2021

NETSCOUT nGeniusONE 6.3.0 build 1004 and earlier allows Stored Cross-Site Scripting (XSS) in the Packet Analysis module.

IBM Cloud Pak for Security (CP4S) 1.7.0.0, 1.7.1.0, 1.7.2.0, and 1.8.0.0 uses weaker than expected cryptographic algorit

IBM Cloud Pak for Security (CP4S) 1.7.0.0, 1.7.1.0, 1.7.2.0, and 1.8.0.0 could allow an attacker to perform unauthorized

IBM Sterling Order Management 9.4, 9.5, and 10.0 is vulnerable to cross-site scripting. This vulnerability allows users

rudp v0.6 was discovered to contain a memory leak in the component main.c.

libiec_iccp_mod v1.5 contains a segmentation violation in the component server_example1.c.

libiec_iccp_mod v1.5 contains a heap-buffer-overflow in the component mms_client_connection.c.

libiec_iccp_mod v1.5 contains a heap-buffer-overflow in the component mms_client_example1.c.

An improper authentication in Fortinet FortiManager version 6.4.3 and below, 6.2.6 and below allows attacker to assign a

An improper neutralization of formula elements in a csv file in Fortinet FortiManager version 6.4.3 and below, 6.2.7 and

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to version

Acrobat Reader DC versions versions 2020.013.20074 (and earlier), 2020.001.30018 (and earlier) and 2017.011.30188 (and e

BaiCloud-cms v2.5.7 is affected by an arbitrary file deletion vulnerability, which allows an attacker to delete arbitrar

ECOA BAS controller stores sensitive data (backup exports) in clear-text, thus the unauthenticated attacker can remotely

ECOA BAS controller is vulnerable to configuration disclosure when direct object reference is made to the specific files

ECOA BAS controller’s special page displays user account and passwords in plain text, thus unauthenticated attackers can

ECOA BAS controller is vulnerable to hard-coded credentials within its Linux distribution image, thus remote attackers c

ECOA BAS controller is vulnerable to insecure direct object references that occur when the application provides direct a

ECOA BAS controller is vulnerable to weak access control mechanism allowing authenticated user to remotely escalate priv

ECOA BAS controller uses weak set of default administrative credentials that can be easily guessed in remote password at

ECOA BAS controller has a Cross-Site Request Forgery vulnerability, thus authenticated attacker can remotely place a for

ECOA BAS controller suffers from a path traversal vulnerability, causing arbitrary files deletion. Using the specific GE

ECOA BAS controller suffers from a path traversal vulnerability, causing arbitrary files disclosure. Using the specific

ECOA BAS controller suffers from an authentication bypass vulnerability. An unauthenticated attacker through cookie pois

ECOA BAS controller suffers from a path traversal content disclosure vulnerability. Using the GET parameter in File Mana

ECOA BAS controller suffers from an arbitrary file write and path traversal vulnerability. Using the POST parameters, un

Apache DB DdlUtils 1.0 included a BinaryObjectsHelper that was intended for use when migrating database data with a SQL

In Shuup, versions 1.6.0 through 2.10.8 are vulnerable to reflected Cross-Site Scripting (XSS) that allows execution of

Zoho ManageEngine Remote Access Plus before 10.1.2121.1 relies on the application's build number to calculate a certain

Zoho ManageEngine Remote Access Plus before 10.1.2121.1 has hardcoded credentials associated with resetPWD.xml.

Zoho ManageEngine Remote Access Plus before 10.1.2121.1 has hardcoded credentials for read-only access. The credentials

Floodlight through 1.2 has poor input validation in checkFlow in StaticFlowEntryPusherResource.java because of unchecked

Floodlight through 1.2 has an integer overflow in checkFlow in StaticFlowEntryPusherResource.java via priority or port n

Floodlight through 1.2 has poor input validation in checkFlow in StaticFlowEntryPusherResource.java because of undefined

PlaceOS Authentication Service before 1.29.10.0 allows app/controllers/auth/sessions_controller.rb open redirect.

Craft CMS before 3.7.14 allows CSV injection.

Wazuh Manager in Wazuh through 4.1.5 is affected by a remote Integer Underflow vulnerability that might lead to denial o

A stored cross-site scripting (XSS) vulnerability in /ucms/index.php?do=list_edit of UCMS 1.4.7 allows attackers to exec

The build of some language stacks of Eclipse Che version 6 includes pulling some binaries from an unsecured HTTP endpoin

LaraCMS v1.0.1 contains a stored cross-site scripting (XSS) vulnerability which allows atackers to execute arbitrary web

LaraCMS v1.0.1 contains a stored cross-site scripting (XSS) vulnerability which allows attackers to execute arbitrary we

LaraCMS v1.0.1 transmits sensitive information in cleartext which can be intercepted by attackers.

The Safari app extension bundled with 1Password for Mac 7.7.0 through 7.8.x before 7.8.7 is vulnerable to authorization

A cross-site request forgery (CSRF) vulnerability exists in Streama up to and including v1.10.3. The application does no

A flaw was found in the KVM's AMD code for supporting SVM nested virtualization. The flaw occurs when processing the VMC

The Credova_Financial WordPress plugin discloses a site's associated Credova API account username and password in plaint

Couchbase Server 6.5.x, 6.6.0 through 6.6.2, and 7.0.0, has a Buffer Overflow. A specially crafted network packet sent f

Couchbase Server 6.5.x, 6.6.x through 6.6.2, and 7.0.0 has a Buffer Overflow. A specially crafted network packet sent fr

Couchbase Server 6.5.x and 6.6.x through 6.6.2 has Incorrect Access Control. Externally managed users are not prevented

When curl >= 7.20.0 and <= 7.78.0 connects to an IMAP or POP3 server to retrieve data using STARTTLS to upgrade to TLS s