2021

Microsoft SharePoint Server Spoofing Vulnerability

Windows DNS Query Information Disclosure Vulnerability

RailsAdmin (aka rails_admin) before 1.4.3 and 2.x before 2.0.2 allows XSS via nested forms.

The Elementor Contact Form DB plugin before 1.6 for WordPress allows CSRF via backend admin pages.

OpenText Carbonite Server Backup Portal before 8.8.7 allows XSS by an authenticated user via policy creation.

In CLA-Assistant, versions before 2.8.5, due to improper access control an authenticated user could access API endpoints

SAP EPM Add-in for Microsoft Office, version - 1010 and SAP EPM Add-in for SAP Analysis Office, version - 2.8, allows an

The BW Database Interface does not perform necessary authorization checks for an authenticated user, resulting in escala

SAP Banking Services (Generic Market Data) does not perform necessary authorization checks for an authenticated user, re

SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated PCX file received from untrusted sources

SAP GUI for Windows, version - 7.60, allows an attacker to spoof logon credentials for Application Server ABAP backend s

SAP BusinessObjects Business Intelligence platform, versions 410, 420, allows an authenticated attacker to inject malici

SAP Commerce Cloud, versions - 1808, 1811, 1905, 2005, 2011, allows an authenticated attacker to include invalidated dat

IBM API Connect 5.0.0.0 through 5.0.8.10 is vulnerable to stored cross-site scripting. This vulnerability allows users t

IBM Workload Automation 9.5 stores the server path in URLs that could aid in further attacks against the system. IBM X-F

IBM Workload Automation 9.5 stores sensitive information in HTML comments that could aid in further attacks against the

REDCap 10.3.4 contains a XSS vulnerability in the ToDoList function with parameter sort. The information submitted by th

A flaw was found in all released versions of m2crypto, where they are vulnerable to Bleichenbacher timing attacks in the

In Pillow before 8.1.0, SGIRleDecode has a 4-byte buffer over-read when decoding crafted SGI RLE image files because off

OX App Suite through 7.10.4 allows XSS via the app loading mechanism (the PATH_INFO to the /appsuite URI).

OX App Suite through 7.10.3 allows SSRF because GET requests are sent to arbitrary domain names with an initial autoconf

In onCreate of SlicePermissionActivity.java, there is a possible misleading string displayed due to improper input valid

In enforceDumpPermissionForPackage of ActivityManagerService.java, there is a possible way to determine if a package is

In is_device_locked and set_device_locked of keystore_keymaster_enforcement.h, there is a possible bypass of lockscreen

In WAVSource::read of WAVExtractor.cpp, there is a possible out of bounds write due to an integer overflow. This could l

In ElementaryStreamQueue::dequeueAccessUnitH264() of ESQueue.cpp, there is a possible out of bounds write due to a missi

In onCreate of grantCredentialsPermissionActivity, there is a confused deputy. This could lead to local information disc

In ReadLogicalParts of basicmbr.cc, there is a possible out of bounds write due to a missing bounds check. This could le

In several functions of GlobalScreenshot.java, there is a possible permission bypass due to an unsafe PendingIntent. Thi

In ged, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of pr

In tun_get_user of tun.c, there is possible memory corruption due to a use after free. This could lead to local escalati

Cross-site request forgery (CSRF) in admin/global/manage.php in WDJA CMS 1.5 allows remote attackers to conduct cross-si

Redcarpet is a Ruby library for Markdown processing. In Redcarpet before version 3.5.1, there is an injection vulnerabil

Certificate validation in node-sass 2.0.0 to 4.14.1 is disabled when requesting binaries even if the user is not specify

IBM MQ Appliance 9.2 CD and 9.2 LTS is vulnerable to a denial of service, caused by a buffer overflow. A remote attacker

Opera Mini for Android below 53.1 displays URL left-aligned in the address field. This allows a malicious attacker to cr

python-cryptography 3.2 is vulnerable to Bleichenbacher timing attacks in the RSA decryption API, via timed processing o

In the 3.1.3.64296 and lower version of 360F5, the third party can trigger the device to send a deauth frame by construc

An Incorrect Access Control issue was discovered in K7Computing K7AntiVirus Premium 15.01.00.53.

A Memory Leak issue was discovered in K7Computing K7AntiVirus Premium 15.01.00.53.

An Incorrect Access Control issue was discovered in K7Computing K7AntiVirus Premium 15.01.00.53.

A Memory Leak issue was discovered in K7Computing K7AntiVirus Premium 15.01.00.53.

Stored XSS was discovered in the tree mode of jsoneditor before 9.0.2 through injecting and executing JavaScript.

XSS exists in JIZHICMS 1.7.1 via index.php/Error/index?msg={XSS] to Home/c/ErrorController.php.

XSS exists in JIZHICMS 1.7.1 via index.php/Wechat/checkWeixin?signature=1&echostr={XSS] to Home/c/WechatController.php.

A stack overflow vulnerability in Aleth Ethereum C++ client version <= 1.8.0 using a specially crafted a config.json fil

Versions of Apache DolphinScheduler prior to 1.3.2 allowed an ordinary user under any tenant to override another users p

Reflected XSS in Quest Policy Authority 8.1.2.200 allows remote attackers to inject malicious code into the browser via

Reflected XSS in Quest Policy Authority 8.1.2.200 allows remote attackers to inject malicious code into the browser via

Reflected XSS in Quest Policy Authority 8.1.2.200 allows remote attackers to inject malicious code into the browser via