2021

Pion WebRTC before 3.0.15 didn't properly tear down the DTLS Connection when certificate verification failed. The PeerCo

M-System DL8 series (type A (DL8-A) versions prior to Ver3.0, type B (DL8-B) versions prior to Ver3.0, type C (DL8-C) ve

M-System DL8 series (type A (DL8-A) versions prior to Ver3.0, type B (DL8-B) versions prior to Ver3.0, type C (DL8-C) ve

Improper access control vulnerability in Custom App of Cybozu Office 10.0.0 to 10.8.4 allows authenticated attackers to

Improper access control vulnerability in Cabinet of Cybozu Office 10.0.0 to 10.8.4 allows authenticated attackers to byp

Improper access control vulnerability in Bulletin Board of Cybozu Office 10.0.0 to 10.8.4 allows authenticated attackers

Improper input validation vulnerability in Custom App of Cybozu Office 10.0.0 to 10.8.4 allows authenticated attacker to

Improper access control vulnerability in Phone Messages of Cybozu Office 10.0.0 to 10.8.4 allows authenticated attackers

Cross-site scripting vulnerability in E-mail of Cybozu Office 10.0.0 to 10.8.4 allows remote attackers to inject an arbi

Cross-site scripting vulnerability in Address Book of Cybozu Office 10.0.0 to 10.8.4 allows remote attackers to inject a

Cross-site scripting vulnerability in Address Book of Cybozu Office 10.0.0 to 10.8.4 allows remote attackers to inject a

Improper access control vulnerability in Workflow of Cybozu Office 10.0.0 to 10.8.4 allows authenticated attackers to by

Improper access control vulnerability in Bulletin Board of Cybozu Office 10.0.0 to 10.8.4 allows an authenticated attack

Improper access control vulnerability in Scheduler of Cybozu Office 10.0.0 to 10.8.4 allows an authenticated attacker to

In Advantech Spectre RT Industrial Routers ERT351 5.1.3 and prior, the affected product does not neutralize special char

Fujitsu ServerView Suite iRMC before 9.62F allows XSS. An authenticated attacker can store an XSS payload in the PSCU_FI

The Taidii Diibear Android application 2.4.0 and all its derivatives allow attackers to view private chat messages and m

The Taidii Diibear Android application 2.4.0 and all its derivatives allow attackers to obtain user credentials from an

autoar-extractor.c in GNOME gnome-autoar before 0.3.1, as used by GNOME Shell, Nautilus, and other software, allows Dire

Buffer overflow occurs when trying to convert ASCII string to Unicode string if the actual size is more than required in

Integer overflow in boot due to improper length check on arguments received in Snapdragon Consumer IOT, Snapdragon Indus

Potential arbitrary memory corruption when the qseecom driver updates ion physical addresses in the buffer as it exposes

Usage of syscall by non-secure entity can allow extraction of secure QTEE diagnostic information in clear text form due

While processing storage SCM commands there is a time of check or time of use window where a pointer used could be inval

HLOS to access EL3 stack canary by just mapping imem region due to Improper access control and can lead to information e

Modem will enter into busy mode in an infinite loop while parsing histogram dimension due to improper validation of inpu

It has been discovered in redhat-certification that any unauthorized user may download any file under /var/www/rhcert, p

The aimeos (aka Aimeos shop and e-commerce framework) extension before 19.10.12 and 20.x before 20.10.5 for TYPO3 allows

A vulnerability has been identified in the Silverstripe CMS 3 and 4 version of the symbiote/silverstripe-queuedjobs modu

Varnish varnish-modules before 0.17.1 allows remote attackers to cause a denial of service (daemon restart) in some conf

IBM Spectrum Scale 5.0.0 through 5.0.5.5 and 5.1.0 through 5.1.0.2 uses an inadequate account lockout setting that could

IBM Spectrum Scale 5.0.0 through 5.0.5.5 and 5.1.0 through 5.1.0.2 could allow a local user with a valid role to the RES

IBM Spectrum Scale 5.0.0 through 5.0.5.5 and 5.1.0 through 5.1.0.2 could allow a local user to poison log files which co

Apache Hive cookie signature verification used a non constant time comparison which is known to be vulnerable to timing

If certificates that signed grub are installed into db, grub can be booted directly. It will then boot any kernel withou

The web service responsible for fetching other users' enrolled courses did not validate that the requesting user had per

When creating a user account, it was possible to verify the account without having access to the verification email link

It was possible for some users without permission to view other users' full names to do so via the online users block in

Text-based feedback answers required additional sanitizing to prevent stored XSS and blind SSRF risks in moodle before 3

The ID number user profile field required additional sanitizing to prevent a stored XSS risk in moodle before 3.10.2, 3.

In Hamilton Medical AG,T1-Ventillator versions 2.2.3 and prior, an information disclosure vulnerability in the ventilato

In Hamilton Medical AG,T1-Ventillator versions 2.2.3 and prior, an XML validation vulnerability in the ventilator allows

In Hamilton Medical AG,T1-Ventillator versions 2.2.3 and prior, hard-coded credentials in the ventilator allow attackers

A cross-site scripting (XSS) vulnerability on the Delete Personal Data page in Cryptshare Server before 4.8.0 allows an

Unquoted service path vulnerability in McAfee Endpoint Product Removal (EPR) Tool prior to 21.2 allows local administrat

The urllib3 library 1.26.x before 1.26.4 for Python omits SSL certificate validation in some cases involving HTTPS to HT

Cross-site Scripting vulnerability in MyBB before 1.8.26 via Custom moderator tools.

Improper URL handling in Wireshark 3.4.0 to 3.4.3 and 3.2.0 to 3.2.11 could allow remote code execution via via packet i

The Backup functionality in Grav CMS through 1.7.0-rc.17 allows an authenticated attacker to read arbitrary local files

An issue was discovered in Quadbase ExpressDashboard (EDAB) 7 Update 9. It allows CSRF. An attacker may be able to trick