2021

It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configu

Zoho ManageEngine Desktop Central is vulnerable to authentication bypass, leading to remote code execution on the server

Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in con

A code injection vulnerability in the Ivanti EPM Cloud Services Appliance (CSA) allows an unauthenticated user to execut

A vulnerability in the web management interface of FatPipe WARP, IPVPN, and MPVPN software prior to versions 10.1.2r60p9

A Stack-based buffer overflow vulnerability in SMA100 Apache httpd server's mod_cgi module environment variables allows

Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and SupportCenter Plus before 11014

Roundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to a potential SQL injection via search or search_params.

Metabase is an open source data analytics platform. In affected versions a security issue has been discovered with the c

Sitecore XP 7.5 Initial Release to Sitecore XP 8.2 Update-7 is vulnerable to an insecure deserialization attack where it

BQE BillQuick Web Suite 2018 through 2021 before 22.0.9.1 allows SQL injection for unauthenticated remote code execution

Yealink Device Management (DM) 3.6.0.20 allows command injection as root via the /sm/api/v1/firewall/zone/services URI,

Use after free in Portals in Google Chrome prior to 94.0.4606.61 allowed a remote attacker who had compromised the rende

Use after free in Indexed DB API in Google Chrome prior to 93.0.4577.82 allowed a remote attacker who had compromised th

It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. An attacker could use a path

Grafana is an open source data visualization platform. In affected versions unauthenticated and authenticated users are

A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path trave

Improper Access Control in Citrix ShareFile storage zones controller before 5.11.20 may allow an unauthenticated attacke

The vCenter Server contains an arbitrary file upload vulnerability in the Analytics service. A malicious actor with netw

A command injection vulnerability in the web server of some Hikvision product. Due to the insufficient input validation,

A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. Th

The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can by

The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can by

Open Management Infrastructure (OMI) Remote Code Execution Vulnerability

SAP NetWeaver (Visual Composer 7.0 RT) versions - 7.30, 7.31, 7.40, 7.50, without restriction, an attacker authenticated

An issue was discovered in Aviatrix Controller 6.x before 6.5-1804.1922. Unrestricted upload of a file with a dangerous

Zoho ManageEngine ADSelfService Plus version 6113 and prior is vulnerable to REST API authentication bypass with resulta

Zoho ManageEngine ServiceDesk Plus before 11302 is vulnerable to authentication bypass that allows a few REST-API URLs w

In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an un

Realtek Jungle SDK version v2.x up to v3.4.14B provides an HTTP web server exposing a management interface that can be u

Realtek Jungle SDK version v2.x up to v3.4.14B provides a diagnostic tool called 'MP Daemon' that is usually compiled as

Sunhillo SureLine before 8.7.0.1.1 allows Unauthenticated OS Command Injection via shell metacharacters in ipAddr or dns

Improper neutralization of a SQL Command leading to SQL Injection vulnerability impacting end-of-life Secure Remote Acce

ForgeRock AM server before 7.0 has a Java deserialization vulnerability in the jato.pageSession parameter on multiple pa

Microsoft discovered a remote code execution (RCE) vulnerability in the SolarWinds Serv-U product utilizing a Remote Mem

Microsoft Exchange Server Elevation of Privilege Vulnerability

Microsoft Exchange Server Remote Code Execution Vulnerability

Kaseya VSA before 9.5.7 allows credential disclosure, as exploited in the wild in July 2021. By default Kaseya VSA on pr

Deserialization of Untrusted Data vulnerability in CheckboxWeb.dll of Checkbox Survey allows an unauthenticated remote a

The vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the Virtual

An improper authorization vulnerability has been reported to affect QNAP NAS running HBS 3 (Hybrid Backup Sync. ) If exp

HTTP Protocol Stack Remote Code Execution Vulnerability

An issue was discovered on Tenda AC11 devices with firmware through 02.03.01.104_CN. A stack buffer overflow vulnerabili

The administrator application on ASUS GT-AC2900 devices before 3.0.0.4.386.42643 and Lyra Mini before 3.0.0.4_384_46630

Multiple vulnerabilities in the web-based management interface of Cisco HyperFlex HX could allow an unauthenticated, rem

Multiple vulnerabilities in the web-based management interface of Cisco HyperFlex HX could allow an unauthenticated, rem

A path traversal vulnerability in the web interfaces of Buffalo WSR-2533DHPL2 firmware version <= 1.02 and WSR-2533DHP3

An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. GitLab was not properly validati

Pulse Connect Secure 9.0R3/9.1R1 and higher is vulnerable to an authentication bypass vulnerability exposed by the Windo

A command injection vulnerability has been reported to affect QTS and QuTS hero. If exploited, this vulnerability allows