2021

A remote code execution (RCE) vulnerability in the component /codebase/dir.php?type=filenew of Mara v7.5 allows attacker

There is a Memory out-of-bounds access vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability

There is a vulnerability of tampering with the kernel in Huawei Smartphone.Successful exploitation of this vulnerability

There is a Kernel crash vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may escalate pe

There is a vulnerability of tampering with the kernel in Huawei Smartphone.Successful exploitation of this vulnerability

There is an Out-of-bounds memory access in Huawei Smartphone.Successful exploitation of this vulnerability may cause pro

There is a Logic Bypass vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may affect serv

There is a vulnerability of hijacking unverified providers in Huawei Smartphone.Successful exploitation of this vulnerab

Zoom Call Recording 6.3.1 from Eleveo is vulnerable to Java Deserialization attacks targeting the inbuilt RMI service. A

CSZ CMS v1.2.4 was discovered to contain an arbitrary file upload vulnerability in the component /core/MY_Security.php.

In Gradle Enterprise before 2021.3 (and Enterprise Build Cache Node before 10.0), there is potential cache poisoning and

An SQL Injection vulnerability exists in Sourcecodester Complaint Management System 1.0 via the cid parameter in complai

The affected controllers do not properly sanitize the input containing code syntax. As a result, an attacker could craft

PolarSSL versions prior to v1.1 use the HAVEGE random number generation algorithm. At its heart, this uses timing inform

A untrusted search path issue was found in Calibre at devices/linux_mount_helper.c leading to the ability of unprivilege

Input validation issues were found in Calibre at devices/linux_mount_helper.c which can lead to argument injection and e

Online Student Admission System 1.0 is affected by an unauthenticated SQL injection bypass vulnerability in /admin/login

caml-light <= 0.75 uses mktemp() insecurely, and also does unsafe things in /tmp during make install.

A flaw was found in WebSVN 2.3.2. Without prior authentication, if the 'allowDownload' option is enabled in config.php,

Penguin Aurora TV Box 41502 is a high-end network HD set-top box produced by Tencent Video and Skyworth Digital. An unau

An issue was discovered in the Dask distributed package before 2021.10.0 for Python. Single machine Dask clusters starte

Crafted web server requests can be utilised to read partial stack or heap memory or may trigger a denial-of- service con

Movable Type 7 r.5002 and earlier (Movable Type 7 Series), Movable Type 6.8.2 and earlier (Movable Type 6 Series), Movab

In Eclipse Openj9 before version 0.29.0, the JVM does not throw IllegalAccessError for MethodHandles that invoke inacces

The Formidable Form Builder WordPress plugin before 4.09.05 allows to inject certain HTML Tags like <audio>,<video>,<img

An Unsafe Deserialization vulnerability exists in the worker services of the Apache Storm supervisor server allowing pre

A Command Injection vulnerability exists in the getTopologyHistory service of the Apache Storm 2.x prior to 2.2.1 and Ap

Gridpro Request Management for Windows Azure Pack before 2.0.7912 allows Directory Traversal for remote code execution,

BQE BillQuick Web Suite 2018 through 2021 before 22.0.9.1 allows SQL injection for unauthenticated remote code execution

Chichen Tech CMS v1.0 was discovered to contain multiple SQL injection vulnerabilities in the file product_list.php via

Portable Ltd Playable v9.18 contains a code injection vulnerability in the filename parameter, which allows attackers to

The Simple Payroll System with Dynamic Tax Bracket in PHP using SQLite Free Source Code (by: oretnom23 ) is vulnerable f

ShowDoc 2.8.3 ihas a file upload vulnerability, where attackers can use the vulnerability to obtain server permissions.

All versions of yongyou PLM are affected by a command injection issue. UFIDA PLM (Product Life Cycle Management) is a st

There are multiple API function codes that permit reading and writing data to or from files and directories, which could

There are multiple API function codes that permit data writing to any file, which may allow an attacker to modify existi

Many of the services used by the affected product do not specify full paths for the DLLs they are loading. An attacker c

The server permits communication without any authentication procedure, allowing the attacker to initiate a session with

Some API functions allow interaction with the registry, which includes reading values as well as data modification.

Some API functions permit by-design writing or copying data into a given buffer. Since the client controls these paramet

An issue was discovered in OpenPOWER 2.6 firmware. unpack_timestamp() calls le32_to_cpu() for endian conversion of a uin

Adobe Connect version 11.2.3 (and earlier) is affected by a Deserialization of Untrusted Data vulnerability to achieve a

The CivetWeb web library does not validate uploaded filepaths when running on an OS other than Windows, when using the b

The shell-quote package before 1.7.3 for Node.js allows command injection. An attacker can inject unescaped shell metach

Discourse is an open source platform for community discussion. In affected versions maliciously crafted requests could l

The Proof-of-Stake (PoS) Ethereum consensus protocol through 2021-10-19 allows an adversary to cause a denial of service

The Proof-of-Stake (PoS) Ethereum consensus protocol through 2021-10-19 allows an adversary to cause a denial of service

ZTE MF971R product has two stack-based buffer overflow vulnerabilities. An attacker could exploit the vulnerabilities to

ZTE MF971R product has two stack-based buffer overflow vulnerabilities. An attacker could exploit the vulnerabilities to

Vulnerability in the Essbase Administration Services product of Oracle Essbase (component: EAS Console). The supported v