2021

A CWE-22: Improper Limitation of a Pathname to a Restricted Directory vulnerability exists in Harmony/HMI Products Confi

This release addresses a potential information leakage vulnerability in NetIQ Access Manager versions prior to 5.0.1

Authentication bypass vulnerability in Apache Zeppelin allows an attacker to bypass Zeppelin authentication mechanism to

bash command injection vulnerability in Apache Zeppelin allows an attacker to inject system commands into Spark interpre

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to version

Acrobat Reader DC versions versions 2020.013.20074 (and earlier), 2020.001.30018 (and earlier) and 2017.011.30188 (and e

Buffer overflow vulnerability in function prune_to_recommended in src/policy.c in libsolv before 0.7.17 allows attackers

Buffer overflow vulnerability in function pool_installable_whatprovides in src/repo.h in libsolv before 0.7.17 allows at

Buffer overflow vulnerability in function pool_disabled_solvable in src/repo.h in libsolv before 0.7.17 allows attackers

Buffer overflow vulnerability in function pool_installable in src/repo.h in libsolv before 0.7.17 allows attackers to ca

bookstack is vulnerable to Server-Side Request Forgery (SSRF)

immer is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

A vulnerability in the web UI for Cisco Nexus Insights could allow an authenticated, remote attacker to view and downloa

A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) Software could allow an au

A vulnerability in the TACACS+ authentication, authorization and accounting (AAA) feature of Cisco Enterprise NFV Infras

A vulnerability in the CLI of Cisco Prime Infrastructure and Cisco Evolved Programmable Network (EPN) Manager could allo

A vulnerability in the web-based management interface of Cisco Prime Collaboration Provisioning could allow an unauthent

The effective key space used to encrypt the cache in CyberArk Credential Provider prior to 12.1 has low entropy, and und

An inadequate encryption vulnerability discovered in CyberArk Credential Provider before 12.1 may lead to Information Di

The user identification mechanism used by CyberArk Credential Provider prior to 12.1 is susceptible to a local host race

Affected versions of Atlassian Jira Server and Data Center allow users who have watched an issue to continue receiving u

Affected versions of Atlassian Jira Service Management Server and Data Center allow remote attackers with "Jira Administ

WTCMS 1.0 contains a stored cross-site scripting (XSS) vulnerability in the link address field under the background link

WTCMS 1.0 contains a stored cross-site scripting (XSS) vulnerability in the link field under the background menu managem

WTCMS 1.0 contains a stored cross-site scripting (XSS) vulnerability in the source field under the article management mo

WTCMS 1.0 contains a reflective cross-site scripting (XSS) vulnerability in the page management background which allows

WTCMS 1.0 contains a reflective cross-site scripting (XSS) vulnerability in the keyword search function under the backgr

WTCMS 1.0 contains a cross-site request forgery (CSRF) vulnerability in the index.php?g=admin&m=nav&a=add_post component

An issue was discovered in the server software in Kaseya Unitrends Backup Software before 10.5.5-2. There is authenticat

An issue was discovered in the server software in Kaseya Unitrends Backup Software before 10.5.5-2. There is a privilege

GlobalNewFiles is a MediaWiki extension maintained by Miraheze. Prior to commit number cee254e1b158cdb0ddbea716b1d3edc31

Http4s is a minimal, idiomatic Scala interface for HTTP services. In http4s versions 0.21.26 and prior, 0.22.0 through 0

OpenOlat is a web-based learning management system (LMS). Prior to version 15.3.18, 15.5.3, and 16.0.0, using a prepared

YzmCMS v5.5 contains a server-side request forgery (SSRF) in the grab_image() function.

A SQL injection vulnerability in the 4.edu.php\conn\function.php component of S-CMS v1.0 allows attackers to access sens

Amazon Kindle e-reader prior to and including version 5.13.4 improperly manages privileges, allowing the framework user

This affects the package mpath before 0.8.4. A type confusion vulnerability can lead to a bypass of CVE-2018-16490. In p

An issue was discovered on Compro IP70 2.08_7130218, IP570 2.08_7130520, IP60, and TN540 devices. mjpegStreamer.cgi allo

An issue was discovered on Compro IP70 2.08_7130218, IP570 2.08_7130520, IP60, and TN540 devices. index_MJpeg.cgi allows

An issue was discovered on Compro IP70 2.08_7130218, IP570 2.08_7130520, IP60, and TN540 devices. cameralist.cgi and set

An issue was discovered on Compro IP70 2.08_7130218, IP570 2.08_7130520, IP60, and TN540 devices. rstp://.../medias2 doe

An issue was discovered on Compro IP70 2.08_7130218, IP570 2.08_7130520, IP60, and TN540 devices. /cgi-bin/support/killp

In Eclipse Theia 0.3.9 to 1.8.1, the "mini-browser" extension allows a user to preview HTML files in an iframe inside th

Amazon Kindle e-reader prior to and including version 5.13.4 contains an Integer Overflow that leads to a Heap-Based Buf

This affects the package immer before 9.0.6. A type confusion vulnerability can lead to a bypass of CVE-2020-28477 when

IBM Planning Analytics 2.0 could expose information that could be used to to create attacks by not validating the return

IBM Planning Analytics 2.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary Jav

IBM Planning Analytics 2.0 could allow a remote attacker to obtain sensitive information when a stack trace is returned

webctrl.cgi.elf on Christie Digital DWU850-GS V06.46 devices allows attackers to perform any desired action via a crafte

XMP Toolkit SDK version 2020.1 (and earlier) is affected by a stack-based buffer overflow vulnerability potentially resu