2021

An Untrusted Pointer Dereference can occur while doing USB control transfers, if multiple requests of different standard

Key material used for TZ diag buffer encryption and other data related to log buffer is not wiped securely due to improp

Use after free issue in audio modules while removing and freeing objects during list iteration due to incorrect usage of

An issue was discovered in Acronis Cyber Protect before 15 Update 1 build 26172. There is cross-site scripting (XSS) in

An issue was discovered in MantisBT through 2.24.3. In the helper_ensure_confirmed call in manage_custom_field_update.ph

url-parse before 1.5.0 mishandles certain uses of backslash such as http:\/ and interprets the URI as a relative path.

Modules/input/Views/schedule.php in Emoncms through 10.2.7 allows XSS via the node parameter.

Livy server version 0.7.0-incubating (only) is vulnerable to a cross site scripting issue in the session name. A malicio

The slashify package 1.0.0 for Node.js allows open-redirect attacks, as demonstrated by a localhost:3000///example.com/

TweetStream 2.6.1 uses the library eventmachine in an insecure way that does not have TLS hostname validation. This allo

In voloko twitter-stream 0.1.10, missing TLS hostname validation allows an attacker to perform a man-in-the-middle attac

Jinjava before 2.5.4 allow access to arbitrary classes by calling Java methods on objects passed into a Jinjava context.

A stack-based buffer overflow in res_rtp_asterisk.c in Sangoma Asterisk before 16.16.1, 17.x before 17.9.2, and 18.x bef

A NULL pointer dereference flaw in Linux kernel versions prior to 5.11 may be seen if sco_sock_getsockopt function in ne

The Terminate Session feature in the Telegram application through 7.2.1 for Android, and through 2.4.7 for Windows and U

Yeastar NeoGate TG400 91.3.0.3 devices are affected by Directory Traversal. An authenticated user can decrypt firmware a

A Server-side request forgery (SSRF) vulnerability in the ProductConfig servlet in Zoho ManageEngine ADSelfService Plus

A CWE-352: Cross-Site Request Forgery vulnerability exists in PowerLogic ION7400, ION7650, ION83xx/84xx/85xx/8600, ION86

Buffer overflow in the BMC firmware for some Intel(R) Server Boards, Server Systems and Compute Modules before version 2

SSRF in the document conversion component of Webware Webdesktop 5.1.15 allows an attacker to read all files from the ser

ModernFlow before 1.3.00.208 does not constrain web-page access to members of a security group, as demonstrated by the S

ownCloud Server 10.x before 10.3.1 allows an attacker, who has one outgoing share from a victim, to access any version o

In the ownCloud application before 2.15 for Android, the lock protection mechanism can be bypassed by moving the system

An issue was discovered in ownCloud before 10.4. An attacker can bypass authentication on a password-protected image by

Chamilo 1.11.14 allows XSS via a main/calendar/agenda_list.php?type= URI.

Askey RTF8115VW BR_SV_g11.11_RTF_TEF001_V6.54_V014 devices allow injection of a Host HTTP header.

Askey RTF8115VW BR_SV_g11.11_RTF_TEF001_V6.54_V014 devices allow cgi-bin/te_acceso_router.cgi curWebPage XSS.

An issue was discovered in res_pjsip_session.c in Digium Asterisk through 13.38.1; 14.x, 15.x, and 16.x through 16.16.0;

A buffer overflow in res_pjsip_diversion.c in Sangoma Asterisk versions 13.38.1, 16.15.1, 17.9.1, and 18.1.1 allows remo

Pi-hole 5.0, 5.1, and 5.1.1 allows XSS via the Options header to the admin/ URI. A remote user is able to inject arbitra

Pi-hole 5.0, 5.1, and 5.1.1 allows Session Fixation. The application does not generate a new session cookie after the us

PressBooks 5.17.3 contains a cross-site scripting (XSS). Stored XSS can be submitted via the Book Info's Long Descriptio

Opencast is a free, open-source platform to support the management of educational audio and video content. In Opencast b

HMI/SCADA iFIX (Versions 6.1 and prior) allows a local authenticated user to modify system-wide iFIX configurations thro

All versions of package reportlab are vulnerable to Server-side Request Forgery (SSRF) via img tags. In order to reduce

IBM Maximo for Civil Infrastructure 7.6.2 is vulnerable to cross-site scripting. This vulnerability allows users to embe

IBM Maximo for Civil Infrastructure 7.6.2 could allow a user to obtain sensitive information due to insecure storeage of

IBM Maximo for Civil Infrastructure 7.6.2 is vulnerable to cross-site scripting. This vulnerability allows users to embe

IBM Jazz Reporting Service 6.0.6.1, 7.0, 7.0.1, and 7.0.2 is vulnerable to cross-site scripting. This vulnerability allo

HMI/SCADA iFIX (Versions 6.1 and prior) allows a local authenticated user to modify system-wide iFIX configurations thro

In Endalia Selection Portal before 4.205.0, an Insecure Direct Object Reference (IDOR) allows any authenticated user to

SQL injection in the expertise parameter in search_result.php in Doctor Appointment System v1.0 allows an authenticated

Traefik before 2.4.5 allows the loading of IFRAME elements from other domains.

Cleartext transmission of sensitive information in Agora Video SDK prior to 3.1 allows a remote attacker to obtain acces

Multiple vulnerabilities in the Admin portal of Cisco Identity Services Engine (ISE) could allow an authenticated, remot

Multiple vulnerabilities in the Admin portal of Cisco Identity Services Engine (ISE) could allow an authenticated, remot

A vulnerability in the SSH service of the Cisco StarOS operating system could allow an unauthenticated, remote attacker

A vulnerability in Cisco Webex Meetings Desktop App and Webex Productivity Tools for Windows could allow an authenticate

A vulnerability in the web-based interface of Cisco Webex Meetings could allow an unauthenticated, remote attacker to co

The lineage endpoint of the deprecated Experimental API was not protected by authentication in Airflow 2.0.0. This allow