2021

Pillow before 8.1.2 allows attackers to cause a denial of service (memory consumption) because the reported size of a co

An improper access control vulnerability was identified in the GitHub Enterprise Server GraphQL API that allowed authent

A remote code execution vulnerability was identified in GitHub Enterprise Server that could be exploited when building a

Microsoft Exchange Server Remote Code Execution Vulnerability

Microsoft Exchange Server Remote Code Execution Vulnerability

Microsoft Exchange Server Remote Code Execution Vulnerability

usersettings.php in e107 through 2.3.0 lacks a certain e_TOKEN protection mechanism.

Calling of non-existent provider in MobileWips application prior to SMR Feb-2021 Release 1 allows unauthorized actions i

Dell EMC OpenManage Server Administrator (OMSA) version 9.5 Microsoft Windows installations with Distributed Web Server

A buffer overflow vulnerability in the AT command interface of Gigaset DX600A v41.00-175 devices allows remote attackers

An issue was discovered in Veritas Backup Exec before 21.2. The communication between a client and an Agent requires suc

An issue was discovered in Veritas Backup Exec before 21.2. It supports multiple authentication schemes: SHA authenticat

An issue was discovered in Veritas Backup Exec before 21.2. The communication between a client and an Agent requires suc

EPrints 3.4.2 allows remote attackers to execute arbitrary commands via crafted input to the verb parameter in a cgi/too

SRS Policy Manager 6.X is affected by an XML External Entity Injection (XXE) vulnerability due to a misconfigured XML pa

An improper binary stream data handling issue was found in the [core] module of ONLYOFFICE DocumentServer v4.0.0-9-v5.6.

The fix for CVE-2020-9484 was incomplete. When using Apache Tomcat 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41, 8.5.0 to 8.5

When responding to new h2c connection requests, Apache Tomcat versions 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41 and 8.5.0

In SaltStack Salt before 3002.5, when authenticating to services using certain modules, the SSL certificate is not alway

An issue was discovered in SaltStack Salt before 3002.5. The minion's restartcheck is vulnerable to command injection vi

An issue was discovered in Scytl sVote 2.1. Due to the implementation of the database manager, an attacker can access th

An issue was discovered in Scytl sVote 2.1. Because the sdm-ws-rest API does not require authentication, an attacker can

A vulnerability was discovered in how p2p/p2p_pd.c in wpa_supplicant before 2.10 processes P2P (Wi-Fi Direct) provision

Zenphoto through 1.5.7 is affected by authenticated arbitrary file upload, leading to remote code execution. The attacke

ean_leading_zeroes in backend/upcean.c in Zint Barcode Generator 2.9.1 has a stack-based buffer overflow that is reachab

Stack-based buffer overflow vulnerability in frontend/main.c in faad2 before 2.2.7.1 allow local attackers to execute ar

Insertion of sensitive information into sent data vulnerability in synorelayd in Synology DiskStation Manager (DSM) befo

Cleartext transmission of sensitive information vulnerability in synorelayd in Synology DiskStation Manager (DSM) before

Cleartext transmission of sensitive information vulnerability in synorelayd in Synology DiskStation Manager (DSM) before

Incorrect authorization vulnerability in synoagentregisterd in Synology DiskStation Manager (DSM) before 6.2.4-25553 all

Node-Red is a low-code programming for event-driven applications built using nodejs. Node-RED 1.2.7 and earlier contains

Mozilla developers reported memory safety bugs present in Firefox 85. Some of these bugs showed evidence of memory corru

Mozilla developers reported memory safety bugs present in Firefox 85 and Firefox ESR 78.7. Some of these bugs showed evi

Mozilla developers reported memory safety bugs present in Firefox 84. Some of these bugs showed evidence of memory corru

Mozilla developers reported memory safety bugs present in Firefox 84 and Firefox ESR 78.6. Some of these bugs showed evi

The vulnerabilities can be exploited to cause the web visualization component of the PLC to stop and not respond, leadin

Changing the password on the module webpage does not require the user to type in the current password first. Thus, the p

ownCloud owncloud/client before 2.7 allows DLL Injection. The desktop client loaded development plugins from certain dir

Micro Focus Solutions Business Manager Application Repository versions prior to 11.7.1 are vulnerable to privilege escal

Incorrect use of the '<RowCountChanged>' method could have led to a user-after-poison and a potentially exploitable cras

Further techniques that built on the slipstream research combined with a malicious webpage could have exposed both an in

Performing garbage collection on re-declared JavaScript variables resulted in a user-after-poison, and a potentially exp

Navigations through the Android-specific `intent` URL scheme could have been misused to escape iframe sandbox. Note: Thi

Using the new logical assignment operators in a JavaScript switch statement could have caused a type confusion, leading

When accepting a malicious intent from other installed apps, Firefox for Android accepted manifests from arbitrary file

One phishing tactic on the web is to provide a link with HTTP Auth. For example 'https://[email protected]

.NET Core Remote Code Execution Vulnerability

Visual Studio Code npm-script Extension Remote Code Execution Vulnerability

Windows PKU2U Elevation of Privilege Vulnerability

.NET Core Remote Code Execution Vulnerability