2021

Inappropriate implementation in Network in Google Chrome prior to 90.0.4430.72 allowed a remote attacker to potentially

Inappropriate implementation in storage in Google Chrome prior to 90.0.4430.72 allowed a remote attacker to leak cross-o

Insufficient data validation in QR scanner in Google Chrome on iOS prior to 90.0.4430.72 allowed an attacker displaying

IBM Spectrum Protect Client 8.1.0.0 through 8.1.11.0 is vulnerable to a stack-based buffer overflow, caused by improper

IBM Spectrum Protect Plus File Systems Agent 10.1.6 and 10.1.7 stores potentially sensitive information in log files tha

IBM Spectrum Protect Plus 10.1.0 through 10.1.7 uses Cross-Origin Resource Sharing (CORS) which could allow an attacker

IBM Planning Analytics 2.0 could allow a remote attacker to obtain sensitive information by allowing cross-window commun

A security vulnerability that can lead to local privilege escalation has been found in ’guix-daemon’. It affects multi-u

The package postcss before 8.2.13 are vulnerable to Regular Expression Denial of Service (ReDoS) via getAnnotationURL()

A smart proxy that provides a restful API to various sub-systems of the Foreman is affected by the flaw which can cause

OrangeHRM 4.7 allows an unauthenticated user to enumerate the valid username and email address via the forgot password f

The Import function in MintHCM RELEASE 3.0.8 allows an attacker to execute a cross-site scripting (XSS) payload in file-

Jamovi <=1.6.18 is affected by a cross-site scripting (XSS) vulnerability. The column-name is vulnerable to XSS in the E

The package github.com/tyktechnologies/tyk-identity-broker before 1.1.1 are vulnerable to Authentication Bypass via the

LeoCAD before 21.03 sometimes allows a use-after-free during the opening of a new document.

cPanel before 94.0.3 allows self-XSS via EasyApache 4 Save Profile (SEC-581).

Improper access control vulnerability in NEC Aterm WG2600HS firmware Ver1.5.1 and earlier, and Aterm WX3000HP firmware V

Cross-site scripting vulnerability in Aterm WG2600HS firmware Ver1.5.1 and earlier allows remote attackers to inject an

Cross-site scripting vulnerability in NEC Aterm devices (Aterm WG1900HP2 firmware Ver.1.3.1 and earlier, Aterm WG1900HP

react-draft-wysiwyg (aka React Draft Wysiwyg) before 1.14.6 allows a javascript: URi in a Link Target of the link decora

Settings.aspx?view=About in Directum 5.8.2 allows XSS via the HTTP User-Agent header.

Sipwise C5 NGCP WWW Admin version 3.6.7 up to and including platform version NGCP CE 3.0 has multiple authenticated stor

Sonatype Nexus Repository Manager 3 Pro up to and including 3.30.0 has Incorrect Access Control.

Cross Site Scripting (XSS) in dotCMS v5.1.5 allows remote attackers to execute arbitrary code by injecting a malicious p

Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image file

Node-redis is a Node.js Redis client. Before version 3.1.1, when a client is in monitoring mode, the regex begin used to

Excessive memory consumption in MS-WSP dissector in Wireshark 3.4.0 to 3.4.4 and 3.2.0 to 3.2.12 allows denial of servic

Improper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code exec

Wowza Streaming Engine before 4.8.8.01 (in a default installation) has cleartext passwords stored in the conf/admin.pass

Authentication.logout() helper in com.vaadin:flow-client versions 5.0.0 prior to 6.0.0 (Vaadin 18), and 6.0.0 through 6.

Non-constant-time comparison of CSRF tokens in endpoint request handler in com.vaadin:flow-server versions 3.0.0 through

Non-constant-time comparison of CSRF tokens in UIDL request handler in com.vaadin:flow-server versions 1.0.0 through 1.0

Non-constant-time comparison of CSRF tokens in UIDL request handler in com.vaadin:vaadin-server versions 7.0.0 through 7

Improper URL validation in development mode handler in com.vaadin:flow-server versions 2.0.0 through 2.4.1 (Vaadin 14.0.

Missing variable sanitization in Grid component in com.vaadin:vaadin-server versions 7.4.0 through 7.7.19 (Vaadin 7.4.0

Missing output sanitization in default RouteNotFoundError view in com.vaadin:flow-server versions 1.0.0 through 1.0.10 (

An improper authorization of using debugging command in Secure Folder prior to SMR Oct-2020 Release 1 allows unauthorize

Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Web Listener). Supported version

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that

Vulnerability in the Oracle Hospitality Inventory Management product of Oracle Food and Beverage Applications (component

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Packaging). Supported versions that are af

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affected

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Stored Procedure). Supported versions that

Vulnerability in the OSS Support Tools product of Oracle Support Tools (component: Diagnostic Assistant). The supported

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affected

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are af

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are af

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that