2021

An account takeover flaw was found in Red Hat Satellite 6.7.2 onward. A potential attacker with proper authentication to

A vulnerability was found in RESTEasy, where RootNode incorrectly caches routes. This issue results in hash flooding, le

A flaw was found in Infinispan version 10, where it is possible to perform various actions that could have side effects

Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in file management componen

Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in PHP component in S

Nextcloud Server is a Nextcloud package that handles data storage. A vulnerability in federated share exists in versions

Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.11, 20.0.10, and 21.0.2, an

A vulnerability was discovered in the indexOf function of JSONParserByteArray in JSON Smart versions 1.3 and 2.4 which c

An OS command injection vulnerability in FortiWeb's management interface 6.3.7 and below, 6.2.3 and below, 6.1.x, 6.0.x,

Nextcloud Mail is a mail app for the Nextcloud platform. A missing permission check in Nextcloud Mail before 1.4.3 and 1

A heap-based Buffer Overflow vulnerability exists in FFmpeg 4.2 in filter_intra at libavfilter/vf_bwdif.c, which might l

A heap-based Buffer Overflow vulnerability exists in FFmpeg 4.2 in get_block_row at libavfilter/vf_bm3d.c, which might l

Invision Community (aka IPS Community Suite) before 4.6.0 allows eval-based PHP code injection by a moderator because th

A vulnerability has been discovered in BigTree CMS 4.4.10 and earlier which allows an authenticated attacker to execute

A SQL injection vulnerability was discovered in /core/feeds/custom.php in BigTree CMS 4.4.10 and earlier which allows an

Libjpeg-turbo all version have a stack-based buffer overflow in the "transform" component. A remote attacker can send a

There's a flaw in libxml2's xmllint in versions before 2.9.11. An attacker who is able to submit a crafted file to be pr

An incorrect access control flaw was found in the kiali-operator in versions before 1.33.0 and before 1.24.7. This flaw

It was found that all versions of 3Scale developer portal lacked brute force protections. An attacker could use this gap

Server-Side request forgery (SSRF) vulnerability in task management component in Synology Download Station before 3.8.15

Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability container volume management

Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in cgi component in S

Emissary is a P2P based data-driven workflow engine. Affected versions of Emissary are vulnerable to post-authentication

A flaw was found in postgresql in versions before 13.3, before 12.7, before 11.12, before 10.17 and before 9.6.22. While

IBM Spectrum Scale 5.0.0 through 5.0.5.6 and 5.1.0 through 5.1.0.3 system core component is affected by a format string

IBM Security Verify Access 20.07 is vulnerable to a stack based buffer overflow, caused by improper bounds checking whic

Unrestricted upload of file with dangerous type vulnerability in file management component in Synology Photo Station bef

Improper limitation of a pathname to a restricted directory ('Path Traversal') in cgi component in Synology DiskStation

The parameters $cache_path, $wp_cache_debug_ip, $wp_super_cache_front_page_text, $cache_scheduled_time, $cached_direct_p

The wp_ajax_upload-remote-file AJAX action of the External Media WordPress plugin before 1.0.34 was vulnerable to arbitr

IBM Security Verify Access 20.07 could allow a remote attacker to send a specially crafted HTTP GET request that could c

IBM Cognos Analytics 11.0 and 11.1 could allow a remote attacker to inject malicious HTML code that when viewed by the a

IBM Cognos Analytics 11.0 and 11.1 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML da

A regular expression denial of service (ReDoS) vulnerability in the validateBaseUrl function can cause the application t

IBM Cognos Analytics 11.0 and 11.1 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML da

IBM Cognos Analytics 11.0 and 11.1 could allow a remote attacker to obtain credentials from a user's browser via incorre

IBM Cognos Analytics 11.0 and 11.1 could allow a remote attacker to obtain credentials from a user's browser via incorre

The NGINX Controller 2.0.0 thru 2.9.0 and 3.x before 3.15.0 Administrator password may be exposed in the systemd.txt fil

A security issue in nginx resolver was identified, which might allow an attacker who is able to forge UDP packets from t

Intra-cluster communication does not use TLS. The services within the NGINX Controller 3.x before 3.4.0 namespace are us

Frontier ichris through 5.18 mishandles making a DNS request for the hostname in the HTTP Host header, as demonstrated b

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions pri

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions pri

1CDN is open-source file sharing software. In 1CDN before commit f88a2730fa50fc2c2aeab09011f6f142fd90ec25, there is a ba

XStream is software for serializing Java objects to XML and back again. A vulnerability in XStream versions prior to 1.4

Envoy is a cloud-native edge/middle/service proxy. Envoy does not decode escaped slash sequences `%2F` and `%5C` in HTTP

A NULL-pointer deference issue was discovered in GNU_gama::set() in ellipsoid.h in Gama 2.04 which can lead to a denial

The css-what package 4.0.0 through 5.0.0 for Node.js does not ensure that attribute parsing has Linear Time Complexity r

A Cross Site Request Forgery (CSRF) vulnerability was discovered in iCMS 7.0.16 which can allow an attacker to execute a

A flaw was found in openstack-neutron's default Open vSwitch firewall rules. By sending carefully crafted packets, anyon