2021

When taxes are enabled, the "Additional tax classes" field was not properly sanitised or escaped before being output bac

The GiveWP – Donation Plugin and Fundraising Platform WordPress plugin before 2.10.4 did not sanitise or escape the Back

The Goto WordPress theme before 2.1 did not sanitise, validate of escape the keywords GET parameter from its listing pag

The ReDi Restaurant Reservation WordPress plugin before 21.0426 provides the functionality to let users make restaurant

It was possible to exploit an Unauthenticated Time-Based Blind SQL Injection vulnerability in the Spam protection, AntiS

The Happy Addons for Elementor WordPress plugin before 2.24.0, Happy Addons Pro for Elementor WordPress plugin before 1.

There are several endpoints in the Store Locator Plus for WordPress plugin through 5.5.15 that could allow unauthenticat

There is functionality in the Store Locator Plus for WordPress plugin through 5.5.14 that made it possible for authentic

When subscribing using AcyMailing, the 'redirect' parameter isn't properly sanitized. Turning the request from POST to G

IBM Planning Analytics Local 2.0 connects to a Redis server. The Redis server, an in-memory data structure store, runnin

IBM Planning Analytics Local 2.0 connects to a MongoDB server. MongoDB, a document-oriented database system, is listenin

Access bypass vulnerability in of Drupal Core Workspaces allows an attacker to access data without correct permissions.

A vulnerability was found in Moodle where javaScript injection was possible in some Mustache templates via recursive ren

Hirschmann HiOS 07.1.01, 07.1.02, and 08.1.00 through 08.5.xx and HiSecOS 03.3.00 through 03.5.01 allow remote attackers

Intelbras Router RF 301K Firmware 1.1.2 is vulnerable to Cross Site Request Forgery (CSRF) due to lack of security mecha

Intelbras Router RF 301K Firmware 1.1.2 is vulnerable to Cross Site Request Forgery (CSRF) due to lack of validation and

Incorrect access control in zam64.sys, zam32.sys in MalwareFox AntiMalware 2.74.0.150 allows a non-privileged process to

Incorrect access control in zam64.sys, zam32.sys in MalwareFox AntiMalware 2.74.0.150 where IOCTL's 0x80002014, 0x800020

An authentication brute-force protection mechanism bypass in telnetd in D-Link Router model DIR-842 firmware version 3.0

A flaw was found in the Nosy driver in the Linux kernel. This issue allows a device to be inserted twice into a doubly-l

The Data Engine module in Liferay Portal 7.3.0 through 7.3.5, and Liferay DXP 7.3 before fix pack 1 does not check permi

Cross-site scripting (XSS) vulnerability in the Asset module's Asset Publisher app in Liferay Portal 7.2.1 through 7.3.5

Cross-site scripting (XSS) vulnerability in the Layout module's page administration page in Liferay Portal 7.3.4, 7.3.5

A flaw in Mozilla's embedded certificate code might allow web sites to install root certificates on devices without user

Multiple SQL injection vulnerabilities in Liferay Portal 7.3.5 and Liferay DXP 7.3 before fix pack 1 allow remote authen

Cross-site scripting (XSS) vulnerability in the Asset module's category selector input field in Liferay Portal 7.3.5 and

Cross-site scripting (XSS) vulnerability in the Redirect module's redirection administration page in Liferay Portal 7.3.

Cross-site scripting (XSS) vulnerability in the Site module's membership request administration pages in Liferay Portal

The Portal Store module in Liferay Portal 7.0.0 through 7.3.5, and Liferay DXP 7.0 before fix pack 97, 7.1 before fix pa

The SimpleCaptcha implementation in Liferay Portal 7.3.4, 7.3.5 and Liferay DXP 7.3 before fix pack 1 does not invalidat

Denial-of-service (DoS) vulnerability in the Multi-Factor Authentication module in Liferay DXP 7.3 before fix pack 1 all

The JSON web services in Liferay Portal 7.3.4 and earlier, and Liferay DXP 7.0 before fix pack 97, 7.1 before fix pack 2

Cross-site scripting (XSS) vulnerability in the Asset module's categories administration page in Liferay Portal 7.3.4 al

Delta Industrial Automation CNCSoft ScreenEditor Versions 1.01.28 (with ScreenEditor Version 1.01.2) and prior are vulne

DedeCMS V5.7 SP2 contains a CSRF vulnerability that allows a remote attacker to send a malicious request to to the web m

A XSS Vulnerability in /uploads/dede/action_search.php in DedeCMS V5.7 SP2 allows an authenticated user to execute remot

In the Linux kernel before 5.12.4, net/bluetooth/hci_event.c has a use-after-free when destroying an hci_chan, aka CID-5

The Linux kernel before 5.11.14 has a use-after-free in cipso_v4_genopt in net/ipv4/cipso_ipv4.c because the CIPSO and C

The block subsystem in the Linux kernel before 5.2 has a use-after-free that can lead to arbitrary code execution in the

An integer overflow and several buffer overflow reads in libyara/modules/macho/macho.c in YARA v4.0.3 and earlier could

Firely/Incendi Spark before 1.5.5-r4 lacks Content-Disposition headers in certain situations, which may cause crafted fi

Apache Traffic Server 9.0.0 is vulnerable to a remote DOS attack on the experimental Slicer plugin.

A UI misrepresentation vulnerability was identified in GitHub Enterprise Server that allowed more permissions to be gran

A Zip Slip vulnerability was found in the oc binary in openshift-clients where an arbitrary file write is achieved by us

A heap buffer overflow read was discovered in upx 4.0.0, because the check in p_lx_elf.cpp is not perfect.

A vulnerability found in libxml2 in versions before 2.9.11 shows that it did not propagate errors while parsing XML mixe

TensorFlow is an end-to-end open source platform for machine learning. Passing invalid arguments (e.g., discovered via f

TensorFlow is an end-to-end open source platform for machine learning. Passing a complex argument to `tf.transpose` at t

TensorFlow is an end-to-end open source platform for machine learning. An attacker can cause a denial of service via `CH

TensorFlow is an end-to-end open source platform for machine learning. The implementation of TrySimplify(https://github.