2021

An issue was discovered in Reprise RLM 14.2. As the session cookies are small, an attacker can hijack any existing sessi

Auerswald COMpact 5500R devices before 8.2B allow Arbitrary File Disclosure. A sub-admin can read the cleartext Admin pa

Auerswald COMpact 5500R devices before 8.2B allow Privilege Escalation via the passwd=1 substring.

Auerswald COMfortel 1400 IP and 2600 IP before 2.8G devices allow Authentication Bypass via the /about/../ substring.

In Cibele Thinfinity VirtualUI before 3.0, /changePassword returns different responses for invalid authentication reques

A stack-based buffer overflow in handle_request function in DHT.c in toxcore 0.1.9 through 0.1.11 and 0.2.0 through 0.2.

The Onion module in toxcore before 0.2.2 doesn't restrict which packets can be onion-routed, which allows a remote attac

The TCP Server module in toxcore before 0.2.8 doesn't free the TCP priority queue under certain conditions, which allows

The CLI 1.0.0 for Amazon AWS OpenSearch has weak permissions for the configuration file.

Zoho ManageEngine Desktop Central is vulnerable to authentication bypass, leading to remote code execution on the server

HashiCorp Consul Enterprise before 1.8.17, 1.9.x before 1.9.11, and 1.10.x before 1.10.4 has Incorrect Access Control. A

phpservermon is vulnerable to Improper Neutralization of CRLF Sequences

yetiforcecrm is vulnerable to Cross-Site Request Forgery (CSRF)

OpenOlat is a web-basedlearning management system. A path traversal vulnerability exists in OpenOlat prior to versions 1

A malicious hypervisor in conjunction with an unprivileged attacker process inside an SEV/SEV-ES guest VM may fail to fl

Improper handling of pointers in the System Management Mode (SMM) handling code may allow for a privileged attacker with

Grafana is an open-source platform for monitoring and observability. Grafana prior to versions 8.3.2 and 7.5.12 has a di

snipe-it is vulnerable to Improper Access Control

All versions of package merge-deep2 are vulnerable to Prototype Pollution via the mergeDeep() function.

All versions of package sey are vulnerable to Prototype Pollution via the deepmerge() function.

The package md-to-pdf before 5.0.0 are vulnerable to Remote Code Execution (RCE) due to utilizing the library gray-matte

All versions of package comb are vulnerable to Prototype Pollution via the deepMerge() function.

The package com.h2database:h2 from 1.4.198 and before 2.0.202 are vulnerable to XML External Entity (XXE) Injection via

Missing SSL Certificate Validation issue exists in Pluck 4.7.15 in update_applet.php, which could lead to man-in-the-mid

In Pluck-4.7.15 admin background a remote command execution vulnerability exists when uploading files.

Remote Code Execution (RCE) vulnerability exists in MaxSite CMS v107.5 via the Documents page.

Grafana is an open-source platform for monitoring and observability. Grafana prior to versions 8.3.2 and 7.5.12 contains

IBM PowerVM Hypervisor FW940, FW950, and FW1010 could allow an authenticated user to cause the system to crash using a s

IBM PowerVM Hypervisor FW860, FW940, and FW950 could allow an attacker that gains service access to the FSP can read and

Zip Slip vulnerability in Pluck-CMS Pluck 4.7.15 allows an attacker to upload specially crafted zip files, resulting in

Session Fixation vulnerability in login.php in Pluck-CMS Pluck 4.7.15 allows an attacker to sustain unauthorized access

An information disclosure vulnerability in the login page of Huntflow Enterprise before 3.10.4 could allow an unauthenti

Due to insufficient server-side login-attempt limit enforcement, a vulnerability in /account/login in Huntflow Enterpris

Stored Cross-Site Scripting (XSS) vulnerability discovered in WordPress Comment Engine Pro plugin (versions <= 1.0), cou

A security vulnerability has been identified in HPE StoreServ Management Console (SSMC). An authenticated SSMC administr

openwhyd is vulnerable to URL Redirection to Untrusted Site

A user interface overlay vulnerability was discovered in F-secure SAFE Browser for Android. When user click on a special

An issue was discovered on Digi TransPort Gateway devices through 5.2.13.4. They do not set the Secure attribute for sen

An issue was discovered on Digi TransPort devices through 2021-07-21. An authenticated attacker may load customized firm

An issue was discovered on Digi TransPort devices through 2021-07-21. An authenticated attacker may read a password file

An issue was discovered in Digi TransPort DR64, SR44 VC74, and WR. The ZING protocol allows arbitrary remote command exe

pimcore is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

pimcore is vulnerable to Cross-Site Request Forgery (CSRF)

pimcore is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in con

Next.js is a React framework. In versions of Next.js prior to 12.0.5 or 11.1.3, invalid or malformed URLs could lead to

Etherpad is a real-time collaborative editor. In versions prior to 1.8.16, an attacker can craft an `*.etherpad` file th

Delta Electronics CNCSoft Versions 1.01.30 and prior are vulnerable to a stack-based buffer overflow, which may allow an

Mattermost 6.0.2 and earlier fails to sufficiently sanitize user's password in audit logs when user creation fails.

kimai2 is vulnerable to Cross-Site Request Forgery (CSRF)