2021

An attacker can place a crafted JSON config file into the project folder pointing to a custom executable. VScode-bazel a

Broken Authentication in Atlassian Connect Express (ACE) from version 3.0.2 before version 6.6.0: Atlassian Connect Expr

Wordpress is an open source CMS. A user with the ability to upload files (like an Author) can exploit an XML parsing iss

Sydent is a reference Matrix identity server. Sydent can be induced to send HTTP GET requests to internal systems, due t

Sydent is a reference Matrix identity server. Sydent does not limit the size of requests it receives from HTTP clients.

The project received a report that all versions of Apache OpenOffice through 4.1.8 can open non-http(s) hyperlinks. The

The dio package 4.0.0 for Dart allows CRLF injection if the attacker controls the HTTP method string, a different vulner

Pi-hole is a Linux network-level advertisement and Internet tracker blocking application. The Stored XSS exists in the P

An authentication flaw was found in ceph in versions before 14.2.20. When the monitor handles CEPHX_GET_AUTH_SESSION_KEY

Adobe Photoshop versions 21.2.6 (and earlier) and 22.3 (and earlier) are affected by a Buffer Overflow vulnerability whe

Adobe Photoshop versions 21.2.6 (and earlier) and 22.3 (and earlier) are affected by a Buffer Overflow vulnerability whe

SQL Injection in the "evoadm.php" component of b2evolution v7.2.2-stable allows remote attackers to obtain sensitive dat

Adobe Digital Editions version 4.5.11.187245 (and earlier) is affected by a Privilege Escalation vulnerability during in

Adobe Bridge versions 10.1.1 (and earlier) and 11.0.1 (and earlier) are affected by an Out-of-bounds write vulnerability

Adobe Bridge versions 10.1.1 (and earlier) and 11.0.1 (and earlier) are affected by an Out-of-bounds write vulnerability

Adobe Bridge versions 10.1.1 (and earlier) and 11.0.1 (and earlier) are affected by a memory corruption vulnerability wh

Adobe Bridge versions 10.1.1 (and earlier) and 11.0.1 (and earlier) are affected by a memory corruption vulnerability wh

A unauthenticated backdoor exists in the configuration server functionality of Cosori Smart 5.8-Quart Air Fryer CS158-AF

Privilege Escalation vulnerability in McAfee Data Loss Prevention (DLP) Endpoint for Windows prior to 11.6.100 allows a

An issue was discovered in MDaemon before 20.0.4. Administrators can use Remote Administration to exploit an Arbitrary F

An issue was discovered in MDaemon before 20.0.4. There is an IFRAME injection vulnerability in Webmail (aka WorldClient

An issue was discovered in MDaemon before 20.0.4. Remote Administration allows an attacker to perform a fixation of the

An SQL Injection issue in Devolutions Server before 2021.1 and Devolutions Server LTS before 2020.3.18 allows an adminis

The web interface on Intelbras WIN 300 and WRN 342 devices through 2021-01-04 allows remote attackers to discover creden

AjaxSearchPro before 4.20.8 allows Deserialization of Untrusted Data (in the import database feature of the administrati

An issue was discovered in the /api/connector endpoint handler in Yubico yubihsm-connector before 3.0.1 (in YubiHSM SDK

The Windows Installation component of TIBCO Software Inc.'s TIBCO Messaging - Eclipse Mosquitto Distribution - Bridge -

The Windows Installation component of TIBCO Software Inc.'s TIBCO Messaging - Eclipse Mosquitto Distribution - Core - Co

This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.0.1-4

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR Nigh

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R780

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR Nigh

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-2

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-2

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link Arch

An issue was discovered in Forescout CounterACT before 8.1.4. A local privilege escalation vulnerability is present in t

An unquoted service path in SAPSetup, version - 9.0, could lead to privilege escalation during the installation process

A Creation of Temporary File With Insecure Permissions vulnerability in hawk2 of SUSE Linux Enterprise High Availability

Multilaser Router AC1200 V02.03.01.45_pt contains a cross-site request forgery (CSRF) vulnerability. An attacker can ena

Appspace 6.2.4 is vulnerable to a broken authentication mechanism where pages such as /medianet/mail.aspx can be called

Buffer Overflow in TP-Link WR2041 v1 firmware for the TL-WR2041+ router allows remote attackers to cause a Denial-of-Ser

Buffer Overflow in the "sixel_encoder_encode_bytes" function of Libsixel v1.8.6 allows attackers to cause a Denial of Se

Nextcloud Desktop Client prior to 3.1.3 is vulnerable to resource injection by way of missing validation of URLs, allowi

In the standard library in Rust before 1.52.0, there is an optimization for joining strings that can cause uninitialized

The Motorola MH702x devices, prior to version 2.0.0.301, do not properly verify the server certificate during communicat

Grav is a file based Web-platform. Twig processing of static pages can be enabled in the front matter by any administrat

The Grav admin plugin prior to version 1.10.11 does not correctly verify caller's privileges. As a consequence, users wi

ScratchOAuth2 is an Oauth implementation for Scratch. Any ScratchOAuth2-related data normally accessible and modifiable

trestle-auth is an authentication plugin for the Trestle admin framework. A vulnerability in trestle-auth versions 0.4.0

In Gradle before version 7.0, on Unix-like systems, the system temporary directory can be created with open permissions