2021

The PDF.js Viewer WordPress plugin before 2.0.2 does not escape some of its shortcode and Gutenberg Block attributes, wh

The Contact Form, Survey & Popup Form Plugin for WordPress plugin before 1.5 does not properly sanitize some of its sett

The Import any XML or CSV File to WordPress plugin before 3.6.3 does not escape the Import's Title and Unique Identifier

An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5. The apache user could read arbitrary files s

An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5. The Samba file sharing service allowed anony

firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)

A stored cross-site scripting (XSS) vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafte

This affects the package plupload before 2.3.9. A file name containing JavaScript code could be uploaded and run. An att

IBM Cognos Analytics 11.1.7 and 11.2.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed a

IBM Cognos Analytics 11.1.7 and 11.2.0 could allow an authenticated to view or edit a Jupyter notebook that they should

IBM Cognos Analytics 11.1.7 and 11.2.0 could be vulnerable to client side vulnerabilties due to a web response specifyin

IBM Cognos Analytics 11.1.7 and 11.2.0 could allow a low level user to reas of the application that privileged user shou

IBM Cognos Analytics 11.1.7 and 11.2.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed a

The Kentico Xperience CMS version 13.0 – 13.0.43 is vulnerable to a persistent Cross-Site Scripting (XSS) vulnerability

dzzoffice 2.02.1_SC_UTF8 is affected by a Cross Site Scripting (XSS) vulnerability in explorerfile.php. The output of th

showdoc is vulnerable to URL Redirection to Untrusted Site

A reachable assertion vulnerability in Trend Micro Apex One could allow an attacker to crash the program on affected ins

Trend Micro Security 2021 v17.0 (Consumer) contains a vulnerability that allows files inside the protected folder to be

Taocms v2.5Beta5 was discovered to contain a cross-site scripting (XSS) vulnerability via the component Management colum

AOM v2.0.1 was discovered to contain a NULL pointer dereference via the component rate_hist.c.

AOM v2.0.1 was discovered to contain a segmentation violation via the component aom_dsp/x86/obmc_sad_avx2.c.

AOM v2.0.1 was discovered to contain a NULL pointer dereference via the component av1/av1_dx_iface.c.

An issue was discovered on Renesas RX65 and RX65N devices. With a VCC glitch, an attacker can extract the security ID ke

CA Network Flow Analysis (NFA) 21.2.1 and earlier contain a SQL injection vulnerability in the NFA web application, due

The ClickBank Affiliate Ads WordPress plugin through 1.20 does not escape its settings, allowing high privilege users to

An issue was discovered in the eGeeTouch 3rd Generation Travel Padlock application for Android. The lock sends a pairing

bookstack is vulnerable to Cross-Site Request Forgery (CSRF)

Unauthenticated remote attackers can read textual content via FreeMarker including files /scripts/*, /templates/* and so

Authenticated administrators may modify the main YAML configuration file and load a Java class resulting in RCE.

Authenticated administrators may override the system configuration file and cause a denial of service.

Authenticated users with Site roles may inject XSS scripts via file names that will execute in the browser for this and

Authenticated users with Administrator or Developer roles may execute OS commands by Groovy Script which uses Groovy lib

Authenticated users with Administrator or Developer roles may execute OS commands by SPEL Expression in Spring beans. SP

thinkphp-bjyblog (last update Jun 4 2021) is affected by a Cross Site Scripting (XSS) vulnerability in AdminBaseControll

nZEDb v0.4.20 is affected by a Cross Site Scripting (XSS) vulnerability in www/pages/api.php. The exit function will ter

pictshare v1.5 is affected by a Cross Site Scripting (XSS) vulnerability in api/info.php. The exit function will termina

SakuraPanel v1.0.1.1 is affected by a Cross Site Scripting (XSS) vulnerability in /master/core/PostHandler.php. The exit

Mahavitaran android application 7.50 and prior transmit sensitive information in URL parameters. This may lead to inform

Zulip is an open source group chat application that combines real-time chat with threaded conversations. In affected ver

The Events Manager WordPress plugin before 5.9.8 does not sanitise and escape some search parameter before outputing the

Discourse is an open source discussion platform. In affected versions an attacker can poison the cache for anonymous (i.

Discourse is an open source discussion platform. In affected versions a vulnerability in the Polls feature allowed users

Discourse is an open source discussion platform. In affected versions a vulnerability affects users of tag groups who us

IBM QRadar SIEM 7.3 and 7.4 is vulnerable to server side request forgery (SSRF). This may allow an authenticated attacke

IBM QRadar SIEM 7.3 and 7.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary Ja

IBM QRadar SIEM 7.3 and 7.4 could allow an attacker to obtain sensitive information due to the server performing key exc

chamilo-lms v1.11.14 is affected by a Cross Site Scripting (XSS) vulnerability in /plugin/jcapture/applet.php if an atta

NXP Kinetis K82 devices have a buffer over-read via a crafted wlength value in a GET Status-Other request during use of

manage (last update Oct 24, 2017) is affected by a Cross Site Scripting (XSS) vulnerability in Application/Home/Controll

NXP LPC55S69 devices before A3 have a buffer over-read via a crafted wlength value in a GET Descriptor Configuration req