2021

Cachet is an open source status page system. Prior to version 2.5.1 authenticated users, regardless of their privileges

Cachet is an open source status page system. Prior to version 2.5.1, authenticated users, regardless of their privileges

Passport-SAML is a SAML 2.0 authentication provider for Passport, the Node.js authentication library. Prior to version 3

OpenMage magento-lts is an alternative to the Magento CE official releases. Due to missing sanitation in data flow in ve

A lack of filtering for searched keywords in the search bar of YouDianCMS 8.0 allows attackers to perform SQL injection.

An arbitrary file upload vulnerability in the /uploads/dede component of DedeCMS V5.7SP2 allows attackers to upload a we

The GET parameter "id" in WMS v1.0 is passed without filtering, which allows attackers to perform SQL injection.

SQL Injection vulnerability in cxuucms 3.1 ivia the pid parameter in public/admin.php.

xen/arm: No memory limit for dom0less domUs The dom0less feature allows an administrator to create multiple unprivileged

inadequate grant-v2 status frames array bounds check The v2 grant table interface separates grant attributes from grant

long running loops in grant table handling In order to properly monitor resource use, Xen maintains information on the g

grant table v2 status pages may remain accessible after de-allocation Guest get permitted access to certain Xen-owned pa

IOMMU page mapping issues on x86 T[his CNA information record relates to multiple CVEs; the text explains which aspects/

IOMMU page mapping issues on x86 T[his CNA information record relates to multiple CVEs; the text explains which aspects/

IOMMU page mapping issues on x86 T[his CNA information record relates to multiple CVEs; the text explains which aspects/

Heap-based Buffer Overflow vulnerability exists in ok-file-formats 1 via the ok_jpg_generate_huffman_table function in o

Cross Site Scripting (XSS) in Mezzanine v4.3.1 allows remote attackers to execute arbitrary code via the 'Description' f

Command Injection in Simiki v1.6.2.1 and prior allows remote attackers to execute arbitrary system commands via line 64

Cross Site Scripting (XSS) in Simiki v1.6.2.1 and prior allows remote attackers to execute arbitrary code via line 54 of

Cross Site Scripting (XSS) in Blog_mini v1.0 allows remote attackers to execute arbitrary code via the component '/admin

Cross Site Scripting (XSS) in Blog_mini v1.0 allows remote attackers to execute arbitrary code via the component '/admin

OpenMage Magento LTS is an alternative to the Magento CE official releases. Prior to versions 19.4.15 and 20.0.11, layou

Multiple Cross Site Scripting (XSS) vulneratiblities exist in Cacti 1.2.12 in (1) reports_admin.php, (2) data_queries.ph

This affects the package object-path before 0.11.6. A type confusion vulnerability can lead to a bypass of CVE-2020-1525

ngiflib 0.4 has a heap overflow in GetByte() at ngiflib.c:70 in NGIFLIB_NO_FILE mode, GetByte() reads memory buffer with

ngiflib 0.4 has a heap overflow in GetByteStr() at ngiflib.c:108 in NGIFLIB_NO_FILE mode, GetByteStr() copy memory buffe

IBM Maximo Asset Management 7.6.0 and 7.6.1 is vulnerable to cross-site scripting. This vulnerability allows users to em

squashfs_opendir in unsquash-1.c in Squashfs-Tools 4.5 stores the filename in the directory entry; this is then used by

Misskey is a decentralized microblogging platform. In versions of Misskey prior to 12.51.0, malicious actors can use the

The useradm service 1.14.0 (in Northern.tech Mender Enterprise 2.7.x before 2.7.1) and 1.13.0 (in Northern.tech Mender E

In OPC Foundation Local Discovery Server (LDS) before 1.04.402.463, remote attackers can cause a denial of service (DoS)

OpenZepplin is a library for smart contract development. In affected versions a vulnerability in TimelockController allo

OpenZepplin is a library for smart contract development. In affected versions a vulnerability in TimelockController allo

Nuishop v2.3 contains a SQL injection vulnerability in /goods/getGoodsListByConditions/.

Cachet is an open source status page. With Cachet prior to and including 2.3.18, there is a SQL injection which is in th

Discourse is an open source platform for community discussion. In affected versions category names can be used for Cross

A remote cross-site scripting (XSS) vulnerability was discovered in Aruba AirWave Management Platform version(s): Prior

IBM AIX 7.1, 7.2, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the AIX kernel to c

IBM AIX 7.1, 7.2, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the kernel to gain

IBM API Connect 5.0.0.0 through 5.0.8.11 could allow a user to potentially inject code due to unsanitized user input. IB

IBM AIX 7.1, 7.2, and VIOS 3.1 could allow a local user to exploit a vulnerability in the AIX kernel to cause a denial o

IBM API Connect 5.0.0.0 through 5.0.8.11 could alllow a remote user to obtain sensitive information or conduct denial of

octobercms in a CMS platform based on the Laravel PHP Framework. In affected versions of the october/system package an a

octobercms in a CMS platform based on the Laravel PHP Framework. In affected versions of the october/system package an a

Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability

Microsoft Edge (Chromium-based) Information Disclosure Vulnerability

Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability

Use after free in ANGLE in Google Chrome prior to 92.0.4515.159 allowed a remote attacker to potentially exploit heap co

Data race in WebAudio in Google Chrome prior to 92.0.4515.159 allowed a remote attacker to potentially exploit heap corr

Use after free in WebRTC in Google Chrome prior to 92.0.4515.159 allowed an attacker who convinced a user to visit a mal