2021

A vulnerability in the packet processing functionality of Cisco Embedded Wireless Controller (EWC) Software for Catalyst

A vulnerability in the Cisco IOS XE SD-WAN Software CLI could allow an authenticated, local attacker to overwrite arbitr

A vulnerability in Ethernet over GRE (EoGRE) packet processing of Cisco IOS XE Wireless Controller Software for the Cisc

A vulnerability in the disaster recovery feature of Cisco SD-WAN vManage Software could allow an authenticated, remote a

Multiple vulnerabilities in the Control and Provisioning of Wireless Access Points (CAPWAP) protocol processing of Cisco

A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to access sensitive inf

A vulnerability in the SSH management feature of multiple Cisco Access Points (APs) platforms could allow a local, authe

CMS Made Simple 2.2.14 was discovered to contain a cross-site scripting (XSS) vulnerability which allows attackers to ex

Leo Editor v6.2.1 was discovered to contain a regular expression denial of service (ReDoS) vulnerability in the componen

gmate v0.12+bionic contains a regular expression denial of service (ReDoS) vulnerability in the gedit3 plugin.

The vCenter Server contains a denial-of-service vulnerability due to improper XML entity parsing. A malicious actor with

The vCenter Server contains a local privilege escalation vulnerability due to the way it handles session tokens. A malic

The Ninja Forms WordPress plugin is vulnerable to arbitrary email sending via the trigger_email_action function found in

The Ninja Forms WordPress plugin is vulnerable to sensitive information disclosure via the bulk_export_submissions funct

Talend ESB Runtime in all versions from 5.1 to 7.3.1-R2021-09, 7.2.1-R2021-09, 7.1.1-R2021-09, has an unauthenticated Jo

Mattermost 5.38 and earlier fails to sufficiently sanitize clipboard contents, which allows a user-assisted attacker to

Edgecore ECS2020 Firmware 1.0.0.0 devices allow Unauthenticated Command Injection via the command1 HTTP header to the /E

LINE client for iOS before 11.15.0 might expose authentication information for a certain service to external entities un

Improper Access Control in Gurock TestRail versions < 7.2.0.3014 resulted in sensitive information exposure. A threat ac

Zoho ManageEngine ADManager Plus version 7110 and prior allows account takeover via SSO.

Zoho ManageEngine ADManager Plus version 7110 and prior has a Post-Auth OS command injection vulnerability.

Improper access control vulnerability in the repair process for McAfee Agent for Windows prior to 5.7.4 could allow a lo

A DLL sideloading vulnerability in McAfee Agent for Windows prior to 5.7.4 could allow a local user to perform a DLL sid

Improper privilege management vulnerability in maconfig for McAfee Agent for Windows prior to 5.7.4 allows a local user

MaianAffiliate v1.0 allows an authenticated administrative user to save an XSS to the database.

A command injection vulnerability in the web server of some Hikvision product. Due to the insufficient input validation,

A flaw was found in Ansible, where a user's controller is vulnerable to template injection. This issue can occur through

The Telefication WordPress plugin is vulnerable to Open Proxy and Server-Side Request Forgery via the ~/bypass.php file

Some components in Apache Kafka use `Arrays.equals` to validate a password or key, which is vulnerable to timing attacks

In the Amazon AWS WorkSpaces client 3.0.10 through 3.1.8 on Windows, argument injection in the workspaces:// URI handler

In Halibut versions prior to 4.4.7 there is a deserialisation vulnerability that could allow remote code execution on sy

Plastic SCM before 10.0.16.5622 mishandles the WebAdmin server management interface.

Heap-buffer overflow in the randomize_iparp function in edit_packet.c. of Tcpreplay v4.3.2 allows attackers to cause a d

An issue was discovered in gpac 0.8.0. The stbl_GetSampleSize function in isomedia/stbl_read.c has a heap-based buffer o

An issue was discovered in gpac 0.8.0. The gf_hinter_track_process function in isom_hinter_track_process.c has a heap-ba

An issue was discovered in gpac 0.8.0. The OD_ReadUTF8String function in odf_code.c has a heap-based buffer overflow whi

in-toto-golang is a go implementation of the in-toto framework to protect software supply chain integrity. In affected v

jsuites is an open source collection of common required javascript web components. In affected versions users are subjec

Cross Site Scripting (XSS) vulnerability exists in ManageEngine OPManager <=12.5.174 when the API key contains an XML-ba

Cross Site Scripting (XSS) vlnerability exists in WUZHI CMS up to and including 4.1.0 in the config function in corefram

Blacklist bypass issue exists in WUZHI CMS up to and including 4.1.0 in common.func.php, which when uploaded can cause r

http4s is an open source scala interface for HTTP. In affected versions http4s is vulnerable to response-splitting or re

The update process of the Circle Parental Control Service on various NETGEAR routers allows remote attackers to achieve

In Cloudron 6.2, the returnTo parameter on the login page is vulnerable to Reflected XSS.

Butter is a system usability utility. Due to a kernel error the JPNS kernel is being discontinued. Affected users are re

This affects the package jointjs before 3.4.2. A type confusion vulnerability can lead to a bypass of CVE-2020-28480 whe

This affects the package edge.js before 5.3.2. A type confusion vulnerability can be used to bypass input sanitization w

IBM Jazz for Service Management 1.1.3.10 and IBM Tivoli Netcool/OMNIbus_GUI is vulnerable to an XML External Entity Inje

IBM PowerVM Hypervisor FW860, FW930, FW940, and FW950 could allow a local user to create a specially crafted sequence of

An issue related to modification of otherwise restricted files through a locally authenticated attacker exists in FlexNe