2021

Missing synchronization vulnerability in GOT2000 series GT27 model communication driver versions 01.19.000 through 01.39

A reflected cross-site scripting vulnerability exists in TCExam <= 14.8.4. The paths provided in the f, d, and dir param

A reflected cross-site scripting vulnerability exists in TCExam <= 14.8.3. The paths provided in the f, d, and dir param

XML external entity (XXE) vulnerability affecting certain versions of a Mule runtime component that may affect CloudHub,

A vulnerability in File Transfer Solution of Raonwiz could allow arbitrary command execution as the result of viewing a

A flaw was found in the USB redirector device emulation of QEMU in versions prior to 6.1.0-rc2. It occurs when dropping

A lack of CPU resource in the Linux kernel tracing module functionality in versions prior to 5.14-rc3 was found in the w

Fixed a bypass for a reflected cross-site scripting vulnerability affecting OAuth-enabled instances of Mattermost.

In certain Progress MOVEit Transfer versions before 2021.0.3 (aka 13.0.3), SQL injection in the MOVEit Transfer web appl

An issue was discovered in GPAC 1.0.1. There is a heap-based buffer overflow in the function gp_rtp_builder_do_tx3g func

An issue was discovered in Bento4 through v1.6.0-636. A NULL pointer dereference exists in the AP4_DescriptorFinder::Tes

An issue was discovered in Bento4 through v1.6.0-636. A NULL pointer dereference exists in the function AP4_StszAtom::Wr

The NewsPlugin WordPress plugin is vulnerable to Cross-Site Request Forgery via the handle_save_style function found in

Neo4j through 3.4.18 (with the shell server enabled) exposes an RMI service that arbitrarily deserializes Java objects,

A Denial-of-Service (DoS) vulnerability was discovered in F-Secure Atlant whereby the SAVAPI component used in certain F

Showing the legitimate URL in the address bar while loading the content from other domain. This makes the user believe t

Acronis True Image prior to 2021 Update 4 for Windows, Acronis True Image prior to 2021 Update 5 for Mac, Acronis Agent

Acronis True Image prior to 2021 Update 4 for Windows allowed local privilege escalation due to DLL hijacking.

Acronis True Image prior to 2021 Update 4 for Windows and Acronis True Image prior to 2021 Update 5 for macOS allowed an

Acronis True Image prior to 2021 Update 4 for Windows allowed local privilege escalation due to improper soft link handl

Acronis True Image prior to 2021 Update 5 for Windows allowed local privilege escalation due to insecure folder permissi

Acronis True Image prior to 2021 Update 4 for Windows allowed local privilege escalation due to improper soft link handl

Multiple low security issues were discovered and fixed in a security audit of Mozilla VPN 2.x branch as part of a 3rd pa

Mozilla developers reported memory safety bugs present in Firefox 89. Some of these bugs showed evidence of memory corru

Mozilla developers reported memory safety bugs present in code shared between Firefox and Thunderbird. Some of these bug

Through a series of DOM manipulations, a message, over which the attacker had control of the text but not HTML or format

When network partitioning was enabled, e.g. as a result of Enhanced Tracking Protection settings, a TLS error page would

Password autofill was enabled without user interaction on insecure websites on Firefox for Android. This was corrected t

A use-after-free vulnerability was found via testing, and traced to an out-of-date Cairo library. Updating the library r

If a user had granted a permission to a webpage and saved that grant, any webpage running on the same host - irrespectiv

A malicious webpage could have triggered a use-after-free, memory corruption, and a potentially exploitable crash. *This

If Thunderbird was configured to use STARTTLS for an IMAP connection, and an attacker injected IMAP server responses pri

Improper access control vulnerability in Smart Touch Call prior to version 1.0.0.5 allows arbitrary webpage loading in w

Improper access control vulnerability in SmartThings prior to version 1.7.67.25 allows untrusted applications to cause l

Improper access control vulnerability in SmartThings prior to version 1.7.67.25 allows untrusted applications to cause a

Unprotected component vulnerability in Samsung Internet prior to version 14.2 allows untrusted application to access int

An IV reuse vulnerability in keymaster prior to SMR AUG-2021 Release 1 allows decryption of custom keyblob with privileg

A use after free vulnerability in conn_gadget driver prior to SMR AUG-2021 Release 1 allows malicious action by an attac

A vulnerability in the web-based interface allows an unauthenticated remote attacker to trigger actions on an affected s

An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.0. It was possible to exploit a sto

Improper access control in GitLab EE versions 13.11.6, 13.12.6, and 14.0.2 allows users to be created via single sign on

A unsafe deserialization vulnerability exists in the ComponentModel Profile.FromFile() functionality of CODESYS GmbH COD

A ZTE's product of the transport network access layer has a security vulnerability. Because the system does not sufficie

ZTE's big video business platform has two reflective cross-site scripting (XSS) vulnerabilities. Due to insufficient inp

Skytable is an open source NoSQL database. In versions prior to 0.6.4 an incorrect check of return value of the accept f

CMS Made Simple (CMSMS) 2.2.14 allows stored XSS via the Extensions > Fie Picker..

OneNav beta 0.9.12 allows XSS via the Add Link feature. NOTE: the vendor's position is that there intentionally is not a

In version 6.5 Microchip MiWi software and all previous versions including legacy products, the stack is validating only

In version 6.5 of Microchip MiWi software and all previous versions including legacy products, there is a possibility of

The REST API in Planview Spigit 4.5.3 allows remote unauthenticated attackers to query sensitive user accounts data, as