2021

Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an imprope

Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an XML Inj

Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by a stored c

Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by a stored c

Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an imprope

Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an Imprope

Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an XML Inj

Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an XML Inj

Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by a business

Adobe Captivate version 11.5.5 (and earlier) is affected by an Creation of Temporary File In Directory With Incorrect Pe

Deserialization of Untrusted Data in the Web Console Chart Endpoint can lead to remote code execution. An unauthorized a

Insecure Deserialization of untrusted data remote code execution vulnerability was discovered in Patch Manager Orion Pla

Insecure deserialization leading to Remote Code Execution was detected in the Orion Platform version 2020.2.5. Authentic

This affects all versions of package elFinder.NetCore. The Path.Combine(...) method is used to create an absolute file p

This affects all versions of package elFinder.NetCore. The ExtractAsync function within the FileSystem is vulnerable to

This affects all versions of package Proto. It is possible to inject pollute the object property of an application using

Pimcore is an open source data & experience management platform. Prior to version 10.1.2, an authenticated user could ad

Pimcore is an open source data & experience management platform. Prior to version 10.1.2, text-values were not properly

NMSAccess32.exe in TeraRecon AQNetClient 4.4.13 allows attackers to execute a malicious binary with SYSTEM privileges vi

OpenEMR 6.0.0 has a pnotes_print.php?noteid= Insecure Direct Object Reference vulnerability via which an attacker can re

A SQL Injection vulnerability exists in openSIS 8.0 when MySQL (MariaDB) is being used as the application database. A ma

A SQL Injection vulnerability exists in openSIS 8.0 when MySQL (MariaDB) is being used as the application database. A ma

A SQL Injection vulnerability exists in openSIS 8.0 when MySQL (MariaDB) is being used as the application database. A ma

Samsung Drive Manager 2.0.104 on Samsung H3 devices allows attackers to bypass intended access controls on disk manageme

CyberArk Identity 21.5.131, when handling an invalid authentication attempt, sometimes reveals whether the username is v

Wireless devices running certain Arcadyan-derived firmware (such as KPN Experia WiFi 1.00.15) do not properly sanitise u

User with Orion Platform Admin Rights could store XSS through URL POST parameter in CreateExternalWebsite website.

An issue was discovered in iPortalis iCS 7.1.13.0. An attacker can gain privileges by intercepting a request and changin

An issue was discovered in iPortalis iCS 7.1.13.0. Attackers can send a sequence of requests to rapidly cause .NET Input

The renderWidgetResource resource in Atlasian Atlasboard before version 1.1.9 allows remote attackers to read arbitrary

Zoho ManageEngine ServiceDesk Plus before 11302 is vulnerable to authentication bypass that allows a few REST-API URLs w

Cyrus IMAP before 3.4.2 allows remote attackers to cause a denial of service (multiple-minute daemon hang) via input tha

A SQL injection vulnerability exists in version 8.0 of openSIS when MySQL or MariaDB is used as the application database

An issue was discovered in Ivanti Workspace Control before 10.6.30.0. A locally authenticated user with low privileges c

bludit v3.13.0 contains an arbitrary file deletion vulnerability in the backup plugin via the `deleteBackup' parameter.

A heap buffer-overflow in the client_example1.c component of libiec_iccp_mod v1.5 leads to a denial of service (DOS).

IEC104 v1.0 contains a stack-buffer overflow in the parameter Iec10x_Sta_Addr.

VMware Workspace ONE Access and Identity Manager, unintentionally provide a login interface on port 7443. A malicious ac

VMware Workspace ONE Access and Identity Manager, allow the /cfg web app and diagnostic endpoints, on port 8443, to be a

VMware Workspace ONE UEM REST API contains a denial of service vulnerability. A malicious actor with access to /API/syst

An issue was discovered in OpenStack Neutron before 16.4.1, 17.x before 17.2.1, and 18.x before 18.1.1. Authenticated at

OpenOLAT is a web-based learning management system (LMS). A path traversal vulnerability exists in versions prior to 15.

detect-character-encoding is a package for detecting character encoding using ICU. In detect-character-encoding v0.3.0 a

A stored cross-site scripting (XSS) vulnerability exists in FileBrowser < v2.16.0 that allows an authenticated user auth

Use of a hard-coded cryptographic key in MIK.starlight 7.9.5.24363 allows local users to decrypt credentials via unspeci

The function AdminGetFirstFileContentByFilePath in MIK.starlight 7.9.5.24363 allows (by design) an authenticated attacke

Improper Authorization in multiple functions in MIK.starlight 7.9.5.24363 allows an authenticated attacker to escalate p

Deserialization of untrusted data in multiple functions in MIK.starlight 7.9.5.24363 allows authenticated remote attacke

HashiCorp Vault Enterprise 0.9.2 through 1.6.2 allowed the read of license metadata from DR secondaries without authenti

A flaw has been found in libssh in versions prior to 0.9.6. The SSH protocol keeps track of two shared secrets during th