2021

themegrill-demo-importer before 1.6.3 allows CSRF, as demonstrated by wiping the database.

themegrill-demo-importer before 1.6.2 does not require authentication for wiping the database, because of a reset_wizard

SolarWinds Serv-U before 15.2 is affected by Cross Site Scripting (XSS) via the HTTP Host header.

SolarWinds Serv-U before 15.1.6 Hotfix 3 is affected by Cross Site Scripting (XSS) via a directory name (entered by an a

Insecure Permissions in Centreon Web versions 19.10.18, 20.04.8, and 20.10.2 allows remote attackers to bypass validatio

Redis is an open source (BSD licensed), in-memory data structure store, used as a database, cache, and message broker. A

Redis is an open source (BSD licensed), in-memory data structure store, used as a database, cache, and message broker. A

Dell dbutil_2_3.sys driver contains an insufficient access control vulnerability which may lead to escalation of privile

The IBM FlashSystem 900 user management GUI is vulnerable to stored cross-site scripting in code versions 1.5.2.8 and pr

iWT Ltd FaceSentry Access Control System 6.4.8 suffers from an authenticated OS command injection vulnerability using de

An issue was discovered in SolarWinds Serv-U before 15.2.2. Unauthenticated attackers can retrieve cleartext passwords v

All versions of Windscribe VPN for Mac and Windows <= v2.02.10 contain a local privilege escalation vulnerability in the

In IoT Devices SDK, there is an implementation of calloc() that doesn't have a length check. An attacker could pass in m

The Package Manager of CODESYS Development System 3 before 3.5.17.0 does not check the validity of packages before insta

The package handlebars before 4.7.7 are vulnerable to Prototype Pollution when selecting certain compiling options to co

All versions of package path-parse are vulnerable to Regular Expression Denial of Service (ReDoS) via splitDeviceRe, spl

Apache Unomi prior to version 1.5.5 allows CRLF log injection because of the lack of escaping in the log statements.

The kernel in Amazon Web Services FreeRTOS before 10.4.3 has insufficient bounds checking during management of heap memo

Unrestricted File Upload in JEECG v4.0 and earlier allows remote attackers to execute arbitrary code or gain privileges

An open redirect issue was discovered in OPNsense through 20.1.5. The redirect parameter "url" in login page was not fil

An issue was discovered on Libre Wireless LS9 LS1.5/p7040 devices. There is a Authentication Bypass in the Web Interface

An issue was discovered on Libre Wireless LS9 LS1.5/p7040 devices. There is Unauthenticated Root ADB Access Over TCP. Th

An issue was discovered on Libre Wireless LS9 LS1.5/p7040 devices. There is a luci_service GETPASS Configuration Passwor

An issue was discovered on Libre Wireless LS9 LS1.5/p7040 devices. There is a luci_service Read_ NVRAM Direct Access Inf

OX App Suite 7.10.4 and earlier allows XSS via crafted content to reach an undocumented feature, such as ![](http://oner

October is a free, open-source, self-hosted CMS platform based on the Laravel PHP Framework. A bypass of CVE-2020-26231

Mikrotik RouterOs before 6.46.5 (stable tree) suffers from a memory corruption vulnerability in the /nova/bin/traceroute

Mikrotik RouterOs 6.44.6 (long-term tree) suffers from a memory corruption vulnerability in the /nova/bin/traceroute pro

CODESYS Control Runtime system before 3.5.17.0 has improper input validation. Attackers can send crafted communication p

CODESYS Gateway 3 before 3.5.16.70 has a NULL pointer dereference that may result in a denial of service (DoS).

CODESYS Development System 3 before 3.5.17.0 displays or executes malicious documents or files embedded in libraries wit

CODESYS Automation Server before 1.16.0 allows cross-site request forgery (CSRF).

The gnuplot package prior to version 0.1.0 for Node.js allows code execution via shell metacharacters in Gnuplot command

In Node.js mixme, prior to v0.5.1, an attacker can add or alter properties of an object via '__proto__' through the muta

In the LibreOffice 7-1 series in versions prior to 7.1.2, and in the 7-0 series in versions prior to 7.0.5, the denylist

An issue was discovered in the algorithmica crate through 2021-03-07 for Rust. There is a double free in merge_sort::mer

The "origin" parameter passed to some of the endpoints like '/trigger' was vulnerable to XSS exploit. This issue affects

OX App Suite 7.10.4 and earlier allows XSS via a crafted distribution list (payload in the common name) that is mishandl

OX App Suite 7.10.4 and earlier allows XSS via a crafted contact object (payload in the position or company field) that

XSS in the client account page in SuiteCRM before 7.11.19 allows an attacker to inject JavaScript via the name field

OX Guard 2.10.4 and earlier allows a Denial of Service via a WKS server that responds slowly or with a large amount of d

OX App Suite 7.10.4 and earlier allows SSRF via a snippet.

A remote code execution vulnerability exists in Chamilo through 1.11.14 due to improper input sanitization of a paramete

Dell EMC Unity, UnityVSA, and Unity XT versions prior to 5.0.7.0.5.008 contain a plain-text password storage vulnerabili

Dell EMC iDRAC9 versions prior to 4.40.00.00 contain an improper authentication vulnerability. A remote authenticated ma

Dell EMC iDRAC9 versions prior to 4.40.00.00 contain multiple stored cross-site scripting vulnerabilities. A remote auth

Dell EMC iDRAC9 versions prior to 4.40.10.00 contain multiple stored cross-site scripting vulnerabilities. A remote auth

Dell EMC iDRAC9 versions prior to 4.40.00.00 contain a DOM-based cross-site scripting vulnerability. A remote unauthenti

Dell EMC iDRAC9 versions prior to 4.40.00.00 contain a stack-based overflow vulnerability. A remote authenticated attack

Dell EMC iDRAC9 versions prior to 4.40.00.00 contain a Time-of-check Time-of-use (TOCTOU) race condition vulnerability.