2021

An open redirect vulnerability exists in Replicated Classic versions prior to 2.53.1 that could lead to spoofing. To exp

The Google Maps Easy WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation

The Notification WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and

The NextScripts: Social Networks Auto-Poster <= 4.3.20 WordPress plugin is vulnerable to Reflected Cross-Site Scripting

Buffer overflow vulnerability in Kodi xbmc up to 19.0, allows attackers to cause a denial of service due to improper len

A potential local bypass of security restrictions vulnerability has been identified in HPE ProLiant DL20 Gen10, HPE ProL

System Manager 9.x versions 9.7 and higher prior to 9.7P16, 9.8P7 and 9.9.1P2 are susceptible to a vulnerability which c

For certain valid JPEG XL images with a size slightly larger than an integer number of groups (256x256 pixels) when proc

Invalid JPEG XL images using libjxl can cause an out of bounds access on a std::vector<std::vector<T>> when rendering sp

AVideo/YouPHPTube 10.0 and prior is affected by multiple reflected Cross Script Scripting vulnerabilities via the videoN

AVideo/YouPHPTube 10.0 and prior has multiple reflected Cross Script Scripting vulnerabilities via the u parameter which

AVideo/YouPHPTube AVideo/YouPHPTube 10.0 and prior has multiple reflected Cross Script Scripting vulnerabilities via the

In Apache MINA, a specifically crafted, malformed HTTP request may cause the HTTP Header decoder to loop indefinitely. T

The Events Made Easy WordPress plugin before 2.2.24 does not sanitise and escape Custom Field Names, allowing high privi

The BP Better Messages WordPress plugin before 1.9.9.41 sanitise (with sanitize_text_field) but does not escape the 'sub

The Far Future Expiry Header WordPress plugin before 1.5 does not have CSRF check when saving its settings, which could

The Connections Business Directory WordPress plugin before 10.4.3 does not escape the Address settings when creating an

The WPeMatico RSS Feed Fetcher WordPress plugin before 2.6.12 does not escape the Feed URL added to a campaign before ou

The Flat Preloader WordPress plugin before 1.5.5 does not escape some of its settings when outputting them in attribute

The Image Source Control WordPress plugin before 2.3.1 allows users with a role as low as Contributor to change arbitrar

The WordPress Download Manager WordPress plugin before 3.2.16 does not escape some of the Download settings when outputt

The Stylish Price List WordPress plugin before 6.9.1 does not perform capability checks in its spl_upload_ser_img AJAX a

The Stylish Price List WordPress plugin before 6.9.0 does not perform capability checks in its spl_upload_ser_img AJAX a

The Logo Slider and Showcase WordPress plugin before 1.3.37 allows Editor users to update the plugin's settings via the

The WP Reactions Lite WordPress plugin before 1.3.6 does not properly sanitize inputs within wp-admin pages, allowing us

The Restaurant Menu by MotoPress WordPress plugin before 2.4.2 does not properly sanitize or escape inputs when creating

The Modern Events Calendar Lite WordPress plugin before 5.22.3 does not properly sanitize or escape values set by users

The WP Sitemap Page WordPress plugin before 1.7.0 does not properly sanitise and escape some of its settings, which coul

The Flat Preloader WordPress plugin before 1.5.4 does not enforce nonce checks when saving its settings, as well as does

The Cool Tag Cloud WordPress plugin before 2.26 does not escape the style attribute of the cool_tag_cloud shortcode, whi

The MP3 Audio Player for Music, Radio & Podcast by Sonaar WordPress plugin before 2.4.2 does not properly sanitize or es

The Accept Donations with PayPal WordPress plugin before 1.3.1 provides a function to create donation buttons which are

The Accept Donations with PayPal WordPress plugin before 1.3.1 offers a function to create donation buttons, which inter

The Coming Soon, Under Construction & Maintenance Mode By Dazzler WordPress plugin before 1.6.7 does not sanitise or esc

The Delete All Comments Easily WordPress plugin through 1.3 is lacking Cross-Site Request Forgery (CSRF) checks, which c

The WP-Pro-Quiz WordPress plugin through 0.37 does not have CSRF check in place when deleting a quiz, which could allow

The Content text slider on post WordPress plugin before 6.9 does not sanitise and escape the Title and Message/Content s

The WP-Stats WordPress plugin before 2.52 does not have CSRF check when saving its settings, and did not escape some of

Affected versions of Atlassian Jira Server and Data Center allow authenticated but non-admin remote attackers to edit em

Office Server Document Converter V7.2MR4 and earlier and V7.1MR7 and earlier allows a remote unauthenticated attacker to

Several web interfaces in D-Link DIR-868LW 1.12b have no authentication requirements for access, allowing for attackers

A local attacker could bypass the app password using a race condition in Sophos Secure Workspace for Android before vers

NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (vGPU plugin), where it can deadlock, which may

NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (vGPU plugin), where it can dereference a NULL

NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager kernel driver, where a vGPU can cause resource

A vulnerability was discovered in the filename parameter in pathindex.php?r=cms-backend/attachment/delete&sub=&filename=

A directory traversal vulnerability in the component system/manager/class/web/database.php was discovered in Baijiacms V

A vulnerability exists within the FileManagerController.php function in FrogCMS 0.9.5 which allows an attacker to perfor

Fluentd collects events from various data sources and writes them to files to help unify logging infrastructure. The par

A missing HTTP header (X-Frame-Options) in Kiwi Syslog Server has left customers vulnerable to click jacking. Clickjacki