2021

Jenkins Cloud Statistics Plugin 0.26 and earlier does not perform a permission check in an HTTP endpoint, allowing attac

Jenkins Extra Columns Plugin 1.22 and earlier does not escape parameter values in the build parameters column, resulting

Jenkins Build With Parameters Plugin 1.5 and earlier does not escape parameter names and descriptions, resulting in a st

The netmask package before 2.0.1 for Node.js mishandles certain unexpected characters in an IP address string, such as a

Cross-Site Scripting (XSS) vulnerability in Zhiyuan G6 Government Collaboration System V6.1SP1, via the 'method' paramet

Cross Site Scripting (XSS) vulnerability in INSMA Wifi Mini Spy 1080P HD Security IP Camera 1.9.7 B via all fields in th

An issue was discovered in INSMA Wifi Mini Spy 1080P HD Security IP Camera 1.9.7 B. A local attacker can execute arbitra

A remote cross-site scripting (xss) vulnerability was discovered in some Aruba Instant Access Point (IAP) products in ve

A remote arbitrary file modification vulnerability was discovered in some Aruba Instant Access Point (IAP) products in v

A remote arbitrary file modification vulnerability was discovered in some Aruba Instant Access Point (IAP) products in v

A remote arbitrary file read vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s

A remote arbitrary file read vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s

A remote arbitrary directory create vulnerability was discovered in some Aruba Instant Access Point (IAP) products in ve

A vulnerability was found in Braces versions 2.2.0 and above, prior to 2.3.1. Affected versions of this package are vuln

It was discovered that the is-my-json-valid JavaScript library used an inefficient regular expression to validate JSON f

A remote arbitrary file modification vulnerability was discovered in some Aruba Instant Access Point (IAP) products in v

A remote unauthorized disclosure of information vulnerability was discovered in some Aruba Instant Access Point (IAP) pr

This vulnerability allows local attackers to disclose sensitive information on affected installations of Parallels Deskt

This vulnerability allows local attackers to delete arbitrary directories on affected installations of Avast Premium Sec

MobileIron Mobile@Work through 2021-03-22 allows attackers to distinguish among valid, disabled, and nonexistent user ac

An issue was discovered in PortSwigger Burp Suite before 2021.2. During viewing of a malicious request, it can be manipu

Sherlock SherlockIM through 2021-03-29 allows Cross Site Scripting (XSS) by leveraging the api/Files/Attachment URI to a

An open redirect vulnerability in Ilch CMS version 2.1.42 allows attackers to redirect users to an attacker's site after

A local authentication bypass vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(

Redmine 4.1.x before 4.1.2 allows XSS because an issue's subject is mishandled in the auto complete tip.

bluemonday before 1.0.5 allows XSS because certain Go lowercasing converts an uppercase Cyrillic character, defeating a

remark42 before 1.6.1 allows XSS, as demonstrated by "Locator: Locator{URL:" followed by an XSS payload. This is related

An issue was discovered in the Linux kernel before 5.11.7. usbip_sockfd_store in drivers/usb/usbip/stub_dev.c allows att

An issue was discovered in the Linux kernel through 5.11.10. drivers/net/ethernet/freescale/gianfar.c in the Freescale G

wire-server is an open-source back end for Wire, a secure collaboration platform. In wire-server from version 2021-02-16

OAuth2-Proxy is an open source reverse proxy that provides authentication with Google, Github or other providers. The `-

In FreeBSD 12.2-STABLE before r365730, 11.4-STABLE before r365738, 12.1-RELEASE before p10, 11.4-RELEASE before p4, and

In FreeBSD 12.1-STABLE before r364644, 11.4-STABLE before r364651, 12.1-RELEASE before p9, 11.4-RELEASE before p3, and 1

In 11.4-PRERELEASE before r360733 and 11.3-RELEASE before p13, improper mbuf handling in the kernel causes a use-after-f

In FreeBSD 12.2-STABLE before r369346, 11.4-STABLE before r369345, 12.2-RELEASE before p4 and 11.4-RELEASE before p8 a r

In FreeBSD 12.2-STABLE before r368969, 11.4-STABLE before r369047, 12.2-RELEASE before p3, 12.1-RELEASE before p13 and 1

In FreeBSD 12.2-STABLE before r368969, 11.4-STABLE before r369047, 12.2-RELEASE before p3, 12.1-RELEASE before p13 and 1

In all versions of GitLab, marshalled session keys were being stored in Redis.

An information disclosure issue in GitLab starting from version 12.8 allowed a user with access to the server logs to se

An issue has been discovered in GitLab affecting all versions starting from 13.4. Improper access control allows unautho

Improper authorization in GitLab 12.8+ allows a guest user in a private project to view tag data that should be inaccess

Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for ope

Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for ope

An improper boundary check in DSP driver prior to SMR Mar-2021 Release 1 allows out of bounds memory access.

A vulnerability in DSP driver prior to SMR Mar-2021 Release 1 allows attackers load arbitrary ELF libraries inside DSP.

An incorrect implementation handling file descriptor in dpu driver prior to SMR Mar-2021 Release 1 results in memory cor

An improper access control vulnerability in sec_log file prior to SMR MAR-2021 Release 1 exposes sensitive kernel inform

Rocket.Chat before 3.11, 3.10.5, 3.9.7, 3.8.8 is vulnerable to persistent cross-site scripting (XSS) using nested markdo

A flaw was found in RESTEasy in all versions of RESTEasy up to 4.6.0.Final. The endpoint class and method names are retu

A flaw was found in upx canPack in p_lx_elf.cpp in UPX 3.96. This flaw allows attackers to cause a denial of service (SE