2021

A Remote Code Execution (RCE) vulnerability exists in emlog 5.3.1 via content/plugins.

Cross-site scripting (XSS) vulnerability in /application/controller/admin/theme.php in LimeSurvey 3.6.2+180406 allows re

An issue was discovered in UiPath App Studio 21.4.4. There is a persistent XSS vulnerability in the file-upload function

An issue was discovered in UiPath Assistant 21.4.4. User-controlled data supplied to the --process-start argument of the

UiPath Assistant 21.4.4 will load and execute attacker controlled data from the file path supplied to the --dev-widget a

Opencast is an Open Source Lecture Capture & Video Management for Education. Opencast versions prior to 9.10 allow HTTP

Unisys Cargo Mobile Application before 1.2.29 uses cleartext to store sensitive information, which might be revealed in

A Cross Site Scripting (XSS) vulnerability exists in Piwigo 11.5.0 via the system album name and description of the loca

IBM MQ on HPE NonStop 8.0.4 and 8.1.0 is vulnerable to a privilege escalation attack when SharedBindingsUserId is set to

The RegistrationMagic WordPress plugin made it possible for unauthenticated users to log in as any site user, including

Apache Sling Commons Messaging Mail provides a simple layer on top of JavaMail/Jakarta Mail for OSGi to send mails via S

Two methods of a utility class in SAP NetWeaver AS ABAP - versions 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752

SAP GRC Access Control - versions V1100_700, V1100_731, V1200_750, does not perform necessary authorization checks for a

SAF-T Framework Transaction SAFTN_G allows an attacker to exploit insufficient validation of path information provided b

Internally used text extraction reports allow an attacker to inject code that can be executed by the application. An att

The Variation Swatches for WooCommerce WordPress plugin is vulnerable to Stored Cross-Site Scripting via several paramet

When a user opens manipulated Jupiter Tessellation (.jt) file received from untrusted sources in SAP 3D Visual Enterpris

When a user opens manipulated Tagged Image File Format (.tif) file received from untrusted sources in SAP 3D Visual Ente

When a user opens a manipulated GIF (.gif) file received from untrusted sources in SAP 3D Visual Enterprise Viewer - ver

SAP Business One - version 10.0, allows an admin user to view DB password in plain text over the network, which should o

If configured to use an Oracle database and if a query is created using the flexible search java api with a parameterize

A security vulnerability has been discovered in the SAP Knowledge Warehouse - versions 7.30, 7.31, 7.40, 7.50. The usage

SAP BusinessObjects Business Intelligence Platform (Web Intelligence) - version 420, does not sufficiently encode user-c

The Fathom Analytics WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation

An issue was discovered in Listary through 6. Improper implementation of the update process leads to the download of sof

An issue was discovered in Listary through 6. When Listary is configured as admin, Listary will not ask for permissions

An issue was discovered in Listary through 6. An attacker can create a \\.\pipe\Listary.listaryService named pipe and wa

dbeaver is vulnerable to Improper Restriction of XML External Entity Reference

The duoFAQ - Responsive, Flat, Simple FAQ WordPess plugin is vulnerable to Reflected Cross-Site Scripting via the msg pa

The H5P CSS Editor WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the h5p-css-file parameter found

The Magic Post Voice WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the ids parameter found in the

The WooCommerce EnvioPack WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the dataid parameter foun

The Simple Image Gallery WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the msg parameter found in

The True Ranker plugin <= 2.2.2 for WordPress allows arbitrary files, including sensitive configuration files such as wp

The link-list-manager WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the category parameter found

The Real WYSIWYG WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to the use of PHP_SELF in the ~/re

The Parsian Bank Gateway for Woocommerce WordPress plugin is vulnerable to Reflected Cross-Site Scripting via and parame

The WooCommerce myghpay Payment Gateway WordPess plugin is vulnerable to Reflected Cross-Site Scripting via the clientre

The .htaccess Redirect WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the link parameter found in

Due to insufficient input validation of Kyma, authenticated users can pass a Header of their choice and escalate privile

yetiforcecrm is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Rapid7 Insight Agent, versions 3.0.1 to 3.1.2.34, suffer from a local privilege escalation due to an uncontrolled DLL se

glFusion CMS 1.7.9 is affected by an access control vulnerability via /public_html/users.php.

An issue was discovered in AbanteCart before 1.3.2. Any low-privileged user with file-upload permissions can upload a ma

An issue was discovered in AbanteCart before 1.3.2. It allows DOM Based XSS.

taocms 3.0.2 is vulnerable to arbitrary file deletion via taocms\include\Model\file.php from line 60 to line 72.

There is an upload sql injection vulnerability in the background of taocms 3.0.2 in parameter id:action=cms&ctrl=update&

The olm_session_describe function in Matrix libolm before 3.2.7 is vulnerable to a buffer overflow. The Olm session obje

An issue was discovered in Cuppa CMS Versions Before 31 Jan 2021 allows authenticated attackers to gain escalated privil

Sysaid API User Enumeration - Attacker sending requests to specific api path without any authorization before 21.3.60 ve