2021

Matrix is an ecosystem for open federated Instant Messaging and Voice over IP. In versions 1.41.0 and prior, unauthorise

`@npmcli/arborist`, the library that calculates dependency trees and manages the node_modules folder hierarchy for the n

`@npmcli/arborist`, the library that calculates dependency trees and manages the `node_modules` folder hierarchy for the

The npm package "tar" (aka node-tar) before versions 4.4.18, 5.0.10, and 6.1.9 has an arbitrary file creation/overwrite

The npm package "tar" (aka node-tar) before versions 4.4.18, 5.0.10, and 6.1.9 has an arbitrary file creation/overwrite

The npm package "tar" (aka node-tar) before versions 4.4.16, 5.0.8, and 6.1.7 has an arbitrary file creation/overwrite a

An SQL injection Privilege Escalation Vulnerability was discovered in the Orion Platform reported by the ZDI Team. A bli

A vulnerability found in UniFi Protect application V1.18.1 and earlier allows a malicious actor with a view-only role an

A vulnerability found in UniFi Protect application V1.18.1 and earlier permits a malicious actor who has already gained

An information disclosure exists in Brave Browser Desktop prior to version 1.28.62, where logged warning messages that i

Tizen RT RTOS version 3.0.GBB is vulnerable to integer wrap-around in functions_calloc and mm_zalloc. This improper memo

A memory corruption vulnerability exists in the XML-parsing CreateLabelOrAttrib functionality of AT&T Labs’ Xmill 0.7. A

Matrix is an ecosystem for open federated Instant Messaging and Voice over IP. In versions 1.41.0 and prior, unauthorise

A security researcher stored XSS via a Help Server setting. This affects customers using Internet Explorer, because they

A security researcher found a user with Orion map manage rights could store XSS through via text box hyperlink.

The Serv-U File Server allows for events such as user login failures to be audited by executing a command. This command

An Improper Access Control Privilege Escalation Vulnerability was discovered in the User Setting of Orion Platform versi

IBM OpenPages with Watson 8.1 and 8.2 could allow an authenticated user to upload a file that could execute arbitrary co

Jenkins Nomad Plugin 0.7.4 and earlier stores Docker passwords unencrypted in the global config.xml file on the Jenkins

Jenkins Nested View Plugin 1.20 and earlier does not configure its XML transformer to prevent XML external entity (XXE)

Jenkins Azure AD Plugin 179.vf6841393099e and earlier allows attackers to craft URLs that would bypass the CSRF protecti

Jenkins SAML Plugin 2.0.7 and earlier allows attackers to craft URLs that would bypass the CSRF protection of any target

Jenkins Code Coverage API Plugin 1.4.0 and earlier does not apply Jenkins JEP-200 deserialization protection to Java obj

Cross Site Scripting (XSS) in MyBB v1.8.20 allows remote attackers to inject arbitrary web script or HTML via the "Descr

Cross Site Scripting (XSS) in MyBB v1.8.20 allows remote attackers to inject arbitrary web script or HTML via the "Title

Cross Site Request Forgey (CSRF) in iWebShop v5.3 allows remote atatckers to execute arbitrary code via malicious POST r

Cross Site Scripting (XSS) in S-CMS v1.0 allows remote attackers to execute arbitrary code via the component '/admin/tpl

This vulnerability allows attackers to impersonate users and perform arbitrary actions leading to a Remote Code Executio

Improper Access Control Tampering Vulnerability using ImportAlert function which can lead to a Remote Code Execution (RC

The Zoomsounds plugin <= 6.45 for WordPress allows arbitrary files, including sensitive configuration files such as wp-c

Command Injection vulnerability in EmailWebPage API which can lead to a Remote Code Execution (RCE) from the Alerts Sett

ExportToPdfCmd Arbitrary File Read Information Disclosure Vulnerability using ImportAlert function within the Alerts Set

axios is vulnerable to Inefficient Regular Expression Complexity

Missing Release of Resource after Effective Lifetime vulnerability in OpenSSL implementation of WAGO 750-831/xxx-xxx, 75

This vulnerability allows an attacker who has access to the WBM to read and write settings-parameters of the device by s

In PEPPERL+FUCHS WirelessHART-Gateway 3.0.7 to 3.0.9 the SSH and telnet services are active with hard-coded credentials.

Any cookie-stealing vulnerabilities within the application or browser would enable an attacker to steal the user's crede

In PEPPERL+FUCHS WirelessHART-Gateway 3.0.8 and 3.0.9 the HttpOnly attribute is not set on a cookie. This allows the coo

In PEPPERL+FUCHS WirelessHART-Gateway 3.0.8 it is possible to inject arbitrary JavaScript into the application's respons

In PEPPERL+FUCHS WirelessHART-Gateway <= 3.0.8 serious issue exists, if the application is not externally accessible or

In PEPPERL+FUCHS WirelessHART-Gateway <= 3.0.9 a form contains a password field with autocomplete enabled. The stored cr

In PEPPERL+FUCHS WirelessHART-Gateway <= 3.0.8 a vulnerability may allow remote attackers to rewrite links and URLs in c

In PEPPERL+FUCHS WirelessHART-Gateway <= 3.0.7 the filename parameter is vulnerable to unauthenticated path traversal at

An issue was discovered in Form Tools through 3.0.20. SQL Injection can occur via the export_group_id field when a low-p

An issue was discovered in Form Tools through 3.0.20. A low-privileged user can trigger Reflected XSS when a viewing a f

An issue was discovered in Form Tools through 3.0.20. When an administrator creates a customer account, it is possible f

git_connect_git in connect.c in Git before 2.30.1 allows a repository path to contain a newline character, which may res

In the server in SerNet verinice before 1.22.2, insecure Java deserialization allows remote authenticated attackers to e

KRAMER VIAware through August 2021 allows remote attackers to execute arbitrary code because ajaxPages/writeBrowseFilePa

A stored XSS vulnerability was discovered in the ECT Provider in OutSystems before 2020-09-04, affecting generated appli