2021

A reflected cross-site scripting vulnerability exists in the url parameter of the /cgi-bin/luci/site_access/ page on the

An attacker could prematurely expire a verification code, making it unusable by the patient, making the patient unable t

A improper authentication in Fortinet FortiAuthenticator version 6.4.0 allows user to bypass the second factor of authen

A violation of secure design principles in Fortinet Meru AP version 8.6.1 and below, version 8.5.5 and below allows atta

An improper authorization vulnerabiltiy [CWE-285] in FortiClient Windows versions 7.0.0 and 6.4.6 and below and 6.2.8 an

Apache Airavata Django Portal allows CRLF log injection because of lack of escaping log statements. In particular, some

A improper control of a resource through its lifetime in Fortinet FortiClientWindows version 6.4.1 and 6.4.0, version 6.

A missing encryption of sensitive data in Fortinet FortiClientEMS version 7.0.1 and below, version 6.4.4 and below allow

It was possible to recreate previous cursor spoofing attacks against users with a zoomed native cursor. This vulnerabili

Using the Location API in a loop could have caused severe application hangs and crashes. This vulnerability affects Thun

When receiving a URL through a SEND intent, Firefox would have searched for the text, but subsequent usages of the addre

Documents loaded with the CSP sandbox directive could have escaped the sandbox's script restriction by embedding additio

Using XMLHttpRequest, an attacker could have identified installed applications by probing error messages for loading ext

When invoking protocol handlers for external protocols, a supplied parameter URL containing spaces was not properly esca

WebExtensions with the correct permissions were able to create and install ServiceWorkers for third-party websites that

By misusing a race in our notification code, an attacker could have forcefully hidden the notification for pages that ha

Under certain circumstances, asynchronous functions could have caused a navigation to fail but expose the target URL. Th

When parsing internationalized domain names, high bits of the characters in the URLs were sometimes stripped, resulting

The 'Copy Image Link' context menu action would copy the final image URL after redirects. By embedding an image that tri

When a user loaded a Web Extensions context menu, the Web Extension could access the post-redirect URL of the element cl

A Universal XSS vulnerability was present in Firefox for Android resulting from improper sanitization when processing a

Thunderbird unexpectedly enabled JavaScript in the composition area. The JavaScript execution context was limited to thi

Due to an unusual sequence of attacker-controlled events, a Javascript alert() dialog with arbitrary (although unstyled)

By displaying a form validity message in the correct location at the same time as a permission prompt (such as for geolo

The Opportunistic Encryption feature of HTTP2 (RFC 8164) allows a connection to be transparently upgraded to TLS while r

Through a series of navigations, Firefox could have entered fullscreen mode without notification or warning to the user.

Microsoft introduced a new feature in Windows 10 known as Cloud Clipboard which, if enabled, will record data copied to

By executing a special command, an user with administrative rights can get access to extended debug functionality on the

An error in a page handler of the VRM may lead to a reflected cross site scripting (XSS) in the web-based interface. To

PineApp - Mail Secure - Attacker sending a request to :/blocking.php?url=<script>alert(1)</script> and stealing cookies

SYNEL - eharmonynew / Synel Reports - The attacker can log in to the system with default credentials and export a report

`Bundler` is a package for managing application dependencies in Ruby. In `bundler` versions before 2.2.33, when working

Multiple command injection vulnerabilities in the command line interpreter of FortiWeb versions 6.4.1, 6.4.0, 6.3.0 thro

An authentication bypass by capture-replay vulnerability [CWE-294] in FortiClient EMS versions 7.0.1 and below and 6.4.4

Grafana Agent is a telemetry collector for sending metrics, logs, and trace data to the opinionated Grafana observabilit

An improper access control vulnerability [CWE-284] in FortiWeb versions 6.4.1 and below and 6.3.15 and below in the Repo

A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiWeb version 6.4.

There is a Improper Access Control vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may

There is an Input verification vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may caus

Intent redirection vulnerability in Samsung Blockchain Wallet prior to version 1.3.02.8 allows attacker to execute privi

Insecure storage of device information in Contacts prior to version 12.7.05.24 allows attacker to get Samsung Account ID

Insecure storage of device information in Samsung Dialer prior to version 12.7.05.24 allows attacker to get Samsung Acco

Insecure storage of sensitive information vulnerability in Smart Capture prior to version 4.8.02.10 allows attacker to a

Insecure caller check in sharevia deeplink logic prior to Samsung Internet 16.0.2 allows unstrusted applications to get

Insecure caller check and input validation vulnerabilities in SearchKeyword deeplink logic prior to Samsung Internet 16.

An improper access control vulnerability in CPLC prior to SMR Dec-2021 Release 1 allows local attackers to access CPLC i

An improper boundary check in secure_log of LDFW and BL31 prior to SMR Dec-2021 Release 1 allows arbitrary memory write

An improper check or handling of exceptional conditions in Exynos baseband prior to SMR Dec-2021 Release 1 allows attack

An improper usage of implicit intent in SemRewardManager prior to SMR Dec-2021 Release 1 allows attackers to access BSSI

An improper validation vulnerability in telephony prior to SMR Dec-2021 Release 1 allows attackers to launch certain act