2021

No filtering of cross-site scripting (XSS) payloads in the markdown-editor in Zettlr 1.8.7 allows attackers to perform r

A cross-site scripting (XSS) vulnerability exists in Znote 0.5.2. An attacker can insert payloads, and the code executio

An issue was discovered in Cleo LexiCom 5.5.0.0. The requirement for the sender of an AS2 message to identify themselves

An issue was discovered in Cleo LexiCom 5.5.0.0. Within the AS2 message, the sender can specify a filename. This filenam

An issue was discovered in JPress v3.3.0 and below. There are XSS vulnerabilities in the template module and tag managem

The login page in the MCUsystem does not filter with special characters, which allows remote attackers can inject JavaSc

Jenkins Generic Webhook Trigger Plugin 1.72 and earlier does not configure its XML parser to prevent XML external entity

Use of hard-coded credentials vulnerability in php component in Synology Calendar before 2.4.0-0761 allows remote attack

Server-Side Request Forgery (SSRF) vulnerability in task management component in Synology Download Station before 3.8.16

Improper privilege management vulnerability in cgi component in Synology Download Station before 3.8.16-3566 allows remo

Improper neutralization of special elements used in a command ('Command Injection') vulnerability in task management com

Server-Side Request Forgery (SSRF) vulnerability in cgi component in Synology Media Server before 1.8.3-2881 allows remo

Sonatype Nexus Repository Manager 3.x before 3.31.0 allows a remote authenticated attacker to get a list of blob files a

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. A vulnerability relate

Nextcloud Android app is the Android client for Nextcloud. In versions prior to 3.15.1, a malicious application on the s

In TrendNet TW100-S4W1CA 2.3.32, it is possible to inject arbitrary JavaScript into the router's web interface via the "

In TrendNet TW100-S4W1CA 2.3.32, due to a lack of proper session controls, a threat actor could make unauthorized change

Nextcloud Android app is the Android client for Nextcloud. In versions prior to 3.16.1, a malicious app on the same devi

An XSS issue was discovered in manage_custom_field_edit_page.php in MantisBT before 2.25.2. Unescaped output of the retu

HashiCorp Nomad and Nomad Enterprise up to version 1.0.4 bridge networking mode allows ARP spoofing from other bridged t

In CiviCRM before 5.28.1 and CiviCRM ESR before 5.27.5 ESR, the CKEditor configuration form allows CSRF.

In CiviCRM before 5.21.3 and 5.22.x through 5.24.x before 5.24.3, users may be able to upload and execute a crafted PHAR

Wagtail is an open source content management system built on Django. A cross-site scripting vulnerability exists in vers

All versions of package lutils are vulnerable to Prototype Pollution via the main (merge) function.

IBM AIX 7.1 could allow a non-privileged local user to exploit a vulnerability in the trace facility to expose sensitive

In Fiyo CMS 2.0.6.1, the 'tag' parameter results in an unauthenticated XSS attack.

An authenticated Stored XSS (Cross-site Scripting) exists in the "captive.cgi" Captive Portal via the "Title of Login Pa

Elemin allows remote attackers to upload and execute arbitrary PHP code via the Themify framework (before 1.2.2) wp-cont

An Out-of-Bounds Read was discovered in arch/arm/mach-footbridge/personal-pci.c in the Linux kernel through 5.12.11 beca

A local file inclusion vulnerability was discovered in the captcha function in Monstra 3.0.4 which allows remote attacke

Quassel through 0.13.1, when --require-ssl is enabled, launches without SSL or TLS support if a usable X.509 certificate

Affected versions of Octopus Server are prone to an authenticated SQL injection vulnerability in the Events REST API bec

An out-of-bounds write issue exists in the DGN file-reading procedure in the Drawings SDK (Version 2022.4 and prior) res

An out-of-bounds read issue exists within the parsing of DXF files in the Drawings SDK (All versions prior to 2022.4) re

An out-of-bounds write issue exists in the DWG file-reading procedure in the Drawings SDK (All versions prior to 2022.4)

A use-after-free issue exists in the DGN file-reading procedure in the Drawings SDK (All versions prior to 2022.4) resul

An out-of-bounds read issue exists in the DWG file-recovering procedure in the Drawings SDK (All versions prior to 2022.

Drawings SDK (All versions prior to 2022.4) are vulnerable to an out-of-bounds read due to parsing of DWG files resultin

An out-of-bounds write issue exists in the DXF file-recovering procedure in the Drawings SDK (All versions prior to 2022

PHPMailer 6.4.1 and earlier contain a vulnerability that can result in untrusted code being called (if such code is inje

An improper check for unusual or exceptional conditions issue exists within the parsing DGN files from Drawings SDK (Ver

An issue was discovered in ConnectWise Automate before 2021.5. A blind SQL injection vulnerability exists in core agent

Trend Micro InterScan Web Security Virtual Appliance version 6.5 was found to have a reflected cross-site scripting (XSS

Improper permissions in the installer for the Intel(R) Brand Verification Tool before version 11.0.0.1225 may allow an a

An information disclosure vulnerability exists in the Ethernet/IP UDP handler functionality of EIP Stack Group OpENer 2.

This vulnerability allows remote attackers to execute arbitrary code on affected installations of GE Reason RPV311 14A03

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 10.1.

Apollos Apps is an open source platform for launching church-related apps. In Apollos Apps versions prior to 2.20.0, new

Helm is a tool for managing Charts (packages of pre-configured Kubernetes resources). In versions of helm prior to 3.6.1

In PageKit v1.0.18, a user can upload SVG files in the file upload portion of the CMS. These SVG files can contain malic