2021

The Service Layer of SAP Business One, version - 10.0, allows an authenticated attacker to invoke certain functions that

DMIS Mobile Plug-In or SAP S/4HANA, versions - DMIS 2011_1_620, 2011_1_640, 2011_1_700, 2011_1_710, 2011_1_730, 710, 201

SAP Business One, version - 10.0, allows a local attacker with access to the victim's browser under certain circumstance

SAP Business One, version - 10.0, allows an attacker with business authorization to upload any files (including script f

Under certain conditions, SAP BusinessObjects Business Intelligence Platform (SAPUI5), versions - 420, 430, can allow an

SAP BusinessObjects Business Intelligence Platform (Crystal Report), versions - 420, 430, does not sufficiently encode u

Potentially, SAP Cloud Connector, version - 2.0 communication with the backend is accepted without sufficient validation

SAP Cloud Connector, version - 2.0, does not sufficiently encode user-controlled inputs, allowing an attacker with Admin

SAP Cloud Connector, version - 2.0, allows an authenticated administrator to modify a configuration file to inject malic

SAP Cloud Connector, version - 2.0, allows the upload of zip files as backup. This backup file can be tricked to inject

NWDI Notification Service versions - 7.31, 7.40, 7.50, does not sufficiently encode user-controlled inputs, resulting in

Server-Side Request Forgery (SSRF) vulnerability has been detected in the SAP NetWeaver Development Infrastructure Compo

A Stored XSS exists in TinyFileManager All version up to and including 2.4.6 in /tinyfilemanager.php when the server is

A Cross-Site Request Forgery (CSRF) vulnerability exists in TinyFileManager all version up to and including 2.4.6 that a

A Path Traversal vulnerability exists in TinyFileManager all version up to and including 2.4.6 that allows attackers to

Jitsi Meet is an open source video conferencing application. In versions prior to 2.0.5963, a Prosody module allows the

Jitsi Meet is an open source video conferencing application. Versions prior to 2.0.6173 are vulnerable to client-side cr

IBM Security Guardium 10.6 and 11.3 could allow a remote authenticated attacker to obtain sensitive information or modif

IBM QRadar SIEM 7.3 and 7.4 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt h

Multiple cross-site scripting (XSS) vulnerabilities exist in SITA Software Azur CMS 1.2.3.1 and earlier, which allows re

IBM Security Guardium 11.3 could allow a an authenticated user to obtain sensitive information that could be used in fur

A Cross Site Scriptiong (XSS) vulnerability exists in the admin panel in Webuzo < 2.9.0 via an HTTP request to a non-exi

A maliciously crafted DWG file in Autodesk Navisworks 2019, 2020, 2021, 2022 can be forced to write beyond allocated bou

A maliciously crafted DWG file in Autodesk Navisworks 2019, 2020, 2021, 2022 can be forced to read beyond allocated boun

semver-regex is vulnerable to Inefficient Regular Expression Complexity

The management tool in MyLittleBackup up to and including 1.7 allows remote attackers to execute arbitrary code because

GLPI is a free Asset and IT management software package. Starting in version 9.1 and prior to version 9.5.6, GLPI with A

GLPI is a free Asset and IT management software package. Starting in version 9.2 and prior to version 9.5.6, the telemet

GLPI is a free Asset and IT management software package. In versions prior to 9.5.6, the cookie used to store the autolo

The TechRadar app 1.1 for Confluence Server allows XSS via the Title field of a Radar.

A Memory Corruption vulnerability for PDF files in Autodesk Navisworks 2019, 2020, 2021, 2022 may lead to code execution

A maliciously crafted PDF file in Autodesk Navisworks 2019, 2020, 2021, 2022 can be forced to read beyond allocated boun

MetInfo 7.0.0 contains a SQL injection vulnerability via admin/?n=logs&c=index&a=dodel.

MetInfo 7.0.0 contains a Cross-Site Request Forgery (CSRF) via admin/?n=admin&c=index&a=doSaveInfo.

An arbitrary file creation vulnerability in UReport 2.2.9 allows attackers to execute arbitrary code.

UReport 2.2.9 allows attackers to execute arbitrary code due to a lack of access control to the designer page.

UReport v2.2.9 contains a Server-Side Request Forgery (SSRF) in the designer page which allows attackers to detect intra

Pligg CMS 2.0.2 contains a time-based SQL injection vulnerability via the $recordIDValue parameter in the admin_update_m

GLPI is a free Asset and IT management software package. In versions prior to 9.5.6, a user who is logged in to GLPI can

A user may be tricked into opening a malicious FBX file which may exploit an Untrusted Pointer Dereference vulnerability

A Out-Of-Bounds Read/Write Vulnerability in Autodesk FBX Review version 1.4.0 may lead to remote code execution through

Pimcore is an open source data & experience management platform. In versions prior to 10.1.3, it is possible to enumerat

In Nagios XI before 5.8.6, XSS exists in the dashboard page (/dashboards/#) when administrative users attempt to edit a

An exploitable return of stack variable address vulnerability exists in the JavaScript implementation of Nitro Pro PDF.

Cross Site Request Forgery (CSRF) in LaikeTui v3 allows remote attackers to execute arbitrary code via the component '/i

Cross Site Scripting (XSS) in S-CMS build 20191014 and earlier allows remote attackers to execute arbitrary code via the

Cross Site Scripting (CSS) in Wenku CMS v3.4 allows remote attackers to execute arbitrary code via the 'Intro' parameter

Cross Site Scripting (XSS) in Ari Adminer v1 allows remote attackers to execute arbitrary code via the 'Title' parameter

Improper Access Control in Jfinal CMS v4.7.1 and earlier allows remote attackers to obtain sensitive information and/or

Improper Access Control in Jfinal CMS v4.7.1 and earlier allows remote attackers to obtain sensitive information via the