2021

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that

ManageWiki is an extension to the MediaWiki project. The 'wikiconfig' API leaked the value of private configuration vari

A vulnerability was discovered in Management component of Avaya Equinox Conferencing that could potentially allow an una

An XML External Entities (XXE) vulnerability in Media Server component of Avaya Equinox Conferencing could allow an auth

Authenticated Stored XSS in FME Server versions 2019.2 and 2020.0 Beta allows a remote attacker to execute codeby inject

Unauthenticated Stored XSS in FME Server versions 2019.2 and 2020.0 Beta allows a remote attacker to gain admin privileg

Etherpad < 1.8.3 is affected by a missing lock check which could cause a denial of service. Aggressively targeting rando

In Etherpad UeberDB < 0.4.4, due to MySQL omitting trailing spaces on char / varchar columns during comparisons, retriev

Etherpad <1.8.3 stored passwords used by users insecurely in the database and in log files. This affects every database

Etherpad < 1.8.3 is affected by a denial of service in the import functionality. Upload of binary file to the import end

In Etherpad < 1.8.3, a specially crafted URI would raise an unhandled exception in the cache mechanism and cause a denia

A remote XML external entity vulnerability was discovered in Aruba AirWave Management Platform version(s) prior to 8.2.1

A remote XML external entity vulnerability was discovered in Aruba AirWave Management Platform version(s) prior to 8.2.1

A remote insecure deserialization vulnerability was discovered in Aruba AirWave Management Platform version(s) prior to

xz is a compression and decompression library focusing on the xz format completely written in Go. The function readUvari

A remote escalation of privilege vulnerability was discovered in Aruba AirWave Management Platform version(s) prior to 8

A remote SQL injection vulnerability was discovered in Aruba AirWave Management Platform version(s) prior to 8.2.12.1. A

A remote insecure deserialization vulnerability was discovered in Aruba AirWave Management Platform version(s) prior to

The package browserslist from 4.0.0 and before 4.16.5 are vulnerable to Regular Expression Denial of Service (ReDoS) dur

Cross Site Scripting (XSS) in Qibosoft QiboCMS v7 and earlier allows remote attackers to execute arbitrary code or obtai

Cross Site Scripting (XSS) in MiniCMS v1.10 allows remote attackers to execute arbitrary code by injecting commands via

A remote authentication restriction bypass vulnerability was discovered in Aruba AirWave Management Platform version(s)

A local escalation of privilege vulnerability was discovered in Aruba ClearPass Policy Manager version(s) prior to 6.9.5

AVE DOMINAplus <=1.10.x suffers from an unauthenticated reboot command execution. Attackers can exploit this issue to ca

AVE DOMINAplus <=1.10.x suffers from clear-text credentials disclosure vulnerability that allows an unauthenticated atta

In WEMS Limited Enterprise Manager 2.58, input passed to the GET parameter 'email' is not properly sanitized before bein

A flaw was found in PDFResurrect in version 0.22b. There is an infinite loop in get_xref_linear_skipped() in pdf.c via a

A stored cross-site scripting (XSS) vulnerability in SourceCodester Budget Management System 1.0 allows users to inject

Multiple stored cross-site scripting (XSS) vulnerabilities in Sourcecodester Equipment Inventory System 1.0 allow remote

A cross-site scripting (XSS) vulnerability has been discovered in Nexus Repository Manager 3.x before 3.30.1. An attacke

AVE DOMINAplus <=1.10.x suffers from an authentication bypass vulnerability due to missing control check when directly c

SQL Injection in PHPSHE Mall System v1.7 allows remote attackers to execute arbitrary code by injecting SQL commands int

SQL Injection in Xinhu OA System v1.8.3 allows remote attackers to obtain sensitive information by injecting arbitrary c

There is a pointer double free vulnerability in some versions of CloudEngine 5800, CloudEngine 6800, CloudEngine 7800 an

There is a JavaScript injection vulnerability in certain Huawei smartphones. A module does not verify some inputs suffic

An arbitrary code execution vulnerability exists in Micro Focus Application Performance Management, affecting versions 9

There is a denial of service vulnerability in some versions of CloudEngine 5800, CloudEngine 6800, CloudEngine 7800 and

There is an out of bounds write vulnerability in Huawei Smartphone HUAWEI P30 versions 9.1.0.131(C00E130R1P21) when proc

There is an arbitrary memory write vulnerability in Huawei smart phone when processing file parsing. Due to insufficient

The sensitive information of webcam device is not properly protected. Remote attackers can unauthentically grant user’s

The sensitive information of webcam device is not properly protected. Remote attackers can unauthentically grant adminis

The manage users profile services of the network camera device allows an authenticated. Remote attackers can modify URL

The NTP Server configuration function of the IP camera device is not verified with special parameters. Remote attackers

Externally controlled reference to a resource in another sphere in quarantine functionality in Synology Antivirus Essent

Redmine before 4.0.9 and 4.1.x before 4.1.3 allows an attacker to learn the values of internal authentication keys by ob

Redmine before 4.0.9, 4.1.x before 4.1.3, and 4.2.x before 4.2.1 allows users to circumvent the allowed filename extensi

Redmine before 4.0.9, 4.1.x before 4.1.3, and 4.2.x before 4.2.1 allows attackers to bypass the add_issue_notes permissi

Insufficient input validation in the Git repository integration of Redmine before 4.0.9, 4.1.x before 4.1.3, and 4.2.x b

The yoast_seo (aka Yoast SEO) extension before 7.2.1 for TYPO3 allows SSRF via a backend user account.

The media2click (aka 2 Clicks for External Media) extension 1.x before 1.3.3 for TYPO3 allows XSS by a backend user acco