2021

Cleartext storage of sensitive information in multiple versions of Octopus Server where in certain situations when runni

Password generator feature in Kaspersky Password Manager was not completely cryptographically strong and potentially all

Hexagon G!nius Auskunftsportal before 5.0.0.0 allows SQL injection via the GiPWorkflow/Service/DownloadPublicFile id par

An HTTP Request Smuggling vulnerability in Pulse Secure Virtual Traffic Manager before 21.1 could allow an attacker to s

The Flask-Caching extension through 1.10.1 for Flask relies on Pickle for serialization, which may lead to remote code e

Piwigo 11.4.0 allows admin/user_list_backend.php order[0][dir] SQL Injection.

Bitcoin Core 0.12.0 through 0.21.1 does not properly implement the replacement policy specified in BIP125, which makes i

The HTMLSanitizer class in html-sanitizer.ts in all released versions of the Aurelia framework 1.x repository is vulnera

A local file inclusion vulnerability in ILIAS before 5.3.19, 5.4.10 and 6.0 allows remote authenticated attackers to exe

An information disclosure vulnerability in ILIAS before 5.3.19, 5.4.12 and 6.0 allows remote authenticated attackers to

Pydantic is a data validation and settings management using Python type hinting. In affected versions passing either `'i

GraphHopper is an open-source Java routing engine. In GrassHopper from version 2.0 and before version 2.4, there is a re

Omron CX-One Versions 4.60 and prior, including CX-Server Versions 5.0.29.0 and prior, are vulnerable to a stack-based b

An issue was discovered in HERMES 2.1 in the MBUX Infotainment System on Mercedes-Benz vehicles through 2021. There is a

An issue was discovered in HERMES 2.1 in the MBUX Infotainment System on Mercedes-Benz vehicles through 2021. The SH2 MC

An issue was discovered in the Headunit NTG6 in the MBUX Infotainment System on Mercedes-Benz vehicles through 2021. A t

An issue was discovered in the Headunit NTG6 in the MBUX Infotainment System on Mercedes-Benz vehicles through 2021. The

An issue was discovered in the Headunit NTG6 in the MBUX Infotainment System on Mercedes-Benz vehicles through 2021. A M

admin/user_import.php in Chamilo 1.11.x reads XML data without disabling the ability to load external entities.

Elastic App Search versions after 7.11.0 and before 7.12.0 contain an XML External Entity Injection issue (XXE) in the A

Kibana versions before 7.12.1 contain a denial of service vulnerability was found in the webhook actions due to a lack o

In Logstash versions after 6.4.0 and before 6.8.15 and 7.12.0 a TLS certificate validation flaw was found in the monitor

In Elasticsearch versions before 7.11.2 and 6.8.15 a document disclosure flaw was found when Document or Field Level Sec

In Kibana versions before 7.12.0 and 6.8.15 a flaw in the session timeout was discovered where the xpack.security.sessio

Elasticsearch versions before 7.11.2 and 6.8.15 contain a document disclosure flaw was found in the Elasticsearch sugges

Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metada

An issue was discovered in Prosody before 0.11.9. It does not use a constant-time algorithm for comparing certain secret

Prosody before 0.11.9 allows Uncontrolled CPU Consumption via a flood of SSL/TLS renegotiation requests.

An issue was discovered in Prosody before 0.11.9. The undocumented dialback_without_dialback option in mod_dialback enab

An issue was discovered in Prosody before 0.11.9. Default settings are susceptible to remote unauthenticated denial-of-s

An issue was discovered in Prosody before 0.11.9. The proxy65 component allows open access by default, even if neither o

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. The ability to enumera

IBM Jazz Reporting Service 6.0.6.1, 7.0, 7.0.1, and 7.0.2 is vulnerable to server-side request forgery (SSRF). This may

An out-of-bounds heap buffer access issue was found in the ARM Generic Interrupt Controller emulator of QEMU up to and i

A race condition flaw was found in the 9pfs server implementation of QEMU up to and including 5.2.0. This flaw allows a

A flaw was found in noobaa-operator in versions before 5.7.0, where internal RPC AuthTokens between the noobaa operator

SonicWall Email Security Virtual Appliance version 10.0.9 and earlier versions contain a default username and a password

A file upload issue exists in all versions of ArticleCMS which allows malicious users to getshell.

A vulnerability was found in Linux Kernel where in the spk_ttyio_receive_buf2() function, it would dereference spk_ttyio

A flaw was found in OpenJPEG’s encoder. This flaw allows an attacker to pass specially crafted x,y offset input to OpenJ

A malformed input file can lead to a segfault due to an out of bounds array access in raptor_xml_writer_start_element_co

Insecure permissions issue in zzcms 201910 via the reset any user password in /one/getpassword.php.

File Upload vulnerability exists in ArticleCMS 1.0 via the image upload feature at /admin by changing the Content-Type t

An attacker may cause a Denial of Service (DoS) in multiple versions of Teradici PCoIP Agent via a null pointer derefere

In Weidmüller u-controls and IoT-Gateways in versions up to 1.12.1 a network port intended only for device-internal usag

In multiple managed switches by WAGO in different versions without authorization and with specially crafted packets it i

In multiple managed switches by WAGO in different versions it is possible to read out the password hashes of all Web-bas

In multiple managed switches by WAGO in different versions special crafted requests can lead to cookies being transferre

In multiple managed switches by WAGO in different versions the webserver cookies of the web based UI contain user creden

In multiple managed switches by WAGO in different versions an attacker may trick a legitimate user to click a link to in