2021

SOOIL Developments CoLtd DiabecareRS, AnyDana-i, AnyDana-A, The communication protocol of the insulin pump and AnyDana-i

SOOIL Developments CoLtd DiabecareRS, AnyDana-i ,AnyDana-A, communication protocol of the insulin pump & AnyDana-i,AnyDa

MISP 2.4.136 has XSS via a crafted URL to the app/View/Elements/global_menu.ctp user homepage favourite button.

MISP 2.4.136 has XSS via galaxy cluster element values to app/View/GalaxyElements/ajax/index.ctp. Reference types could

MISP 2.4.136 has Stored XSS in the galaxy cluster view via a cluster name to app/View/GalaxyClusters/view.ctp.

IBM Planning Analytics 2.0 could allow an attacker to obtain sensitive information due to an overly permissive CORS poli

IBM Planning Analytics 2.0 allows web pages to be stored locally which can be read by another user on the system. IBM X-

rfc822.c in Mutt through 2.0.4 allows remote attackers to cause a denial of service (mailbox unavailability) by sending

This affects the package fastify-csrf before 3.0.0. 1. The generated cookie used insecure defaults, and did not have the

The package socket.io before 2.4.0 are vulnerable to Insecure Defaults due to CORS Misconfiguration. All domains are whi

The package jointjs before 3.3.0 are vulnerable to Denial of Service (DoS) via the unsetByPath function.

Pixelimity 1.0 has cross-site request forgery via the admin/setting.php data [Password] parameter.

Bleichenbacher's attack on PKCS #1 v1.5 padding for RSA in Microchip Libraries for Applications 2018-11-26 All up to 201

HGiga EIP product lacks ineffective access control in certain pages that allow attackers to access database or perform p

fs/nfsd/nfs3xdr.c in the Linux kernel through 5.10.8, when there is an NFS export of a subdirectory of a filesystem, all

Cross-site scripting vulnerability in GROWI (v4.2 Series) versions prior to v4.2.3 allows remote attackers to inject an

Affected versions of Atlassian Confluence Server and Data Center allow remote attackers to impact the application's avai

An issue was discovered in the Source Integration plugin before 2.4.1 for MantisBT. An attacker can gain access to the S

Missing Authorization vulnerability in McAfee Agent (MA) for Windows prior to 5.7.1 allows local users to block McAfee p

The package bottle from 0 and before 0.12.19 are vulnerable to Web Cache Poisoning by using a vector called parameter cl

OpenCATS through 0.9.5-3 has multiple Cross-site Scripting (XSS) issues.

Affected versions of Atlassian Fisheye & Crucible allow remote attackers to browse local files via an Insecure Direct Ob

An issue was discovered in Quali CloudShell 9.3. An XSS vulnerability in the login page allows an attacker to craft a UR

In an EVPN/VXLAN scenario, if an IRB interface with a virtual gateway address (VGA) is configured on a PE, a traffic loo

The Junos Space Network Management Platform has been found to store shared secrets in a recoverable format that can be e

A command injection vulnerability in install package validation subsystem of Juniper Networks Junos OS that may allow a

On Juniper Networks Junos EX series, QFX Series, MX Series and SRX branch series devices, a memory leak occurs every tim

An Information Exposure vulnerability in Juniper Networks Contrail Networking allows a locally authenticated attacker ab

An Information Exposure vulnerability in J-Web of Juniper Networks Junos OS allows an unauthenticated attacker to elevat

In Juniper Networks Junos OS Evolved an attacker sending certain valid BGP update packets may cause Junos OS Evolved to

When the "Intrusion Detection Service" (IDS) feature is configured on Juniper Networks MX series with a dynamic firewall

ownCloud (Core) before 10.5 allows XSS in login page 'forgot password.'

Cross-site scripting (XSS) vulnerability in models/list-table.php in the FV Flowplayer Video Player plugin before 7.4.37

A regular expression denial of service issue has been discovered in NuGet API affecting all versions of GitLab starting

An issue has been discovered in GitLab affecting all versions starting from 12.1. Incorrect headers in specific project

An attacker could cause a Prometheus denial of service in GitLab 13.7+ by sending an HTTP request with a malformed metho

An issue has been discovered in GitLab affecting all versions starting from 12.4. The regex used for package names is wr

SolarWinds Web Help Desk 12.7.0 allows XSS via a Schedule Name.

An issue was discovered in flatCore before 2.0.0 build 139. A reflected XSS vulnerability was identified in the media_fi

An issue was discovered in flatCore before 2.0.0 build 139. A time-based blind SQL injection was identified in the selec

An issue was discovered in flatCore before 2.0.0 build 139. A stored XSS vulnerability was identified in the prefs_smtp_

An issue was discovered in flatCore before 2.0.0 build 139. A local file disclosure vulnerability was identified in the

A stored cross-site scripting (XSS) issue in Envira Gallery Lite before 1.8.3.3 allows remote attackers to inject arbitr

A stored cross-site scripting (XSS) issue in Envira Gallery Lite before 1.8.3.3 allows remote attackers to inject arbitr

In all version of Eclipse Hawkbit prior to 0.3.0M7, the HTTP 404 (Not Found) JSON response body returned by the REST API

Script injection in iOSWeb in Google Chrome on iOS prior to 84.0.4147.105 allowed a remote attacker to execute arbitrary

Elasticsearch versions 7.7.0 to 7.10.1 contain an information disclosure flaw in the async search API. Users who execute

A ZTE Smart STB is impacted by an information leak vulnerability. The device did not fully verify the log, so attackers

A vulnerability in the web-based management interface of Bosch PRAESIDEO until and including version 4.41 and Bosch PRAE

SimplCommerce 1.0.0-rc uses the Bootbox.js library, which allows creation of programmatic dialog boxes using Bootstrap m