2021

This affects all versions of package ps-visitor. If attacker-controlled user input is given to the kill function, it is

The overlayfs implementation in the linux kernel did not properly validate with respect to user namespaces the setting o

Shiftfs, an out-of-tree stacking file system included in Ubuntu Linux kernels, did not properly handle faults occurring

An SQL injection vulnerability has been reported to affect QNAP NAS running Multimedia Console or the Media Streaming ad

A command injection vulnerability has been reported to affect QTS and QuTS hero. If exploited, this vulnerability allows

a12n-server is an npm package which aims to provide a simple authentication system. A new HAL-Form was added to allow ed

Portofino is an open source web development framework. Portofino before version 5.2.1 did not properly verify the signat

jose-node-cjs-runtime is an npm package which provides a number of cryptographic functions. In versions prior to 3.11.4

jose-node-esm-runtime is an npm package which provides a number of cryptographic functions. In versions prior to 3.11.4

jose-browser-runtime is an npm package which provides a number of cryptographic functions. In versions prior to 3.11.4 t

A vulnerability has been identified in Mendix Applications using Mendix 7 (All versions < V7.23.19), Mendix Applications

An issue was discovered in libezxml.a in ezXML 0.8.6. The function ezxml_parse_str() performs incorrect memory handling

An issue was discovered in libezxml.a in ezXML 0.8.6. The function ezxml_parse_str() performs incorrect memory handling

jose is an npm library providing a number of cryptographic operations. In vulnerable versions AES_CBC_HMAC_SHA2 Algorith

SQL Injection in Tribalsystems Zenario CMS 8.8.52729 allows remote attackers to access the database or delete the plugin

Adobe Genuine Service version 6.6 (and earlier) is affected by an Uncontrolled Search Path element vulnerability. An aut

Adobe Genuine Service version 6.6 (and earlier) is affected by an Improper Access control vulnerability when handling sy

Adobe Genuine Service version 6.6 (and earlier) is affected by an Uncontrolled Search Path element vulnerability. An aut

IBM Spectrum Protect Server 7.1 and 8.1 is subject to a stack-based buffer overflow caused by improper bounds checking d

An attacker can place a crafted JSON config file into the project folder pointing to a custom executable. VScode-bazel a

The unofficial vscode-rpm-spec extension before 0.3.2 for Visual Studio Code allows remote code execution via a crafted

Broken Authentication in Atlassian Connect Spring Boot (ACSB) from version 1.1.0 before version 2.1.3: Atlassian Connect

Broken Authentication in Atlassian Connect Express (ACE) from version 3.0.2 before version 6.6.0: Atlassian Connect Expr

A cross-site scripting (XSS) vulnerability has been reported to affect earlier versions of File Station. If exploited, t

Command Injection in Tenda G1 and G3 routers with firmware versions v15.11.0.17(9502)_CN or v15.11.0.16(9024)_CN allows

Command Injection in Tenda G0 routers with firmware versions v15.11.0.6(9039)_CN and v15.11.0.5(5876)_CN , and Tenda G1

Wordpress is an open source CMS. One of the blocks in the WordPress editor can be exploited in a way that exposes passwo

Lotus is an Implementation of the Filecoin protocol written in Go. BLS signature validation in lotus uses blst library m

Wordpress is an open source CMS. A user with the ability to upload files (like an Author) can exploit an XML parsing iss

Sydent is a reference matrix identity server. A malicious user could abuse Sydent to send out arbitrary emails from the

Sydent is a reference Matrix identity server. Sydent can be induced to send HTTP GET requests to internal systems, due t

Sydent is a reference Matrix identity server. Sydent does not limit the size of requests it receives from HTTP clients.

The project received a report that all versions of Apache OpenOffice through 4.1.8 can open non-http(s) hyperlinks. The

The dio package 4.0.0 for Dart allows CRLF injection if the attacker controls the HTTP method string, a different vulner

An issue was discovered in Centreon-Web in Centreon Platform 20.10.0. The anti-CSRF token generation is predictable, whi

In QED ResourceXpress through 4.9k, a large numeric or alphanumeric value submitted in specific URL parameters causes a

Sydent is a reference Matrix identity server. In Sydent versions 2.2.0 and prior, sissing input validation of some param

A security vulnerability in HPE IceWall SSO Domain Gateway Option (Dgfw) module version 10.0 on RHEL 5/6/7, version 10.0

Wfilter ICF 5.0.117 contains a cross-site scripting (XSS) vulnerability. An attacker in the same LAN can craft a packet

Pi-hole is a Linux network-level advertisement and Internet tracker blocking application. The Stored XSS exists in the P

LightCMS v1.3.5 contains a remote code execution vulnerability in /app/Http/Controllers/Admin/NEditorController.php duri

An issue was discovered in libezxml.a in ezXML 0.8.6. The function ezxml_internal_dtd() performs incorrect memory handli

An authentication flaw was found in ceph in versions before 14.2.20. When the monitor handles CEPHX_GET_AUTH_SESSION_KEY

Textpattern V4.8.4 contains an arbitrary file upload vulnerability where a plug-in can be loaded in the background witho

Adobe Photoshop versions 21.2.6 (and earlier) and 22.3 (and earlier) are affected by a Buffer Overflow vulnerability whe

Adobe Photoshop versions 21.2.6 (and earlier) and 22.3 (and earlier) are affected by a Buffer Overflow vulnerability whe

SQL Injection in the "evoadm.php" component of b2evolution v7.2.2-stable allows remote attackers to obtain sensitive dat

Cross Site Scripting (XSS) in the "admin_boxes.ajax.php" component of Tribal Systems Zenario CMS v8.8.52729 allows remot

SQL Injection in the "admin_boxes.ajax.php" component of Tribal Systems Zenario CMS v8.8.52729 allows remote attackers t

Adobe Digital Editions version 4.5.11.187245 (and earlier) is affected by a Privilege Escalation vulnerability during in