2021

Sunnet eHRD e-mail delivery task schedule’s serialization function has inadequate input object validation and restrictio

Sunnet eHRD has broken access control vulnerability, which allows a remote attacker to access account management page af

Sunnet eHRD has inadequate filtering for special characters in URLs, which allows a remote attacker to perform path trav

An issue was discovered in Jamf Pro before 10.32.0, aka PI-009921. An account can be granted incorrect privileges in res

Dell EMC Streaming Data Platform versions before 1.3 contain an Insufficient Session Expiration Vulnerability. A remote

Dell EMC Streaming Data Platform versions before 1.3 contain a SQL Injection Vulnerability. A remote malicious user may

An issue was discovered in Concrete CMS before 8.5.7. The Dashboard allows a user's password to be changed without a pro

Zoho ManageEngine SupportCenter Plus before 11016 is vulnerable to an SSRF attack in ActionExecutor.

An issue was discovered on Victure WR1200 devices through 1.0.3. The root SSH password never gets updated from its defau

An issue was discovered on Victure WR1200 devices through 1.0.3. A command injection vulnerability was found within the

An improper input validation leading to arbitrary file creation was discovered in copy method of Nexacro platform. Remot

The vulnerabilty was discovered in ActiveX module related to NeoRS remote support program. This issue allows an remote a

This issue was discovered when the ipTIME C200 IP Camera was synchronized with the ipTIME NAS. It is necessary to extrac

Trend Micro Antivirus for Mac 2021 v11 (Consumer) is vulnerable to an improper access control privilege escalation vulne

An insufficient session expiration vulnerability exists in Business-DNA Solutions GmbH’s TopEase® Platform Version <= 7.

Missing Rate Limiting in Web Applications operating on Business-DNA Solutions GmbH’s TopEase® Platform Version <= 7.1.27

Unrestricted File Upload in Web Applications operating on Business-DNA Solutions GmbH’s TopEase® Platform Version <= 7.1

Persistent Cross Site Scripting in Web Applications operating on Business-DNA Solutions GmbH’s TopEase® Platform Version

Persistent Cross Site Scripting in Web Applications operating on Business-DNA Solutions GmbH’s TopEase® Platform Version

Missing HTTPOnly flag in Web Applications operating on Business-DNA Solutions GmbH’s TopEase® Platform Version <= 7.1.27

# Vulnerability in `pygmalion`, `pygmalion-virtualenv` and `refined` themes **Description**: these themes use `print -P`

# Vulnerability in `rand-quote` and `hitokoto` plugins **Description**: the `rand-quote` and `hitokoto` fetch quotes fro

# Vulnerability in `title` function **Description**: the `title` function defined in `lib/termsupport.zsh` uses `print`

Vulnerability in dirhistory plugin Description: the widgets that go back and forward in the directory history, triggered

Lucet is a native WebAssembly compiler and runtime. There is a bug in the main branch of `lucet-runtime` affecting all v

Serva 4.4.0 allows remote attackers to cause a denial of service (daemon crash) via a TFTP read (RRQ) request, aka opcod

Pinkie 2.15 allows remote attackers to cause a denial of service (daemon crash) via a TFTP read (RRQ) request, aka opcod

@backstage/plugin-scaffolder-backend is the backend for the default Backstage software templates. In affected versions a

Sensitive information could be logged. The following products are affected: Acronis Agent (Windows, Linux, macOS) before

DLL hijacking could lead to local privilege escalation. The following products are affected: Acronis Cyber Protect 15 (W

The Stetic WordPress plugin is vulnerable to Cross-Site Request Forgery due to missing nonce validation via the stats_pa

The Contact Form With Captcha WordPress plugin is vulnerable to Cross-Site Request Forgery due to missing nonce validati

The Ninja Forms Contact Form WordPress plugin before 3.6.4 does not escape keys of the fields POST parameter, which coul

The BSK PDF Manager WordPress plugin before 3.1.2 does not validate and escape the orderby and order parameters before u

The myCred WordPress plugin before 2.3 does not validate or escape the fields parameter before using it in a SQL stateme

The Email Before Download WordPress plugin before 6.8 does not properly validate and escape the order and orderby GET pa

Wipro Holmes Orchestrator 20.4.1 (20.4.1_02_11_2020) allows remote attackers to read application log files containing se

Wipro Holmes Orchestrator 20.4.1 (20.4.1_02_11_2020) allows remote attackers to download arbitrary files, such as report

A heap-based buffer overflow was discovered in bluetoothd in BlueZ through 5.48. There isn't any check on whether there

ZrLog 2.2.2 has a remote command execution vulnerability at plugin download function, it could execute any JAR file

@joeattardi/emoji-button is a Vanilla JavaScript emoji picker component. In affected versions there are two vectors for

Backstage is an open platform for building developer portals. In affected versions the auth-backend plugin allows a mali

BaserCMS is an open source content management system with a focus on Japanese language support. In affected versions use

Improper Input Validation vulnerability in the APDU parser in the Bidirectional Communication Interface (BCI) IEC 60870-

ARK library allows attackers to execute remote code via the parameter(path value) of Ark_NormalizeAndDupPAthNameW functi

HejHome GKW-IC052 IP Camera contained a hard-coded credentials vulnerability. This issue allows remote attackers to oper

The vulnerability function is enabled when the streamer service related to the AfreecaTV communicated through web socket

An authenticated user could potentially execute code via an SQLi vulnerability in the user portal of SG UTM before versi

An improper authentication vulnerability has been reported to affect QNAP device, VioStor. If exploited, this vulnerabil

WordPress before 5.8 lacks support for the Update URI plugin header. This makes it easier for remote attackers to execut