2021

A denial of service vulnerability in all versions of GitLab CE/EE before 13.12.2, 13.11.5 or 13.10.5 allows an attacker

Incorrect access control in push notification service in Night Owl Smart Doorbell FW version 20190505 allows remote user

Django before 2.2.24, 3.x before 3.1.12, and 3.2.x before 3.2.4 has a potential directory traversal via django.contrib.a

In SilverStripe through 4.6.0-rc1, a FormField with square brackets in the field name skips validation.

SilverStripe through 4.6.0-rc1 has an XXE Vulnerability in CSSContentParser. A developer utility meant for parsing HTML

In Nuvoton NPCT75x TPM 1.2 firmware 7.4.0.0, a local authenticated malicious user with high privileges could potentially

In Apache APISIX Dashboard version 2.6, we changed the default value of listen host to 0.0.0.0 in order to facilitate us

When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab CE

SSL Network Extender Client for Linux before build 800008302 reveals part of the contents of the configuration file supp

An attacker can modify the pointers in enclave memory to overwrite arbitrary memory addresses within the secure enclave.

An attacker can modify the address to point to trusted memory to overwrite arbitrary trusted memory. It is recommended t

An attacker can change the pointer to untrusted memory to point to trusted memory region which causes copying trusted me

In ICEcoder 8.0 allows, a reflected XSS vulnerability was identified in the multipe-results.php page due to insufficient

ntpkeygen can generate keys that ntpd fails to parse. NTPsec 1.2.0 allows ntpkeygen to generate keys with '#' characters

A cross-site scripting (XSS) issue was discovered in Intland codeBeamer ALM 10.x through 10.1.SP4. It is possible to per

A flaw double-free memory corruption in the Linux kernel HCI device initialization subsystem was found in the way user a

An integer overflow leading to a heap-buffer overflow was found in OpenEXR in versions before 3.0.1. An attacker could u

An integer overflow leading to a heap-buffer overflow was found in the DwaCompressor of OpenEXR in versions before 3.0.1

An integer overflow leading to a heap-buffer overflow was found in the DwaCompressor of OpenEXR in versions before 3.0.1

Adiscon LogAnalyzer 4.1.10 and 4.1.11 allow login.php XSS.

The package locutus before 2.0.15 are vulnerable to Regular Expression Denial of Service (ReDoS) via the gopher_parsedir

EditworkflowScheme.jspa in Jira Server and Jira Data Center before version 8.5.14, and from version 8.6.0 before version

The CardLayoutConfigTable component in Jira Server and Jira Data Center before version 8.5.15, and from version 8.6.0 be

The number range searcher component in Jira Server and Jira Data Center before version 8.5.14, from version 8.6.0 before

A flaw was found in the machine-config-operator that causes an OpenShift node to become unresponsive when a container co

Incorrect security UI in payments in Google Chrome on Android prior to 91.0.4472.77 allowed a remote attacker to perform

Insufficient policy enforcement in content security policy in Google Chrome prior to 91.0.4472.77 allowed a remote attac

Insufficient policy enforcement in content security policy in Google Chrome prior to 91.0.4472.77 allowed a remote attac

Insufficient policy enforcement in cookies in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to bypass co

Insufficient policy enforcement in iFrameSandbox in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to byp

Insufficient policy enforcement in PopupBlocker in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to bypa

Insufficient policy enforcement in Content Security Policy in Google Chrome prior to 91.0.4472.77 allowed a remote attac

Insufficient policy enforcement in Content Security Policy in Google Chrome prior to 91.0.4472.77 allowed a remote attac

An improper authorization flaw was discovered in openstack-selinux's applied policy where it does not prevent a non-root

Dino before 0.1.2 and 0.2.x before 0.2.1 allows Directory Traversal (only for creation of new files) via URI-encoded pat

Flask-AppBuilder is a development framework, built on top of Flask. User enumeration in database authentication in Flask

Open Redirect in Z-BlogPHP v1.5.2 and earlier allows remote attackers to obtain sensitive information via the "redirect"

A flaw was found in wildfly. The EJBContext principle is not popped back after invoking another EJB using a different Se

IBM DataPower Gateway 10.0.0.0 through 10.0.1.0 and 2018.4.1.0 through 2018.4.1.14 stores sensitive information in GET r

In Accela Civic Platform through 21.1, the security/hostSignon.do parameter servProvCode is vulnerable to XSS. NOTE: The

A SQL injection vulnerability exists in some configurations of ArcGIS Server versions 10.8.1 and earlier. Specially craf

The Easy Preloader WordPress plugin through 1.0.0 does not sanitise its setting fields, leading to authenticated (admin+

The iFlyChat WordPress plugin before 4.7.0 does not sanitise its APP ID setting before outputting it back in the page, l

The JNews WordPress theme before 8.0.6 did not sanitise the cat_id parameter in the POST request /?ajax-request=jnews (w

PageLayer before 1.3.5 allows reflected XSS via color settings.

PageLayer before 1.3.5 allows reflected XSS via the font-size parameter.

Zoho ManageEngine Key Manager Plus before 6001 allows Stored XSS on the user-management page while importing malicious u

An issue was discovered in 2sic 2sxc before 11.22. A XSS vulnerability in the sxcver parameter of dnn/ui.html allows an

On NXP MIFARE Ultralight and NTAG cards, an attacker can interrupt a write operation (aka conduct a "tear off" attack) o

The aaugustin websockets library before 9.1 for Python has an Observable Timing Discrepancy on servers when HTTP Basic A