2021

fig2dev 3.2.7b contains a segmentation fault in the gencgm_start function in gencgm.c.

fig2dev 3.2.7b contains a global buffer overflow in the get_line function in read.c.

fig2dev 3.2.7b contains a stack buffer overflow in the read_textobject function in read.c.

fig2dev 3.2.7b contains a global buffer overflow in the setfigfont function in genepic.c.

fig2dev 3.2.7b contains a global buffer overflow in the conv_pattern_index function in gencgm.c.

fig2dev 3.2.7b contains a segmentation fault in the read_objects function in read.c.

fig2dev 3.2.7b contains a stack buffer overflow in the bezier_spline function in genepic.c.

SQL Injection vulnerability exists in Wuzhi CMS 4.1.0 via the keywords iparameter under the /coreframe/app/order/admin/c

SQL Injection vulnerability exists in Wuzhi CMS 4.1.0 via the keywords parameter under the coreframe/app/promote/admin/i

IBM WebSphere Application Server 7.0, 8.0, 8.5, 9.0 and Liberty 17.0.0.3 through 21.0.0.9 could allow a remote user to e

IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) could disclose sensitive information when using ADMIN_

IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.1 and 11.5 under very specific conditions, could al

IBM Db2 11.2 and 11.5 contains an information disclosure vulnerability, exposing remote storage credentials to privilege

Apache Tomcat 8.5.0 to 8.5.63, 9.0.0-M1 to 9.0.43 and 10.0.0-M1 to 10.0.2 did not properly validate incoming TLS packets

A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. Th

ap_escape_quotes() may write beyond the end of a buffer when given malicious input. No included modules pass untrusted d

A vulnerability in XML processing in Apache Jena, in versions up to 4.1.0, may allow an attacker to execute XML External

mitmproxy is an interactive, SSL/TLS-capable intercepting proxy. In mitmproxy 7.0.2 and below, a malicious client or ser

SharpCompress is a fully managed C# library to deal with many compression types and formats. Versions prior to 0.29.0 ar

A carefully crafted request uri-path can cause mod_proxy_uwsgi to read above the allocated memory and crash (DoS). This

Malformed requests may cause the server to dereference a NULL pointer. This issue affects Apache HTTP Server 2.4.48 and

OpenSIS Community Edition version <= 7.6 is affected by a local file inclusion vulnerability in DownloadWindow.php via t

OpenSIS Community Edition version <= 7.6 is affected by a reflected XSS vulnerability in EmailCheck.php via the "opt" pa

In Kaden PICOFLUX Air in all known versions an information exposure through observable discrepancy exists. This may give

In Enbra EWM in Version 1.7.29 together with several tested wireless M-Bus Sensors the events backflow and "no flow" are

Enbra EWM 1.7.29 does not check for or detect replay attacks sent by wireless M-Bus Security mode 5 devices. Instead tim

Multiple Wireless M-Bus devices by Enbra use Hard-coded Credentials in Security mode 5 without an option to change the e

There is a buffer overflow in librsa.so called by getwifipwdurl interface, resulting in code execution on Xiaomi router

There is command injection in the addMeshNode interface of xqnetwork.lua, which leads to command execution under adminis

The access controls on the Mobility read-write API improperly validate user access permissions; this API is disabled by

The access controls on the Mobility read-only API improperly validate user access permissions. Attackers with both netwo

Some js interfaces in the Xiaomi community were exposed, causing sensitive functions to be maliciously called on Xiaomi

There is command injection in the meshd program in the routing system, resulting in command execution under administrato

Affected versions of Atlassian Jira Server or Data Center using the Jira Service Management addon allow remote attackers

An issue in the BAT file parameters of PublicCMS v4.0 allows attackers to execute arbitrary code.

Improper access control in Jfinal CMS 5.1.0 allows attackers to access sensitive information via /classes/conf/db.proper

The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can by

The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can by

An arbitrary file upload vulnerability in Jizhicms v1.5 allows attackers to execute arbitrary code via a crafted .jpg fi

A cross-site scripting (XSS) vulnerability in RGCMS v1.06 allows attackers to obtain the administrator's cookie via a cr

An arbitrary file upload vulnerability in RGCMS v1.06 allows attackers to execute arbitrary code via a crafted .txt file

An arbitrary file write vulnerability in RGCMS v1.06 allows attackers to execute arbitrary code via a crafted PHP file.

An arbitrary file upload vulnerability in Feehi CMS v2.0.8 and below allows attackers to execute arbitrary code via a cr

emlog v6.0 contains a Cross-Site Request Forgery (CSRF) via /admin/link.php?action=addlink, which allows attackers to ar

OpenSSH through 8.7 allows remote attackers, who have a suspicion that a certain combination of username and public key

HashiCorp Terraform Enterprise up to v202108-1 contained an API endpoint that erroneously disclosed a sensitive URL to a

The HGiga OAKlouds mobile portal does not filter special characters of the IPv6 Gateway parameter of the network interfa

The HGiga OAKlouds mobile portal does not filter special characters of the Ethernet number parameter of the network inte

WriteRegistry function in TSSServiSign component does not filter and verify users’ input, remote attackers can rewrite t

The SAP NetWeaver Portal, versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, component Iviews Editor contains a Server