2021

Cross-site Scripting (XSS) vulnerability in Stylemix Directory Listings WordPress plugin – uListing allows Reflected XSS

Authenticated Insecure Direct Object References (IDOR) vulnerability in WordPress uListing plugin (versions <= 2.0.5).

Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities in YITH Maintenance Mode (WordPress plugin) ver

Authenticated Stored Cross-Site Scripting (XSS) vulnerability in YITH Maintenance Mode (WordPress plugin) versions <= 1.

Adobe Creative Cloud Desktop Application version 5.4 (and earlier) is affected by a file handling vulnerability that cou

The MX Time Zone Clocks WordPress plugin before 3.4.1 does not escape the time_zone attribute of the mxmtzc_time_zone_cl

The CoolClock WordPress plugin before 4.3.5 does not escape some shortcode attributes, allowing users with a role as low

The Podlove Podcast Publisher WordPress plugin before 3.5.6 contains a 'Social & Donations' module (not activated by def

The PostX – Gutenberg Blocks for Post Grid WordPress plugin before 2.4.10, with Saved Templates Addon enabled, allows us

The PostX – Gutenberg Blocks for Post Grid WordPress plugin before 2.4.10, with Saved Templates Addon enabled, allows us

The PostX – Gutenberg Blocks for Post Grid WordPress plugin before 2.4.10 allows users with a role as low as Contributor

The PostX – Gutenberg Blocks for Post Grid WordPress plugin before 2.4.10 performs incorrect checks before allowing any

The WP Map Block WordPress plugin before 1.2.3 does not escape some attributes of the WP Map Block, which could allow us

The Recipe Card Blocks by WPZOOM WordPress plugin before 2.8.3 does not properly sanitise or escape some of the properti

The Countdown Block WordPress plugin before 1.1.2 does not have authorisation in the eb_write_block_css AJAX action, whi

The Recipe Card Blocks by WPZOOM WordPress plugin before 2.8.1 does not escape the message parameter before outputting i

The TranslatePress WordPress plugin before 2.0.9 does not implement a proper sanitisation on the translated strings. The

The Cookie Notice & Compliance for GDPR / CCPA WordPress plugin before 2.1.2 does not escape the value of its Button Tex

Zoho ManageEngine ADManager Plus before 7111 is vulnerable to unrestricted file which leads to Remote code execution.

Cross-Site Request Forgery (CSRF) vulnerability in WordPress uListing plugin (versions <= 2.0.5) makes it possible for a

A potential DOM-based Cross Site Scripting security vulnerability has been identified in HPE StoreOnce. The vulnerabilit

Certain Federal Office of Information Technology Systems and Telecommunication FOITT products are affected by improper h

An issue was discovered in SKALE sgxwallet 1.58.3. The provided input for ECALL 14 triggers a branch in trustedEcdsaSign

An issue was discovered in SKALE sgxwallet 1.58.3. sgx_disp_ippsAES_GCMEncrypt allows an out-of-bounds write, resulting

The network address administrative settings web portal for the Zoom on-premise Meeting Connector before version 4.6.360.

The Zone Controller service in the Zoom On-Premise Meeting Connector Controller before version 4.6.358.20210205 does not

The network proxy page on the web portal for the Zoom on-premise Meeting Connector Controller before version 4.6.348.202

All versions of the Zoom Plugin for Microsoft Outlook for MacOS before 5.3.52553.0918 contain a Time-of-check Time-of-us

During the installation process for all versions of the Zoom Client for Meetings for Windows before 5.4.0, it is possibl

During the installation process forZoom Rooms for Conference Room for Windows before version 5.3.0 it is possible to lau

A user-writable application bundle unpacked during the install for all versions of the Zoom Plugin for Microsoft Outlook

It was discovered that the installation packages of the Zoom Client for Meetings for MacOS (Standard and for IT Admin) i

The Zoom Client for Meetings for Windows in all versions before version 5.3.2 writes log files to a user writable direct

The Zoom Client for Meetings for Windows in all versions before 5.3.0 fails to properly validate the certificate informa

The vulnerability origins in the commissioning process where an attacker of the ControlTouch can enter a serial number i

A SSRF issue was discovered in Concrete CMS through 8.5.5. Users can access forbidden files on their local network. A us

An issue was discovered in Concrete CMS through 8.5.5. The Calendar is vulnerable to CSRF. ccm_token is not verified on

nltk is vulnerable to Inefficient Regular Expression Complexity

jsoneditor is vulnerable to Inefficient Regular Expression Complexity

inflect is vulnerable to Inefficient Regular Expression Complexity

firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)

grav is vulnerable to Reliance on Cookies without Validation and Integrity Checking

grav-plugin-admin is vulnerable to Improper Restriction of Rendered UI Layers or Frames

In Oppo's battery application, the third-party SDK provides the function of loading a third-party Provider, which can be

An issue was discovered in Concrete CMS through 8.5.5. There is unauthenticated stored XSS in blog comments via the webs

An issue was discovered in Concrete CMS through 8.5.5. There is XSS via Markdown Comments.

An issue was discovered in Concrete CMS through 8.5.5. There is an SVG sanitizer bypass.

An issue was discovered in Concrete CMS through 8.5.5. Path Traversal can lead to Arbitrary File Reading and SSRF.

An issue was discovered in Concrete CMS through 8.5.5. Path Traversal leading to RCE via external form by adding a regul

An issue was discovered in Concrete CMS through 8.5.5. Authenticated path traversal leads to to remote code execution vi