2021

The mediamaticAjaxRenameCategory AJAX action of the Mediamatic WordPress plugin before 2.8.1, available to any authentic

The SEO Booster WordPress plugin before 3.8 allows for authenticated SQL injection via the "fn_my_ajaxified_dataloader_a

Advanced Custom Fields versions prior to 5.11 and Advanced Custom Fields Pro versions prior to 5.11 contain a missing au

An issue was discovered in Reprise RLM 14.2. By using an admin account, an attacker can write a payload to /goform/edit_

An issue was discovered in Reprise RLM 14.2. When editing the license file, it is possible for an admin user to enable a

An issue was discovered in Reprise RLM 14.2. As the session cookies are small, an attacker can hijack any existing sessi

Auerswald COMpact 5500R devices before 8.2B allow Privilege Escalation via the passwd=1 substring.

Auerswald COMfortel 1400 IP and 2600 IP before 2.8G devices allow Authentication Bypass via the /about/../ substring.

The TCP Server module in toxcore before 0.2.8 doesn't free the TCP priority queue under certain conditions, which allows

HashiCorp Consul Enterprise before 1.8.17, 1.9.x before 1.9.11, and 1.10.x before 1.10.4 has Incorrect Access Control. A

OpenOlat is a web-basedlearning management system. A path traversal vulnerability exists in OpenOlat prior to versions 1

A malicious hypervisor in conjunction with an unprivileged attacker process inside an SEV/SEV-ES guest VM may fail to fl

The package com.h2database:h2 from 1.4.198 and before 2.0.202 are vulnerable to XML External Entity (XXE) Injection via

In Pluck-4.7.15 admin background a remote command execution vulnerability exists when uploading files.

Session Fixation vulnerability in login.php in Pluck-CMS Pluck 4.7.15 allows an attacker to sustain unauthorized access

An information disclosure vulnerability in the login page of Huntflow Enterprise before 3.10.4 could allow an unauthenti

A security vulnerability has been identified in HPE StoreServ Management Console (SSMC). An authenticated SSMC administr

An issue was discovered on Digi TransPort Gateway devices through 5.2.13.4. They do not set the Secure attribute for sen

An issue was discovered on Digi TransPort devices through 2021-07-21. An authenticated attacker may load customized firm

Next.js is a React framework. In versions of Next.js prior to 12.0.5 or 11.1.3, invalid or malformed URLs could lead to

Delta Electronics CNCSoft Versions 1.01.30 and prior are vulnerable to a stack-based buffer overflow, which may allow an

A Cross Site Request Forgery (CSRF) vulnerability exits in ZZZCMS V1.7.1 via the save_user funciton in save.php.

Flask-AppBuilder is a development framework built on top of Flask. Verions prior to 3.3.4 contain an improper authentica

An SQL Injection vulnerability exists in zzcms 8.2, 8.3, 2020, abd 2021 in dl/dl_download.php. when registering ordinary

An SQL Injection vulnerability exists in zzcms 8.2, 8.3, 2020, and 2021 in dl/dl_print.php when registering ordinary use

IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 uses weaker than expec

IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to a denial of service, caused by sending a specia

IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 could allow a user wit

When using the dart pub publish command to publish a package to a third-party package server, the request would be authe

IBM Db2 9.7, 10.1, 10.5, 11.1, and 11.5 may be vulnerable to an Information Disclosure when using the LOAD utility as un

An SQL Injection vulnerablitly exits in zzcms 8.2, 8.3, 2020, and 2021 via the id parameter in admin/dl_sendmail.php.

An SQL Injection vulnerability exists in zzcms 8.2, 8.3, 2020, and 2021 via the id parameter in admin/bad.php.

An authentication bypass vulnerability exists in the get_aes_key_info_by_packetid() function of the home_security binary

Gryphon Tower routers contain an unprotected openvpn configuration file which can grant attackers access to the Gryphon

An unauthenticated command injection vulnerability exists in the parameters of operation 49 in the controller_server ser

An unauthenticated command injection vulnerability exists in the parameters of operation 48 in the controller_server ser

An unauthenticated command injection vulnerability exists in the parameters of operation 41 in the controller_server ser

An unauthenticated command injection vulnerability exists in the parameters of operation 32 in the controller_server ser

An unauthenticated command injection vulnerability exists in the parameters of operation 10 in the controller_server ser

An unauthenticated command injection vulnerability exists in the parameters of operation 3 in the controller_server serv

An unauthenticated command injection vulnerability exists in multiple parameters in the Gryphon Tower router’s web inter

A path traversal attack in web interfaces of Netgear RAX35, RAX38, and RAX40 routers before v1.0.4.102, allows a remote

A heap-based buffer overflow in Fortinet FortiWeb version 6.4.1 and 6.4.0, version 6.3.15 and below, version 6.2.6 and b

A incorrect permission assignment for critical resource in Fortinet FortiNAC version 9.2.0, version 9.1.3 and below, ver

Multiple stack-based buffer overflows in the API controllers of FortiWeb 6.4.1, 6.4.0, and 6.3.0 through 6.3.15 may allo

Sockeye is an open-source sequence-to-sequence framework for Neural Machine Translation built on PyTorch. Sockeye uses Y

Failure to correctly record the location of live pointers across wasm instance calls resulted in a GC occurring within t

An incorrect type conversion of sizes from 64bit to 32bit integers allowed an attacker to corrupt memory leading to a po

A use-after-free could have occured when an HTTP2 session object was released on a different thread, leading to memory c

Mozilla developers and community members reported memory safety bugs present in Firefox 93 and Firefox ESR 91.2. Some of