2021

Cross-site scripting (XSS) vulnerability in templates/installer/step-004.inc.php in spotweb 1.5.1 and below allow remote

Cross-site scripting (XSS) vulnerability in index.php in FlexTV beta development version allows remote attackers to inje

Cross-site scripting (XSS) vulnerability in callback.php in Spotify-for-Alfred 0.13.9 and below allows remote attackers

Cross-site scripting (XSS) vulnerability in demos/demo.mysqli.php in getID3 1.X and v2.0.0-beta allows remote attackers

Cross-site scripting (XSS) vulnerability in dompdf/dompdf/www/demo.php infaveo-helpdesk v1.11.0 and below allow remote a

Cross-site scripting (XSS) vulnerability in install/index.php in bugs 1.8 and below version allows remote attackers to i

Cross-site scripting (XSS) vulnerability in install/index.php in bugs 1.8 and below version allows remote attackers to i

Cross-site scripting (XSS) vulnerability in install/index.php in bugs 1.8 and below version allows remote attackers to i

Cross-site scripting (XSS) vulnerability in _contactform.inc.php in Detector 0.8.5 and below version allows remote attac

An un-authenticated error-based and time-based blind SQL injection vulnerability exists in Kaushik Jadhav Online Food Or

On 2.1.15 version and below of Lider module in LiderAhenk software is leaking it's configurations via an unsecured API.

Stored cross-site scripting (XSS) issue in Esri Portal for ArcGIS may allow a remote unauthenticated attacker to pass an

A reflected XSS vulnerability in Esri Portal for ArcGIS version 10.9 and below may allow a remote attacker able to convi

There is an privilege escalation vulnerability in organization-specific logins in Esri Portal for ArcGIS versions 10.9 a

An un-authenticated SQL Injection exists in PuneethReddyHC online-shopping-system-advanced through the /homeaction.php c

An un-authenticated SQL Injection exists in PuneethReddyHC online-shopping-system-advanced through the /action.php prId

Galera WebTemplate 1.0 is affected by a directory traversal vulnerability that could reveal information from /etc/passwd

cwlviewer is a web application to view and share Common Workflow Language workflows. Versions prior to 1.3.1 contain a D

Scalabium dBase Viewer version 2.6 (Build 5.751) is vulnerable to remote code execution via a crafted DBF file that trig

There is a stack buffer overflow in MP4Box v1.0.1 at src/filters/dmx_nhml.c:1008 in the nhmldmx_send_sample() function s

There is a stack buffer overflow in MP4Box 1.1.0 at src/filters/dmx_nhml.c in nhmldmx_init_parsing which leads to a deni

There is a stack buffer overflow in MP4Box v1.0.1 at src/filters/dmx_nhml.c:1004 in the nhmldmx_send_sample() function s

Privilege Escalation vulnerability in a Windows system driver of McAfee Drive Encryption (DE) prior to 7.3.0 could allow

The MacOS version of Multipass, version 1.7.0, fixed in 1.7.2, accidentally installed the application directory with inc

An information disclosure via path traversal was discovered in apport/hookutils.py function read_file(). This issue affe

Function check_attachment_for_errors() in file data/general-hooks/ubuntu.py could be tricked into exposing private data

The Windows version of Multipass before 1.7.0 allowed any local process to connect to the localhost TCP control socket t

A cross-site scripting (XSS) vulnerability has been reported to affect QNAP device running Image2PDF. If exploited, this

A cross-site scripting (XSS) vulnerability has been reported to affect QNAP device running Photo Station. If exploited,

A cross-site scripting (XSS) vulnerability has been reported to affect QNAP NAS running Photo Station. If exploited, thi

A cross-site scripting (XSS) vulnerability has been reported to affect QNAP device running Photo Station. If exploited,

A command injection vulnerability has been reported to affect QNAP device running QVR. If exploited, this vulnerability

A vulnerability exists in SMM (System Management Mode) branch that registers a SWSMI handler that does not sufficiently

JeeCMS 1.0.1 contains a stored cross-site scripting (XSS) vulnerability which allows attackers to execute arbitrary web

FlameCMS 3.3.5 contains a time-based blind SQL injection vulnerability in /account/register.php.

FlameCMS 3.3.5 contains a SQL injection vulnerability in /master/article.php via the "Id" parameter.

Directory traversal in the Copy, Move, and Delete features in Pydio Cells 2.2.9 allows remote authenticated users to enu

A stack-based buffer overflow in the httpd server on Tenda AC9 V15.03.06.60_EN allows remote attackers to execute arbitr

wire-server is an open-source back end for Wire, a secure collaboration platform. Before version 2.106.0, the CORS ` Acc

REINER timeCard 6.05.07 installs a Microsoft SQL Server with an sa password that is hardcoded in the TCServer.jar file.

Broken access control for user creation in Pydio Cells 2.2.9 allows remote anonymous users to create standard users via

Directory traversal in the Compress feature in Pydio Cells 2.2.9 allows remote authenticated users to overwrite personal

Zoho ManageEngine OpManager version 125466 and below is vulnerable to SQL Injection in the getReportData API.

NETSCOUT Systems nGeniusONE version 6.3.0 build 1196 allows URL redirection in redirector.

NETSCOUT Systems nGeniusONE 6.3.0 build 1196 allows Reflected Cross-Site Scripting (XSS) in the support endpoint.

NETSCOUT Systems nGeniusONE 6.3.0 build 1196 allows Arbitrary File Read operations via the FDSQueryService endpoint.

NETSCOUT Systems nGeniusONE 6.3.0 build 1196 allows Authorization Bypass (to access an endpoint) in FDSQueryService.

NEI in NETSCOUT nGeniusONE 6.3.0 build 1196 allows XML External Entity (XXE) attacks.

NETSCOUT nGeniusONE 6.3.0 build 1196 allows high-privileged users to achieve Stored Cross-Site Scripting (XSS) in FDSQue

NETSCOUT nGeniusONE 6.3.0 build 1196 and earlier allows Stored Cross-Site Scripting (XSS) in UploadFile.