2021

In all versions of GitLab EE starting from 13.10 before 14.1.7, all versions starting from 14.2 before 14.2.5, and all v

In all versions of GitLab EE since version 8.13, an endpoint discloses names of private groups that have access to a pro

In all versions of GitLab CE/EE, provided a user ID, anonymous users can use a few endpoints to retrieve information abo

A stored Reflected Cross-Site Scripting vulnerability in the Jira integration in GitLab version 13.0 up to 14.3.1 allowe

In all versions of GitLab CE/EE since version 13.6, it is possible to see pending invitations of any public group or pub

In all versions of GitLab CE/EE since version 14.1, an improper access control vulnerability allows users with expired p

In all versions of GitLab CE/EE since version 8.9, project exports may expose trigger tokens configured on that project.

In all versions of GitLab CE/EE since version 8.15, a DNS rebinding vulnerability in Gitea Importer may be exploited by

A business logic error in the project deletion process in GitLab 13.6 and later allows persistent access via project acc

Afian FileRun 2021.03.26 allows XSS when an administrator encounters a crafted document during use of the HTML Editor fo

A stored Cross-Site Scripting vulnerability in the GitLab Flavored Markdown in GitLab CE/EE version 8.4 and above allowe

Nagios Enterprises NagiosXI <= 5.8.4 contains a Server-Side Request Forgery (SSRF) vulnerability in schedulereport.php.

Afian FileRun 2021.03.26 allows Remote Code Execution (by administrators) via the Check Path value for the magick binary

Afian FileRun 2021.03.26 allows Remote Code Execution (by administrators) via the Check Path value for the ffmpeg binary

Afian FileRun 2021.03.26 allows stored XSS via an HTTP X-Forwarded-For header that is mishandled when rendering Activity

A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path trave

While fuzzing the 2.4.49 httpd, a new null pointer dereference was detected during HTTP/2 request processing, allowing a

The decode_data function in drivers/net/hamradio/6pack.c in the Linux kernel before 5.13.13 has a slab out-of-bounds wri

An out-of-bounds access in GffLine::GffLine in gff.cpp in GCLib 0.12.7 allows an attacker to cause a segmentation fault

Survey Solutions is a survey management and data collection system. In affected versions the Headquarters application pu

Moby is an open-source project created by Docker to enable software containerization. A bug was found in Moby (Docker En

Moby is an open-source project created by Docker to enable software containerization. A bug was found in Moby (Docker En

Hiredis is a minimalistic C client library for the Redis database. In affected versions Hiredis is vulnurable to integer

A cross-site scripting (XSS) vulnerability in the component /admin/?setting-base.htm of Xiuno BBS 4.0.4 allows attackers

A cross-site scripting (XSS) vulnerability in the component /admin/?setting-base.htm of Xiuno BBS 4.0.4 allows attackers

A cross-site scripting (XSS) vulnerability in the component install\install.sql of Xiuno BBS 4.0.4 allows attackers to e

An issue in the component route\user.php of Xiuno BBS v4.0.4 allows attackers to enumerate usernames.

Maccms 10 contains a cross-site scripting (XSS) vulnerability in the Editing function under the Member module. This vuln

HongCMS v3.0 contains an arbitrary file read and write vulnerability in the component /admin/index.php/template/edit.

Docker CLI is the command line interface for the docker container runtime. A bug was found in the Docker CLI where runni

A local file inclusion (LFI) vulnerability exists in version BIQS IT Biqs-drive v1.83 and below when sending a specific

A cross-site scripting (XSS) vulnerability in the parameter type_en of Maccms 10 allows attackers to obtain the administ

A Cross-Site Request Forgery (CSRF) in the component admin.php/admin/type/info.html of Maccms 10 allows attackers to gai

A blind SQL injection vulnerability exists in the Raymart DG / Ahmed Helal Hotel-mgmt-system. A malicious attacker can r

The DynamicPageList3 extension is a reporting tool for MediaWiki, listing category members and intersections with variou

Wire-server is the backing server for the open source wire secure messaging application. In affected versions it is poss

Wire is an open source secure messenger. Users of Wire by Bund may bypass the mandatory encryption at rest feature by si

Wire is an open source secure messenger. In affected versions if the an attacker gets an old but valid access token they

LCDS LAquis SCADA through 4.3.1.1085 is vulnerable to a control bypass and path traversal. If an attacker can get a vict

mySCADA myDESIGNER 8.20.0 and below allows Directory Traversal attacks when importing project files. If an attacker can

Redis is an open source, in-memory database that persists on disk. An integer overflow bug in the underlying string libr

The Stripe for WooCommerce WordPress plugin is missing a capability check on the save() function found in the ~/includes

In GFOS Workforce Management 4.8.272.1, the login page of application is prone to authentication bypass, allowing anyone

An attacker with physical access to Boston Scientific Zoom Latitude Model 3120 can remove the hard disk drive or create

The affected device uses off-the-shelf software components that contain unpatched vulnerabilities. A malicious attacker

The programmer installation utility does not perform a cryptographic authenticity or integrity checks of the software on

An attacker with physical access to the device can extract the binary that checks for the hardware key and reverse engin

A skilled attacker with physical access to the affected device can gain access to the hard disk drive of the device to c

Redis is an open source, in-memory database that persists on disk. The redis-cli command line tool and redis-sentinel se

Redis is an open source, in-memory database that persists on disk. An integer overflow bug affecting all versions of Red