2021

Possible race condition during async fastrpc session after sending RPC message due to the fastrpc ctx gets free during a

Possible out of bounds while accessing global control elements due to race condition in Snapdragon Auto, Snapdragon Comp

Possible denial of service due to RTT responder consistently rejects all FTMR by transmitting FTM1 with failure status i

Possible memory corruption while processing EAPOL frames due to lack of validation of key length before using it in Snap

Arbitrary memory write issue in video driver while setting the internal buffers in Snapdragon Auto, Snapdragon Compute,

Out of bound in camera driver due to lack of check of validation of array index before copying into array in Snapdragon

Possible memory corruption and information leakage in sub-system due to lack of check for validity and boundary complian

Stack overflow may occur if GSM/WCDMA broadcast config size received from user is larger than variable length array in S

Out of bound write and read in TA while processing command from NS side due to improper length check on command and resp

Possible out of bound access in TA while processing a command from NS side due to improper length check of response buff

Possible memory corruption in BSI module due to improper validation of parameter count in Snapdragon Auto, Snapdragon Co

User can overwrite Security Code NV item without knowing current SPC due to improper validation of SPC code setting and

Django Channels 3.x before 3.0.3 allows remote attackers to obtain sensitive information from a different request scope.

An issue was discovered in Acronis Cyber Protect before 15 Update 1 build 26172. Because the local notification service

On Netshield NANO 25 10.2.18 devices, /usr/local/webmin/System/manual_ping.cgi allows OS command injection (after authen

Smarty before 3.1.39 allows a Sandbox Escape because $smarty.template_object can be accessed in sandbox mode.

URI.js (aka urijs) before 1.19.6 mishandles certain uses of backslash such as http:\/ and interprets the URI as a relati

The module admin_ITSM in EyesOfNetwork 5.3-10 allows remote authenticated users to upload arbitrary .xml.php files becau

An integer overflow in the PngImg::InitStorage_() function of png-img before 3.1.0 leads to an under-allocation of heap

In Visualware MyConnection Server before 11.0b build 5382, each published report is not associated with its own access c

An issue was discovered in SmartStoreNET before 4.1.0. Lack of Cross Site Request Forgery (CSRF) protection may lead to

Mailtrain through 1.24.1 allows SQL Injection in statsClickedSubscribersByColumn in lib/models/campaigns.js via /campaig

An issue was discovered in Alfresco Enterprise Content Management (ECM) before 6.2.1. A user with privileges to edit a F

Improper Handling of Length Parameter Inconsistency vulnerability in Mitsubishi Electric FA Engineering Software (CPU Mo

Heap-based buffer overflow vulnerability in Mitsubishi Electric FA Engineering Software (CPU Module Logging Configuratio

Path Traversal vulnerability exists in Metasys Reporting Engine (MRE) Web Services which could allow a remote unauthenti

The affected Fuji Electric V-Server Lite versions prior to 3.3.24.0 are vulnerable to an out-of-bounds write, which may

This affects the package docsify before 4.12.0. It is possible to bypass the remediation done by CVE-2020-7680 and execu

Dell EMC PowerProtect Cyber Recovery, version 19.7.0.1, contains an Information Disclosure vulnerability. A locally auth

An exploitable local privilege elevation vulnerability exists in the file system permissions of Sytech XL Reporter v14.0

A CWE-319: Cleartext transmission of sensitive information vulnerability exists in PowerLogic ION7400, ION7650, ION83xx/

A CWE-319: Cleartext transmission of sensitive information vulnerability exists in PowerLogic ION7400, ION7650, ION7700/

In the default configuration, Apache MyFaces Core versions 2.2.0 to 2.2.13, 2.3.0 to 2.3.7, 2.3-next-M1 to 2.3-next-M4,

The File Firewall before 2.8.0 for ownCloud Server does not properly enforce file-type restrictions for public shares.

An issue was discovered in ownCloud before 10.4. Because of an SSRF issue (via the apps/files_sharing/external remote pa

Open OnDemand before 1.5.7 and 1.6.x before 1.6.22 allows CSRF.

Checkmk before 1.6.0p17 allows local users to obtain SYSTEM privileges via a Trojan horse shell script in the %PROGRAMDA

A ReDoS (regular expression denial of service) flaw was found in the @progfay/scrapbox-parser package before 6.0.3 for N

Amaze File Manager before 3.5.1 allows attackers to obtain root privileges via shell metacharacters in a symbolic link.

Buffer overflow in FinalWire Ltd AIDA64 Engineer 6.00.5100 allows attackers to execute arbitrary code by creating a craf

Incorrect access controls in res_srtp.c in Sangoma Asterisk 13.38.1, 16.16.0, 17.9.1, and 18.2.0 and Certified Asterisk

An issue was discovered in Sangoma Asterisk 16.x before 16.16.1, 17.x before 17.9.2, and 18.x before 18.2.1 and Certifie

The Microsoft Windows Installer for Atlassian Bitbucket Server and Data Center before version 6.10.9, 7.x before 7.6.4,

An issue was discovered in Xen through 4.11.x, allowing x86 Intel HVM guest OS users to achieve unintended read/write DM

The package prismjs before 1.23.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via the prism-asciidoc,

All versions of package merge are vulnerable to Prototype Pollution via _recursiveMerge .

This affects the package com.fasterxml.jackson.dataformat:jackson-dataformat-cbor from 0 and before 2.11.4, from 2.12.0-

This affects the package pimcore/pimcore before 6.8.8. A Local FIle Inclusion vulnerability exists in the downloadCsvAct

IBM Maximo for Civil Infrastructure 7.6.2 includes executable functionality (such as a library) from a source that is ou

IBM WebSphere Application Server 8.0, 8.5, and 9.0 could allow a remote attacker to traverse directories. An attacker co