2021

In NetBSD through 9.2, there is an information leak in the TCP ISN (ISS) generation algorithm.

In NetBSD through 9.2, the IPv4 ID generation algorithm does not use appropriate cryptographic measures.

In the IPv4 implementation in the Linux kernel before 5.12.4, net/ipv4/route.c has an information leak because the hash

In the IPv6 implementation in the Linux kernel before 5.13.3, net/ipv6/output_core.c has an information leak because of

In NetBSD through 9.2, the IPv6 fragment ID generation algorithm employs a weak cryptographic PRNG.

In WebKitGTK before 2.32.4, there is a use-after-free in WebCore::Frame::page, a different vulnerability than CVE-2021-3

In WebKitGTK before 2.32.4, there is a use-after-free in WebCore::ContainerNode::firstChild, a different vulnerability t

In WebKitGTK before 2.32.4, there is incorrect memory allocation in WebCore::ImageBufferCairoImageSurfaceBackend::create

An issue was discovered in the Linux kernel before 5.15.11. There is a memory leak in the __rds_conn_create() function i

invoiceninja is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

All versions of package js-data are vulnerable to Prototype Pollution via the deepFillIn and the set functions. This is

The package parse-link-header before 2.0.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via the checkH

elgg is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

This affects all versions of package github.com/kataras/iris; all versions of package github.com/kataras/iris/v12. The u

Path traversal vulnerability in GroupSession Free edition ver5.1.1 and earlier, GroupSession byCloud ver5.1.1 and earlie

Open redirect vulnerability in GroupSession Free edition ver5.1.1 and earlier, GroupSession byCloud ver5.1.1 and earlier

Incorrect permission assignment for critical resource vulnerability in GroupSession Free edition ver5.1.1 and earlier, G

Plaintext storage of a password vulnerability in IDEC PLCs (FC6A Series MICROSmart All-in-One CPU module v2.32 and earli

Unprotected transport of credentials vulnerability in IDEC PLCs (FC6A Series MICROSmart All-in-One CPU module v2.32 and

In MediaWiki through 1.37, the Special:ImportFile URI (aka FileImporter) allows XSS, as demonstrated by the clientUrl pa

In MediaWiki through 1.37, Wikibase item descriptions allow XSS, which is triggered upon a visit to an action=info URL (

In MediaWiki through 1.37, XSS can occur in Wikibase because an external identifier property can have a URL format that

In MediaWiki through 1.37, blocked IP addresses are allowed to edit EntitySchema items.

An issue was discovered in UTI Mutual fund Android application 5.4.18 and prior, allows attackers to brute force enumera

lib/DatabaseLayer.py in cve-search before 4.1.0 allows regular expression injection, which can lead to ReDoS (regular ex

A flaw was found in the hivex library. This flaw allows an attacker to input a specially crafted Windows Registry (hive)

A flaw was found in SSSD, where the sssctl command was vulnerable to shell command injection via the logs-fetch and cach

A flaw was found in podman. The `podman machine` function (used to create and manage Podman virtual machine containing a

An XSS vulnerability was found in Privoxy which was fixed in cgi_error_no_template() by encode the template name when Pr

A memory leak vulnerability was found in Privoxy when handling errors.

A vulnerability was found in Privoxy which was fixed in process_encrypted_request_headers() by freeing header memory whe

A vulnerability was found in Privoxy which was fixed in get_url_spec_param() by freeing memory of compiled pattern spec

mySCADA myPRO: Versions 8.20.0 and prior has a vulnerable debug interface which includes a ping utility, which may allow

mySCADA myPRO Versions 8.20.0 and prior stores passwords using MD5, which may allow an attacker to crack the previously

An additional, nondocumented administrative account exists in mySCADA myPRO Versions 8.20.0 and prior that is not expose

An unauthenticated remote attacker can access mySCADA myPRO Versions 8.20.0 and prior without any form of authentication

mySCADA myPRO: Versions 8.20.0 and prior has a feature where the firmware can be updated, which may allow an attacker to

mySCADA myPRO: Versions 8.20.0 and prior has a feature to send emails, which may allow an attacker to inject arbitrary o

A server side remote code execution vulnerability was found in Foreman project. A authenticated attacker could use Sendm

The HTTP PUT and DELETE methods were enabled in the Web Help Desk web server (12.7.7 and earlier), allowing users to exe

A logic issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.6.2, macOS Monterey

NetApp Virtual Desktop Service (VDS) when used with an HTML5 gateway is susceptible to a vulnerability which when succes

StorageGRID (formerly StorageGRID Webscale) versions 11.5 prior to 11.5.0.5 are susceptible to a vulnerability which may

mySCADA myPRO: Versions 8.20.0 and prior has a feature where the password can be specified, which may allow an attacker

mySCADA myPRO: Versions 8.20.0 and prior has a feature where the API password can be specified, which may allow an attac

The HornetQ component of Artemis in EAP 7 was not updated with the fix for CVE-2016-4978. A remote attacker could use th

This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Catalina 10.15.4, Security Update

A use after free issue was addressed with improved memory management. This issue is fixed in macOS Catalina 10.15.4, Sec

This issue was addressed with improved entitlements. This issue is fixed in watchOS 6, tvOS 13, macOS Catalina 10.15, iO

This issue was addressed with a new entitlement. This issue is fixed in macOS Mojave 10.14.6, Security Update 2019-004 H