2021

A cross-site request forgery (CSRF) vulnerability in Jenkins Claim Plugin 2.18.1 and earlier allows attackers to change

Jenkins Claim Plugin 2.18.1 and earlier does not escape the user display name, resulting in a stored cross-site scriptin

Jenkins Repository Connector Plugin 2.0.2 and earlier does not escape parameter names and descriptions for past builds,

Jenkins Active Choices Plugin 2.5.2 and earlier does not escape reference parameter values, resulting in a stored cross-

A stored-self XSS exists in LightCMS v1.3.4, allowing an attacker to execute HTML or JavaScript code in a vulnerable Tit

Weak encryption in the Quick Pairing mode in the eWeLink mobile application (Android application V4.9.2 and earlier, iOS

Cross-site scripting vulnerability in SolarView Compact SV-CPT-MC310 prior to Ver.6.5 allows an attacker to inject an ar

Improper access control vulnerability in SolarView Compact SV-CPT-MC310 prior to Ver.6.5 allows an authenticated attacke

Exposure of information through directory listing in SolarView Compact SV-CPT-MC310 prior to Ver.6.5 allows an authentic

A flaw was found in mupdf 1.18.0. Double free of object during linearization may lead to memory corruption and other pot

Brave is an open source web browser with a focus on privacy and security. In Brave versions 1.17.73-1.20.103, the CNAME

A flaw was found in Red Hat Satellite. The BMC interface exposes the password through the API to an authenticated local

A flaw was found in Red Hat 3scale API Management Platform 2. The 3scale backend does not perform preventive handling on

A flaw was found in libebml before 1.4.2. A heap overflow bug exists in the implementation of EbmlString::ReadData and E

A flaw was found in jasper before 2.0.25. A null pointer dereference in jp2_decode in jp2_dec.c may lead to program cras

In Directus 8.x through 8.8.1, an attacker can discover whether a user is present in the database through the password r

In Directus 8.x through 8.8.1, an attacker can learn sensitive information such as the version of the CMS, the PHP versi

Nextcloud Deck before 1.0.2 suffers from an insecure direct object reference (IDOR) vulnerability that permits users wit

A local authenticated buffer overflow vulnerability was discovered in Aruba ClearPass Policy Manager version(s): Prior t

A remote authenticated SQL Injection vulnerabilitiy was discovered in Aruba ClearPass Policy Manager version(s): Prior t

A remote reflected cross-site scripting (XSS) vulnerability was discovered in Aruba ClearPass Policy Manager version(s):

A remote unauthenticated stored cross-site scripting (XSS) vulnerability was discovered in Aruba ClearPass Policy Manage

A flaw was found in PostgreSQL in versions before 13.2. This flaw allows a user with SELECT privilege on one column to c

A flaw was found in Undertow. A regression in the fix for CVE-2020-10687 was found. HTTP request smuggling related to CV

A remote authenticated SQL Injection vulnerabilitiy was discovered in Aruba ClearPass Policy Manager version(s): Prior t

Applications using the “Sensitive Headers” functionality in Spring Cloud Netflix Zuul 2.2.6.RELEASE and below may be vul

fastadmin V1.0.0.20200506_beta contains a cross-site scripting (XSS) vulnerability which may allow an attacker to obtain

IBM Planning Analytics 2.0 could allow a remote authenticated attacker to obtain information about an organization's int

Polaris Office v9.102.66 is affected by a divide-by-zero error in PolarisOffice.exe and EngineDLL.dll that may cause a l

An issue was discovered in RouterNanoHTTPD.java in NanoHTTPD through 2.3.1. The GeneralHandler class implements a basic

An issue was discovered in libxls before and including 1.6.1 when reading Microsoft Excel files. A NULL pointer derefere

An issue was discovered in netplex json-smart-v1 through 2015-10-23 and json-smart-v2 through 2.4. An exception is throw

Chatbox is affected by cross-site scripting (XSS). An attacker has to upload any XSS payload with SVG, XML file in Chatb

The CIRA Canadian Shield app before 4.0.13 for iOS lacks SSL Certificate Validation.

Keybase Desktop Client before 5.6.0 on Windows and macOS, and before 5.6.1 on Linux, allows an attacker to obtain potent

The MessageBundleWhiteList class of atlassian-gadgets before version 4.2.37, from version 4.3.0 before 4.3.14, from vers

The CachingResourceDownloadRewriteRule class in Jira Server and Jira Data Center before version 8.5.11, from 8.6.0 befor

The ConfluenceResourceDownloadRewriteRule class in Confluence Server and Confluence Data Center before version 6.13.18,

MyBB before 1.8.25 allows stored XSS via nested [email] tags with MyCode (aka BBCode).

A stored XSS issue exists in Appspace 6.2.4. After a user is authenticated and enters an XSS payload under the groups se

Genymotion Desktop through 3.2.0 leaks the host's clipboard data to the Android application by default. NOTE: the vendor

"Tasks" application version before 9.7.3 is affected by insecure permissions. The VoiceCommandActivity application compo

In webERP 4.15, the ManualContents.php file allows users to specify the "Language" parameter, which can lead to local fi

The Contact page in Monica 2.19.1 allows stored XSS via the Nickname field.

The Contact page in Monica 2.19.1 allows stored XSS via the Description field.

The Contact page in Monica 2.19.1 allows stored XSS via the Last Name field.

The Contact page in Monica 2.19.1 allows stored XSS via the Middle Name field.

The Contact page in Monica 2.19.1 allows stored XSS via the First Name field.

Automated Logic Corporation (ALC) WebCTRL System 6.5 and prior allows remote attackers to execute any JavaScript code vi

Out of bound read access in hypervisor due to an invalid read access attempt by passing invalid addresses in Snapdragon