2021

In sourcecodetester Engineers Online Portal as of 10-21-21, an attacker can manipulate the Host header as seen by the we

OS Command injection vulnerability in function link in Filesystem.php in Laravel Framework before 5.8.17.

Zoho ManageEngine PAM360 before build 5303 allows attackers to modify a few aspects of application state because of a fi

Zoho ManageEngine Access Manager Plus before 4203 allows anyone to view a few data elements (e.g., access control detail

Zoho ManageEngine ServiceDesk Plus MSP before 10.5 Build 10534 is vulnerable to unauthenticated remote code execution du

OS Command Injection vulnerability in the wirelessConnect handler of Abode iota All-In-One Security Kit allows an attack

Opmantek Open-AudIT Community 4.2.0 (Fixed in 4.3.0) is affected by a Cross Site Scripting (XSS) vulnerability. If a bad

A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from

A crafted URI sent to httpd configured as a forward proxy (ProxyRequests on) can cause a crash (NULL pointer dereference

Improper Input Validation vulnerability in Parquet-MR of Apache Parquet allows an attacker to DoS by malicious Parquet f

An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. It is possible to us

Thinfinity VirtualUI before 3.0 allows a malicious actor to enumerate users registered in the OS (Windows) through the /

Gurock TestRail before 7.2.4 mishandles HTML escaping.

The SyncThru Web Service on Samsung SCX-6x55X printers allows an attacker to gain access to a list of SMB users and clea

Mbed TLS before 3.0.1 has a double free in certain out-of-memory conditions, as demonstrated by an mbedtls_ssl_set_sessi

Chain Sea ai chatbot system’s file upload function has insufficient filtering for special characters in URLs, which allo

Chain Sea ai chatbot backend has improper filtering of special characters in URL parameters, which allows a remote attac

Chain Sea ai chatbot system’s specific file download function has path traversal vulnerability. The function has imprope

4MOSAn GCB Doctor’s file upload function has improper user privilege control. A remote attacker can upload arbitrary fil

vim is vulnerable to Heap-based Buffer Overflow

SuiteCRM before 7.12.2 and 8.x before 8.0.1 allows authenticated SQL injection via the Tooltips action in the Project mo

Apache PLC4X - PLC4C (Only the C language implementation was effected) was vulnerable to an unsigned integer underflow f

Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursio

livehelperchat is vulnerable to Cross-Site Request Forgery (CSRF)

snipe-it is vulnerable to Cross-Site Request Forgery (CSRF)

Incomplete string comparison vulnerability exits in cvxopt.org cvxop <= 1.2.6 in APIs (cvxopt.cholmod.diag, cvxopt.cholm

Buffer Overflow Vulnerability exists in ajaxsoundstudio.com n Pyo < 1.03 in the Server_debug function, which allows remo

Buffer overflow in ajaxsoundstudio.com Pyo &lt and 1.03 in the Server_jack_init function. which allows attackers to cond

Null pointer reference in CMS_Conservative_increment_obj in RaRe-Technologies bounter version 1.01 and 1.10, allows atta

Buffer overflow in the array_from_pyobj function of fortranobject.c in NumPy < 1.19, which allows attackers to conduct a

Null Pointer Dereference vulnerability exists in numpy.sort in NumPy &lt and 1.19 in the PyArray_DescrNew function due t

This affects versions of the package unisharp/laravel-filemanager before 2.6.2. The upload() function does not sufficien

This affects the package latte/latte before 2.10.6. There is a way to bypass allowFunctions that will affect the securit

All versions of package http-server-node are vulnerable to Directory Traversal via use of --path-as-is.

All versions of package dojo are vulnerable to Prototype Pollution via the setObject function.

message_bus is a messaging bus for Ruby processes and web clients. In versions prior to 3.3.7 users who deployed message

jsx-slack is a library for building JSON objects for Slack Block Kit surfaces from JSX. In versions prior to 4.5.1 users

An incomplete string comparison in the numpy.core component in NumPy before 1.22.0 allows attackers to trigger slightly

A Buffer Overflow vulnerability exists in NumPy 1.9.x in the PyArray_NewFromDescr_int function of ctors.c when specifyin

A flaw was found in xorg-x11-server in versions before 21.1.2 and before 1.20.14. An out-of-bounds access can occur in t

A flaw was found in xorg-x11-server in versions before 21.1.2 and before 1.20.14. An out-of-bounds access can occur in t

A flaw was found in xorg-x11-server in versions before 21.1.2 and before 1.20.14. An out-of-bounds access can occur in t

A flaw was found in xorg-x11-server in versions before 21.1.2 and before 1.20.14. An out-of-bounds access can occur in t

TCMAN GIM does not perform an authorization check when trying to access determined resources. A remote attacker could ex

TCMAN GIM is affected by an open redirect vulnerability. This vulnerability allows the redirection of user navigation to

TCMAN GIM is vulnerable to a lack of authorization in all available webservice methods listed in /PC/WebService.asmx. Th

TCMAN GIM is vulnerable to a SQL injection vulnerability inside several available webservice methods in /PC/WebService.a

IBM Business Automation Workflow 18.0, 19.0, 20,0 and 21.0 and IBM Business Process Manager 8.5 and 8.6 are vulnerable t

Mattermost 6.0 and earlier fails to sufficiently validate parameters during post creation, which allows authenticated at

Mattermost 6.0 and earlier fails to sufficiently validate the email address during registration, which allows attackers