2021

Miniaudio 0.10.35 has a Double free vulnerability that could cause a buffer overflow in ma_default_vfs_close__stdio in m

Vulnerability in Fidelis Network and Deception CommandPost enables authenticated command injection through the web inter

Vulnerability in Fidelis Network and Deception CommandPost enables unauthenticated SQL injection through the web interfa

Vulnerability in the CommandPost, Collector, and Sensor components of Fidelis Network and Deception enables an attacker

Zoho ManageEngine ADSelfService Plus through 6101 is vulnerable to unauthenticated Remote Code Execution while changing

Shopware is an open source eCommerce platform. Versions prior to 6.3.5.1 may leak of information via Store-API. The vuln

Integer overflow vulnerability in payable function of a smart contract implementation for an Ethereum token, as demonstr

Flysystem is an open source file storage library for PHP. The whitespace normalisation using in 1.x and 2.x removes any

SQL Injection vulnerability in WebPort <=1.19.1 via the new connection, parameter name in type-conn.

There is an arbitrary password modification vulnerability in a D-LINK DSL-2888A router product. An attacker can use this

In applications using jfinal 4.9.08 and below, there is a deserialization vulnerability when using redis,may be vulnerab

In IBOS 4.5.4 Open, Arbitrary File Inclusion causes getshell via /system/modules/dashboard/controllers/CronController.ph

phpwcms 1.9.13 is vulnerable to Code Injection via /phpwcms/setup/setup.php.

SQL Injection vulnerability in gnuboard5 <=v5.3.2.8 via the table_prefix parameter in install_db.php.

CRMEB 3.1.0+ is vulnerable to File Upload Getshell via /crmeb/crmeb/services/UploadService.php.

Proxy functionality built into Hubs Cloud’s Reticulum software allowed access to internal URLs, including the metadata s

A command execution vulnerability exists in the default legacy spellchecker plugin in Moodle 3.10. A specially crafted s

SQL Injection vulnerability in imcat v5.2 via the fm[auser] parameters in coms/add_coms.php.

VMware Carbon Black App Control 8.0, 8.1, 8.5 prior to 8.5.8, and 8.6 prior to 8.6.2 has an authentication bypass. A mal

Use after free vulnerability in file transfer protocol component in Synology DiskStation Manager (DSM) before 6.2.3-2542

Ballerina is an open source programming language and platform for cloud application programmers. Ballerina versions 1.2.

An improper authorization vulnerability in Palo Alto Networks Cortex XSOAR enables a remote unauthenticated attacker wit

NoSQL injection vulnerability in GROWI versions prior to v4.2.20 allows a remote attacker to obtain and/or alter the inf

Joomla! Core is prone to a security bypass vulnerability. Exploiting this issue may allow attackers to perform otherwise

Joomla! Core is prone to a vulnerability that lets attackers upload arbitrary files because the application fails to pro

An XXE vulnerability exists in ConnectWise Automate before 2021.0.6.132.

The Autoptimize WordPress plugin before 2.7.8 attempts to delete malicious files (such as .php) form the uploaded archiv

The Fancy Product Designer WordPress plugin before 4.6.9 allows unauthenticated attackers to upload arbitrary files, res

In the Location Manager WordPress plugin before 2.1.0.10, the AJAX action gd_popular_location_list did not properly sani

Textpattern 4.7.3 contains an aribtrary file load via the file_insert function in include/txp_file.php.

Apache Nuttx Versions prior to 10.1.0 are vulnerable to integer wrap-around in functions malloc, realloc and memalign. T

In p2p_process_prov_disc_req of p2p_pd.c, there is a possible out of bounds read and write due to a use after free. This

Greenbone Security Assistant (GSA) before 7.0.3 and Greenbone OS (GOS) before 5.0.0 allow Host Header Injection.

White Shark System (WSS) 1.3.2 is vulnerable to unauthorized access via user_edit_password.php, remote attackers can mod

SerenityOS before commit 3844e8569689dd476064a0759d704bc64fb3ca2c contains a directory traversal vulnerability in tar/un

Secure 8 (Evalos) does not validate user input data correctly, allowing a remote attacker to perform a Blind SQL Injecti

An issue was discovered in Cleo LexiCom 5.5.0.0. Within the AS2 message, the sender can specify a filename. This filenam

Jenkins Generic Webhook Trigger Plugin 1.72 and earlier does not configure its XML parser to prevent XML external entity

Improper privilege management vulnerability in cgi component in Synology Download Station before 3.8.16-3566 allows remo

Improper neutralization of special elements used in a command ('Command Injection') vulnerability in task management com

Elemin allows remote attackers to upload and execute arbitrary PHP code via the Themify framework (before 1.2.2) wp-cont

A local file inclusion vulnerability was discovered in the captcha function in Monstra 3.0.4 which allows remote attacke

An information disclosure vulnerability exists in the Ethernet/IP UDP handler functionality of EIP Stack Group OpENer 2.

An issue was discovered on Enphase Envoy R3.x and D4.x devices with v3 software. The default admin password is set to th

Matrix libolm before 3.2.3 allows a malicious Matrix homeserver to crash a client (while it is attempting to retrieve an

SQL Injection in 74cms 3.2.0 via the id parameter to wap/wap-company-show.php.

SQL Injection in 74cms 3.2.0 via the key parameter to plus/ajax_street.php.

SQL Injection in 74cms 3.2.0 via the x parameter to ajax_officebuilding.php.

SQL Injection in 74cms 3.2.0 via the query parameter to plus/ajax_common.php.

SQL Injection in 74cms 3.2.0 via the x parameter to plus/ajax_street.php.