP BusinessObjects Business Intelligence Analysis edition for OLAP allows an authenticated attacker to inject malicious code that can be executed by the application over the network. On successful exploitation, an attacker can perform operations that may completely compromise the application...

CVE-2023-21771: Sensitive Data Storage in Improperly Locked Memory

Windows Local Session Manager LSM Elevation of Privilege Vulnerability...

CVE-2022-4337: Out-of-bounds Read

An out-of-bounds read in Organization Specific TLV was found in various versions of OpenvSwitch...

CVE-2023-0129: Out-of-bounds Write

Heap buffer overflow in Network Service in Google Chrome prior to 109.0.5414.74 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page and specific interactions. Chromium security severity: High...

CVE-2023-22469: Insecure Storage of Sensitive Information

Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. When getting the reference preview for Deck cards the user has no access to, unauthorized user could eventually get the cached data of a user that has access. There ar...

CVE-2023-0136: Undefined Security Weakness

Inappropriate implementation in in Fullscreen API in Google Chrome on Android prior to 109.0.5414.74 allowed a remote attacker to execute incorrect security UI via a crafted HTML page. Chromium security severity: Medium...

CVE-2023-21755: Use After Free

Windows Kernel Elevation of Privilege Vulnerability...

CVE-2023-21737: Heap-based Buffer Overflow

Microsoft Office Visio Remote Code Execution Vulnerability...

CVE-2023-20528: Improper Input Validation

Insufficient input validation in the SMU may allow a physical attacker to exfiltrate SMU memory contents over the I2C bus potentially leading to a loss of confidentiality...

CVE-2023-21772: Out-of-bounds Read

Windows Kernel Elevation of Privilege Vulnerability...

CVE-2023-22899: Origin Validation Error

Zip4j through 2.11.2, as used in Threema and other products, does not always check the MAC when decrypting a ZIP archive...

CVE-2022-4338: Out-of-bounds Read

An integer underflow in Organization Specific TLV was found in various versions of OpenvSwitch...

CVE-2023-21548: Sensitive Data Storage in Improperly Locked Memory

Windows Secure Socket Tunneling Protocol SSTP Remote Code Execution Vulnerability...

CVE-2023-0128: Use After Free

Use after free in Overview Mode in Google Chrome on Chrome OS prior to 109.0.5414.74 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...

CVE-2022-4711: Improper Access Control

The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wprsavemegamenusettings' AJAX action in versions up to, and including, 1.3.59. This allows any authenticated user, including those with subscriber-level permissions, to enable and modify Mega Menu...

CVE-2021-26403: Insufficient Verification of Data Authenticity

Insufficient checks in SEV may lead to a malicious hypervisor disclosing the launch secret potentially resulting in compromise of VM confidentiality...

CVE-2023-21538: Deserialization of Untrusted Data

.NET Denial of Service Vulnerability...

CVE-2023-0023: Exposure of Sensitive Information to an Unauthorized Actor

In SAP Bank Account Management Manage Banks application, when a user clicks a smart link to navigate to another app, personal data is shown directly in the URL. They might get captured in log files, bookmarks, and so on disclosing sensitive data of the application...

CVE-2021-26328: Improperly Implemented Security Check for Standard

Failure to verify the mode of CPU execution at the time of SNPINIT may lead to a potential loss of memory integrity for SNP guests...

CVE-2023-21561: Integer Overflow or Wraparound

Microsoft Cryptographic Services Elevation of Privilege Vulnerability...

CVE-2022-4704: Improper Access Control

The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wprimporttemplateskit' AJAX action in versions up to, and including, 1.3.59. This allows any authenticated user, including those with subscriber-level permissions, to import preset site...

CVE-2022-4382: Use After Free

A use-after-free flaw caused by a race among the superblock operations in the gadgetfs Linux driver was found. It could be triggered by yanking out a device that is running the gadgetfs side...

CVE-2023-21546: Sensitive Data Storage in Improperly Locked Memory

Windows Layer 2 Tunneling Protocol L2TP Remote Code Execution Vulnerability...

CVE-2021-46779: Out-of-bounds Write

Insufficient input validation in SVCECCPRIMITIVE system call in a compromised user application or ABL may allow an attacker to corrupt ASP AMD Secure Processor OS memory which may lead to potential loss of integrity and availability...

CVE-2023-21754: Integer Overflow or Wraparound

Windows Kernel Elevation of Privilege Vulnerability...

CVE-2022-3416: Undefined Security Weakness

The WPtouch WordPress plugin before 4.3.45 does not properly validate images to be uploaded, allowing high privilege users such as admin to upload arbitrary files on the server even when they should not be allowed to for example in multisite setup...

CVE-2023-22472: Cross-Site Request Forgery (CSRF)

Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. It is possible to make a user send any POST request with an arbitrary body given they click on a malicious deep link on a Windows computer. e.g. in an email, chat link...

CVE-2022-3679: Undefined Security Weakness

The Starter Templates by Kadence WP WordPress plugin before 1.2.17 unserialises the content of an imported file, which could lead to PHP object injection issues when an admin import intentionally or not a malicious file and a suitable gadget chain is present on the blog...

CVE-2022-4368: Undefined Security Weakness

The WP CSV WordPress plugin through 1.8.0.0 does not sanitize and escape a parameter before outputting it back in the page when importing a CSV, and doe snot have CSRF checks in place as well, leading to a Reflected Cross-Site Scripting...

CVE-2021-4310: Improper Neutralization of Input During Web Page Generation

A vulnerability was found in 01-Scripts 01-Artikelsystem. It has been classified as problematic. Affected is an unknown function of the file 01article.php. The manipulation of the argument $SERVER'PHPSELF' leads to cross site scripting. It is possible to launch the attack remotely. The patch is...

CVE-2022-4325: Undefined Security Weakness

The Post Status Notifier Lite WordPress plugin before 1.10.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which can be used against high privilege users such as admin...

CVE-2022-4884: Improper Limitation of a Pathname to a Restricted Directory

Path-Traversal in MKP storing in Tribe29 Checkmk =2.0.0p32 and = 2.1.0p18 allows an administrator to write mkp files to arbitrary locations via a malicious mkp file...

CVE-2022-4196: Undefined Security Weakness

The Multi Step Form WordPress plugin before 1.7.8 does not sanitise and escape some of its form fields, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2022-2196: Initialization of a Resource with an Insecure Default

A regression exists in the Linux Kernel within KVM: nVMX that allowed for speculative execution attacks. L2 can carry out Spectre v2 attacks on L1 due to L1 thinking it doesn't need retpolines or IBPB after running L2 due to KVM L0 advertising eIBRS support to L1. An attacker at L2 with code...

CVE-2019-25100: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was found in happyman twmap. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file twmap3/data/ajaxCRUD/pointdata2.php. The manipulation of the argument id leads to sql injection. Upgrading to version v2.9v4.31 is able to address...

CVE-2014-125066: Improper Resource Shutdown or Release

A vulnerability was found in emmflo yuko-bot. It has been declared as problematic. This vulnerability affects unknown code. The manipulation of the argument title leads to denial of service. The attack can be initiated remotely. The name of the patch is e580584b877934a4298d4dd0c497c79e579380d0. I...

CVE-2021-4307: Improperly Controlled Modification of Object Prototype Attributes

A vulnerability was found in Yomguithereal Baobab up to 2.6.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality. The manipulation leads to improperly controlled modification of object prototype attributes 'prototype pollution'. The attack can be launche...

CVE-2023-0112: Improper Neutralization of Input During Web Page Generation

Cross-site Scripting XSS - Stored in GitHub repository usememos/memos prior to 0.10.0...

CVE-2020-36644: Improper Neutralization of Input During Web Page Generation

A vulnerability has been found in jamesmartin Inline SVG up to 1.7.1 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file lib/inlinesvg/actionview/helpers.rb of the component URL Parameter Handler. The manipulation of the argument filename leads to...

CVE-2018-25069: Use of Hard-coded Password

A vulnerability classified as critical has been found in Netis Netcore Router. This affects an unknown part. The manipulation leads to use of hard-coded password. It is possible to initiate the attack remotely. The identifier VDB-217593 was assigned to this vulnerability...

CVE-2018-25070: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability has been found in polterguy Phosphorus Five up to 8.2 and classified as critical. This vulnerability affects the function csv.Read of the file plugins/extras/p5.mysql/NonQuery.cs of the component CSV Import. The manipulation leads to sql injection. Upgrading to version 8.3 is able...

CVE-2015-10024: Improper Limitation of a Pathname to a Restricted Directory

A vulnerability classified as critical was found in hoffie larasync. This vulnerability affects unknown code of the file repository/content/filestorage.go. The manipulation leads to path traversal. The name of the patch is 776bad422f4bd4930d09491711246bbeb1be9ba5. It is recommended to apply a pat...

CVE-2021-4306: Inefficient Regular Expression Complexity

A vulnerability classified as problematic has been found in cronvel terminal-kit up to 2.1.7. Affected is an unknown function. The manipulation leads to inefficient regular expression complexity. Upgrading to version 2.1.8 is able to address this issue. The name of the patch is...

CVE-2014-125048: Session Fixation

A vulnerability, which was classified as critical, has been found in kassi xingwall. This issue affects some unknown processing of the file app/controllers/oauth.js. The manipulation leads to session fixiation. The patch is named e9f0d509e1408743048e29d9c099d36e0e1f6ae7. It is recommended to appl...