2021

PCI devices with RMRRs not deassigned correctly Certain PCI devices in a system might be assigned Reserved Memory Region

An issue in Gate One 1.2.0 allows attackers to bypass to the verification check done by the origins list and connect to

An arbitrary file creation by privilege escalation vulnerability in Trend Micro Apex One, Apex One as a Service, Worry-F

A insufficiently protected credentials in Fortinet FortiSDNConnector version 1.1.7 and below allows attacker to disclose

An improper neutralization of input vulnerability [CWE-79] in FortiWebManager versions 6.2.3 and below, 6.0.2 and below

An information disclosure vulnerability [CWE-200] in FortiAnalyzerVM and FortiManagerVM versions 7.0.0 and 6.4.6 and bel

A vulnerability affecting the F-Secure Antivirus engine was discovered when the engine tries to unpack a zip archive (LZ

An improper neutralization of input vulnerability [CWE-79] in FortiAnalyzer versions 6.4.3 and below, 6.2.7 and below an

An insufficient session expiration vulnerability [CWE- 613] in FortiClientEMS versions 6.4.2 and below, 6.2.8 and below

A path traversal vulnerability [CWE-22] in FortiClientEMS versions 6.4.1 and below; 6.2.8 and below may allow an authent

Vyper is a Pythonic Smart Contract Language for the EVM. In affected versions external functions did not properly valida

A Cross-Site Scripting (XSS) attack can cause arbitrary code (JavaScript) to run in a user’s browser while the browser i

A user controlled parameter related to SMTP test functionality is not correctly validated making it possible to add the

A user controlled parameter related to SMTP test functionality is not correctly validated making it possible to bypass b

User controlled parameters related to SMTP notifications are not correctly validated. This can lead to a buffer overflow

waimai Super Cms 20150505 contains a cross-site scripting (XSS) vulnerability in the component /admin.php?m=Config&a=add

waimai Super Cms 20150505 contains a cross-site scripting (XSS) vulnerability in the component /admin.php/Link/addsave.

waimai Super Cms 20150505 contains a cross-site scripting (XSS) vulnerability in the component /admin.php?&m=Public&a=lo

waimai Super Cms 20150505 has a logic flaw allowing attackers to modify a price, before form submission, by observing da

Scrapy-splash is a library which provides Scrapy and JavaScript integration. In affected versions users who use [`HttpAu

sylius/paypal-plugin is a paypal plugin for the Sylius development platform. In affected versions the URL to the payment

Buffer overflow in Zephyr USB DFU DNLOAD. Zephyr versions >= v2.5.0 contain Heap-based Buffer Overflow (CWE-122). For mo

Buffer Access with Incorrect Length Value in zephyr. Zephyr versions >= >=2.5.0 contain Buffer Access with Incorrect Len

Zephyr JSON decoder incorrectly decodes array of array. Zephyr versions >= >1.14.0, >= >2.5.0 contain Attempt to Access

BT: Possible to overwrite an existing bond during keys distribution phase when the identity address of the bond is known

DOS: Incorrect 802154 Frame Validation for Omitted Source / Dest Addresses. Zephyr versions >= > v2.4.0 contain NULL Poi

Composer is an open source dependency manager for the PHP language. In affected versions windows users running Composer

TYPO3 is an open source PHP based web content management system released under the GNU GPL. It has been discovered that

TYPO3 is an open source PHP based web content management system released under the GNU GPL. It has been discovered that

Grafana is an open source data visualization platform. In affected versions unauthenticated and authenticated users are

The FTL Server (tibftlserver) and Docker images containing tibftlserver components of TIBCO Software Inc.'s TIBCO Active

In ARCHIBUS Web Central 21.3.3.815 (a version from 2014), the Web Application in /archibus/login.axvw assign a session t

Omikron MultiCash Desktop 4.00.008.SP5 relies on a client-side authentication mechanism. When a user logs into the appli

Wowza Streaming Engine through 4.8.11+5 could allow an authenticated, remote attacker to exhaust filesystem resources vi

A Cross-Site Request Forgery (CSRF) vulnerability in Wowza Streaming Engine through 4.8.11+5 allows a remote attacker to

In ARCHIBUS Web Central 21.3.3.815 (a version from 2014), XSS occurs in /archibus/dwr/call/plaincall/workflow.runWorkflo

ARCHIBUS Web Central 21.3.3.815 (a version from 2014) does not properly validate requests for access to data and functio

A Denial Of Service vulnerability in the apollo_upload_server Ruby gem in GitLab CE/EE all versions starting from 11.9 b

In all versions of GitLab CE/EE since version 8.0, access tokens created as part of admin's impersonation of a user are

In all versions of GitLab EE since version 14.1, due to an insecure direct object reference vulnerability, an endpoint m

Permissions rules were not applied while issues were moved between projects of the same group in GitLab versions startin

In all versions of GitLab CE/EE since version 7.7, the application may let a malicious user create an OAuth client appli

In all versions of GitLab CE/EE since version 11.11, an instance that has the setting to disable Repo by URL import enab

An issue has been discovered in GitLab affecting all versions starting from 13.8 before 14.0.9, all versions starting fr

Missing access control in all GitLab versions starting from 13.12 before 14.0.9, all versions starting from 14.1 before

A stored Cross-Site Scripting vulnerability in the Jira integration in all GitLab versions starting from 13.9 before 14.

The project import/export feature in GitLab 8.9 and greater could be used to obtain otherwise private email addresses

An issue has been discovered in GitLab affecting all versions starting from 14.0 before 14.0.9, all versions starting fr

In all versions of GitLab CE/EE since version 8.0, a DNS rebinding vulnerability exists in Fogbugz importer which may be

A potential DOS vulnerability was discovered in GitLab starting with version 9.1 that allowed parsing files without auth