2021

Nagios XI before 5.8.5 has Incorrect Permission Assignment for migrate.php.

Remote Code Execution vulnerability in Micro Focus ArcSight Enterprise Security Manager (ESM) product, affecting version

There is an unauthorized access vulnerability in the CMS Enterprise Website Construction System 5.0. Attackers can use t

aurelia-path is part of the Aurelia platform and contains utilities for path manipulation. There is a prototype pollutio

An improper access control vulnerability in SMA100 allows a remote unauthenticated attacker to bypass the path traversal

The set_user extension module before 3.0.0 for PostgreSQL allows ProcessUtility_hook bypass via set_config.

The Authentication API in Ping Identity PingFederate before 10.3 mishandles certain aspects of external password managem

Zoho ManageEngine ADManager Plus version 7110 and prior is vulnerable to unrestricted file upload, leading to remote cod

Unauthenticated Privilege Escalation vulnerability in WordPress uListing plugin (versions <= 2.0.5). Possible if WordPre

The Podlove Podcast Publisher WordPress plugin before 3.5.6 contains a 'Social & Donations' module (not activated by def

Zoho ManageEngine ADManager Plus before 7111 is vulnerable to unrestricted file which leads to Remote code execution.

An issue was discovered in SKALE sgxwallet 1.58.3. The provided input for ECALL 14 triggers a branch in trustedEcdsaSign

The network address administrative settings web portal for the Zoom on-premise Meeting Connector before version 4.6.360.

The Zoom Client for Meetings for Windows in all versions before 5.3.0 fails to properly validate the certificate informa

An issue was discovered in Concrete CMS through 8.5.5. Path Traversal leading to RCE via external form by adding a regul

Webauthn Framework 3.3.x before 3.3.4 has Incorrect Access Control. An attacker that controls a user's system is able to

A command injection vulnerability has been reported to affect QNAP device running QVR. If exploited, this vulnerability

A command injection vulnerability has been reported to affect QNAP device running QVR. If exploited, this vulnerability

An improper access control vulnerability in GitHub Enterprise Server allowed a workflow job to execute in a self-hosted

An issue was discovered in Concrete CMS through 8.5.5. Arbitrary File deletion can occur via PHAR deserialization in is_

Privilege escalation in 'upload.php' in FrogCMS SentCMS v0.9.5 allows attacker to execute arbitrary code via crafted php

IBM Security Guardium 11.3 contains hard-coded credentials, such as a password or cryptographic key, which it uses for i

An information disclosure vulnerability exists in the WiFi Smart Mesh functionality of D-LINK DIR-3040 1.13B03. A specia

When sending data to an MQTT server, libcurl <= 7.73.0 and 7.78.0 could in some circumstances erroneously keep a pointer

Improper Access Control in Citrix ShareFile storage zones controller before 5.11.20 may allow an unauthenticated attacke

The vCenter Server contains an arbitrary file upload vulnerability in the Analytics service. A malicious actor with netw

A vulnerability in the Control and Provisioning of Wireless Access Points (CAPWAP) protocol processing of Cisco IOS XE S

A vulnerability in the vDaemon process in Cisco IOS XE SD-WAN Software could allow an unauthenticated, remote attacker t

A vulnerability in the authentication, authorization, and accounting (AAA) function of Cisco IOS XE Software could allow

Talend ESB Runtime in all versions from 5.1 to 7.3.1-R2021-09, 7.2.1-R2021-09, 7.1.1-R2021-09, has an unauthenticated Jo

Edgecore ECS2020 Firmware 1.0.0.0 devices allow Unauthenticated Command Injection via the command1 HTTP header to the /E

Zoho ManageEngine ADManager Plus version 7110 and prior allows account takeover via SSO.

Zoho ManageEngine ADManager Plus version 7110 and prior has a Post-Auth OS command injection vulnerability.

A command injection vulnerability in the web server of some Hikvision product. Due to the insufficient input validation,

In Halibut versions prior to 4.4.7 there is a deserialisation vulnerability that could allow remote code execution on sy

ManageEngine ADSelfService Plus before 6112 is vulnerable to domain user account takeover.

Zoho ManageEngine Desktop Central before build 10.0.683 allows unauthenticated command injection due to improper handlin

In GetTimeStampAndPkt of DumpstateDevice.cpp, there is a possible out of bounds write due to an incorrect bounds check.

A flaw was found in Red Hat DataGrid 8.x (8.0.0, 8.0.1, 8.1.0 and 8.1.1) and Infinispan (10.0.0 through 12.0.0). An atta

An SQL injection vulnerability exists in Wuzhi CMS v4.1.0 via the KeyValue parameter in coreframe/app/order/admin/index.

The Support Board WordPress plugin before 3.3.4 does not escape multiple POST parameters (such as status_code, departmen

The OMGF WordPress plugin before 4.5.4 does not escape or validate the handle parameter of the REST API, which allows un

Teleport before 4.4.11, 5.x before 5.2.4, 6.x before 6.2.12, and 7.x before 7.1.1 allows forgery of SSH host certificate

static/main-preload.js in Boost Note through 0.22.0 allows remote command execution. A remote attacker may send a crafte

Properly formatted POST requests to multiple resources on the HTTP and HTTPS web servers of the Digi PortServer TS 16 Ra

In MISP before 2.4.148, app/Lib/Export/OpendataExport.php mishandles parameter data that is used in a shell_exec call.

An elevated privileges issue related to Spring MVC calls impacts Code Insight v7.x releases up to and including 2020 R1

XSS Hunter Express before 2021-09-17 does not properly enforce authentication requirements for paths.

Apache Shiro before 1.8.0, when using Apache Shiro with Spring Boot, a specially crafted HTTP request may cause an authe

A use after free can occur due to improper validation of P2P device address in PD Request frame in Snapdragon Auto, Snap