2021

A vulnerability found in udisks2. This flaw allows an attacker to input a specially crafted image file/USB leading to ke

Some Huawei products use the OpenHpi software for hardware management. A function that parses data returned by OpenHpi c

youtube-php-mirroring (last update Jun 9, 2017) is affected by a Cross Site Scripting (XSS) vulnerability in file ytprox

issabelPBX version 2.11 is affected by a Cross Site Scripting (XSS) vulnerability. In file page.backup_restore.php, the

Workerman-ThinkPHP-Redis (last update Mar 16, 2018) is affected by a Cross Site Scripting (XSS) vulnerability. In file C

twmap v2.91_v4.33 is affected by a Cross Site Scripting (XSS) vulnerability. In file list.php, the exit function will te

phpWhois (last update Jun 30 2021) is affected by a Cross Site Scripting (XSS) vulnerability. In file example.php, the e

The My Calendar WordPress plugin before 3.2.18 does not sanitise and escape the callback parameter of the mc_post_lookup

The Smash Balloon Social Post Feed WordPress plugin before 4.0.1 did not have any privilege or nonce validation before s

The Check & Log Email WordPress plugin before 1.0.4 does not escape the d parameter before outputting it back in an attr

The Media-Tags WordPress plugin through 3.2.0.2 does not sanitise and escape any of its Labels settings, which could all

The Popup Anything WordPress plugin before 2.0.4 does not escape the Link Text and Button Text fields of Popup, which co

The Registrations for the Events Calendar WordPress plugin before 2.7.5 does not escape the v parameter before outputtin

The Bulk Datetime Change WordPress plugin before 1.12 does not enforce capability checks which allows users with Contrib

The Stylish Cost Calculator WordPress plugin before 7.0.4 does not have any authorisation and CSRF checks on some of its

The Shop Page WP WordPress plugin before 1.2.8 does not sanitise and escape some of the Product fields, allowing high pr

The WP RSS Aggregator WordPress plugin before 4.19.2 does not properly sanitise and escape the URL to Blacklist field, a

The GenerateBlocks WordPress plugin before 1.4.0 does not validate the generateblocks/container block's tagName attribut

The URL Shortify WordPress plugin before 1.5.1 does not have CSRF check in place when bulk-deleting links or groups, whi

The About Author Box WordPress plugin before 1.0.2 does not sanitise and escape the Social Profiles field values before

The myCred WordPress plugin before 1.7.8 does not sanitise and escape the user parameter before outputting it back in th

An issue was discovered in bluetoothd in BlueZ through 5.48. The vulnerability lies in the handling of a SVC_ATTR_REQ by

In PHP versions 7.3.x below 7.3.33, 7.4.x below 7.4.26 and 8.0.x below 8.0.13, certain XML parsing functions, like simpl

S3Scanner before 2.0.2 allows Directory Traversal via a crafted bucket, as demonstrated by a <Key>../ substring in a Lis

janus-gateway is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

This affects all versions of package html-to-csv. When there is a formula embedded in a HTML page, it gets accepted with

A vulnerability affecting F-Secure antivirus engine was discovered whereby unpacking UPX file can lead to denial-of-serv

Multiple Authenticated Reflected Cross-Site Scripting (XSS) vulnerabilities in WordPress Awesome Support plugin (version

Authenticated Stored Cross-Site Scripting (XSS) vulnerability discovered in WordPress Floating Social Media Icon plugin

A local administrator could prevent the HMPA service from starting despite tamper protection using an unquoted service p

In Keepalived through 2.2.4, the D-Bus policy does not sufficiently restrict the message destination, allowing any user

Symfony/Serializer handles serializing and deserializing data structures for Symfony, a PHP framework for web and consol

Symfony/SecurityBundle is the security system for Symfony, a PHP framework for web and console applications and a set of

Symfony/Http-Kernel is the HTTP kernel component for Symfony, a PHP framework for web and console applications and a set

An issue was discovered in VxWorks 6.9 through 7. In the IKE component, a specifically crafted packet may lead to readin

WordPress Hide My WP plugin (versions <= 6.2.3) can be deactivated by any unauthenticated user. It is possible to retrie

Redash is a package for data visualization and sharing. In versions 10.0 and priorm the implementation of URL-loading da

Redash is a package for data visualization and sharing. In Redash version 10.0 and prior, the implementation of Google L

A Server-Side Request Forgery (SSRF) vulnerability in the EPPUpdateService of Bitdefender Endpoint Security Tools allows

A Server-Side Request Forgery (SSRF) vulnerability in the EPPUpdateService component of Bitdefender Endpoint Security To

An authorized user may trigger an invariant which may result in denial of service or server exit if a relevant aggregati

Cross-site scripting vulnerability in rwtxt versions prior to v1.8.6 allows a remote attacker to inject an arbitrary scr

Improper neutralization of HTTP request headers for scripting syntax vulnerability in the Web GUI of RTX830 Rev.15.02.17

Cross-site script inclusion vulnerability in the Web GUI of RTX830 Rev.15.02.17 and earlier, NVR510 Rev.15.01.18 and ear

Cross-site request forgery (CSRF) vulnerability in EC-CUBE 2 series 2.11.0 to 2.17.1 allows a remote attacker to hijack

Improper access control in Management screen of EC-CUBE 2 series 2.11.2 to 2.17.1 allows a remote authenticated attacker

Cross-site scripting vulnerability in Booking Package - Appointment Booking Calendar System versions prior to 1.5.11 all

A carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to the Denounce

Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability

Windows 10 Update Assistant Elevation of Privilege Vulnerability