2021

OpUtils in Zoho ManageEngine OpManager 12.5 before 125490 mishandles authentication for a few audit directories.

Doctrine DBAL 3.x before 3.1.4 allows SQL Injection. The escaping of offset and length inputs to the generation of a LIM

Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performan

A Cross Site Scripting (XSS) exists in ZZZCMS V1.7.1 via an editfile action in save.php.

A Cross Site Request Forgery (CSRF) vulnerability exits in ZZZCMS V1.7.1 via the save_user funciton in save.php.

An Incorrect Access Control vulnerability exists in zzcms less than or equal to 2019 via admin.php. After disabling Java

Flask-AppBuilder is a development framework built on top of Flask. Verions prior to 3.3.4 contain an improper authentica

An SQL Injection vulnerability exists in zzcms 8.2, 8.3, 2020, abd 2021 in dl/dl_download.php. when registering ordinary

An SQL Injection vulnerability exists in zzcms 8.2, 8.3, 2020, and 2021 in dl/dl_print.php when registering ordinary use

IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 uses weaker than expec

IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to a denial of service, caused by sending a specia

IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.1, and 11.5 is vulnerable to an information disclos

IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 could allow a local us

IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 could allow a user wit

When using the dart pub publish command to publish a package to a third-party package server, the request would be authe

IBM Db2 9.7, 10.1, 10.5, 11.1, and 11.5 may be vulnerable to an Information Disclosure when using the LOAD utility as un

Cross Site Scripting (XSS) vulnerability in McAfee Network Security Manager (NSM) prior to 10.1 Minor 7 allows a remote

A reflected Cross Site Scripting (XSS) vulnerability exists in Premiumdatingscript 4.2.7.7 via the aerror_description pa

An authentication bypass (account takeover) vulnerability exists in Premiumdatingscript 4.2.7.7 due to a weak password r

An SQL Injection vulnerability exists in Premiumdatingscript 4.2.7.7 via the ip parameter in connect.php. .

An Incorrect Access Control vulnerability exists in Premiumdatingscript 4.2.7.7 via the password change procedure in req

Express OpenID Connect is express JS middleware implementing sign on for Express web apps using OpenID Connect. Versions

An SQL Injection vulnerablitly exits in zzcms 8.2, 8.3, 2020, and 2021 via the id parameter in admin/dl_sendmail.php.

An SQL Injection vulnerability exists in zzcms 8.2, 8.3, 2020, and 2021 via the id parameter in admin/bad.php.

An authentication bypass vulnerability exists in the get_aes_key_info_by_packetid() function of the home_security binary

A command execution vulnerability exists in the wifi_country_code_update functionality of the home_security binary of An

An unprotected ssh private key exists on the Gryphon devices which could be used to achieve root access to a server affi

Gryphon Tower routers contain an unprotected openvpn configuration file which can grant attackers access to the Gryphon

An unauthenticated command injection vulnerability exists in the parameters of operation 49 in the controller_server ser

An unauthenticated command injection vulnerability exists in the parameters of operation 48 in the controller_server ser

An unauthenticated command injection vulnerability exists in the parameters of operation 41 in the controller_server ser

An unauthenticated command injection vulnerability exists in the parameters of operation 32 in the controller_server ser

An unauthenticated command injection vulnerability exists in the parameters of operation 10 in the controller_server ser

An unauthenticated command injection vulnerability exists in the parameters of operation 3 in the controller_server serv

An unauthenticated command injection vulnerability exists in multiple parameters in the Gryphon Tower router’s web inter

A reflected cross-site scripting vulnerability exists in the url parameter of the /cgi-bin/luci/site_access/ page on the

A path traversal attack in web interfaces of Netgear RAX35, RAX38, and RAX40 routers before v1.0.4.102, allows a remote

An attacker could prematurely expire a verification code, making it unusable by the patient, making the patient unable t

wbce_cms is vulnerable to Improper Neutralization of Special Elements used in an SQL Command

A heap-based buffer overflow in Fortinet FortiWeb version 6.4.1 and 6.4.0, version 6.3.15 and below, version 6.2.6 and b

A improper authentication in Fortinet FortiAuthenticator version 6.4.0 allows user to bypass the second factor of authen

A incorrect permission assignment for critical resource in Fortinet FortiNAC version 9.2.0, version 9.1.3 and below, ver

A violation of secure design principles in Fortinet Meru AP version 8.6.1 and below, version 8.5.5 and below allows atta

An improper authorization vulnerabiltiy [CWE-285] in FortiClient Windows versions 7.0.0 and 6.4.6 and below and 6.2.8 an

Apache Airavata Django Portal allows CRLF log injection because of lack of escaping log statements. In particular, some

A improper control of a resource through its lifetime in Fortinet FortiClientWindows version 6.4.1 and 6.4.0, version 6.

Multiple stack-based buffer overflows in the API controllers of FortiWeb 6.4.1, 6.4.0, and 6.3.0 through 6.3.15 may allo

A missing encryption of sensitive data in Fortinet FortiClientEMS version 7.0.1 and below, version 6.4.4 and below allow

Sockeye is an open-source sequence-to-sequence framework for Neural Machine Translation built on PyTorch. Sockeye uses Y

An out-of-bounds read flaw was found in the CLARRV, DLARRV, SLARRV, and ZLARRV functions in lapack through version 3.10.