2021

In Apache HTTP Server versions 2.4.0 to 2.4.46 a specially crafted SessionHeader sent by an origin server could cause a

ConnMan (aka Connection Manager) 1.30 through 1.39 has a stack-based buffer overflow in uncompress in dnsproxy.c via NAM

A vulnerability exists in RaspAP 2.6 to 2.6.5 in the "iface" GET parameter in /ajax/networking/get_netcfg.php, when the

Webtools in Brocade SANnav before version 2.1.1 allows unauthenticated users to make requests to arbitrary hosts due to

A Missing Authentication in Critical Function in Bosch IP cameras allows an unauthenticated remote attacker to extract s

SGE-PLC1000 device, in its 0.9.2b firmware version, does not handle some requests correctly, allowing a remote attacker

Possible buffer overflow while updating ikev2 parameters for delete payloads received during informational exchange due

While processing server certificate from IPSec server, certificate validation for subject alternative name API can cause

Possible heap overflow while parsing NAL header due to lack of check of length of data received from user in Snapdragon

Buffer over-read can happen while processing WPA,RSN IE of beacon and response frames if IE length is less than length o

Possible stack out of bound write might happen due to time bitmap length and bit duration fields of the attributes like

Possible out of bound read while WLAN frame parsing due to lack of check for body and header length in Snapdragon Auto,

Kerberos AppContainer Security Feature Bypass Vulnerability

In VembuBDR before 4.2.0.1 and VembuOffsiteDR before 4.2.0.1 the http API located at /sgwebservice_o.php action logFileP

In VembuBDR before 4.2.0.1 and VembuOffsiteDR before 4.2.0.1 installed on Windows, the http API located at /consumerweb/

In VembuBDR before 4.2.0.1 and VembuOffsiteDR before 4.2.0.1, the http API located at /sgwebservice_o.php accepts a comm

Seceon aiSIEM before 6.3.2 (build 585) is prone to an unauthenticated account takeover vulnerability in the Forgot Passw

Flarum is a forum software for building communities. Flarum's translation system allowed for string inputs to be convert

WP-CLI is the command-line interface for WordPress. An improper error handling in HTTPS requests management in WP-CLI ve

Sharp NEC Displays ((UN462A R1.300 and prior to it, UN462VA R1.300 and prior to it, UN492S R1.300 and prior to it, UN492

Sharp NEC Displays (UN462A R1.300 and prior to it, UN462VA R1.300 and prior to it, UN492S R1.300 and prior to it, UN492V

NGINX before 1.13.6 has a buffer overflow for years that exceed four digits, as demonstrated by a file with a modificati

EmTec ZOC through 8.02.4 allows remote servers to cause a denial of service (Windows GUI hang) by telling the ZOC window

An authentication bypass in telnet server in BF-430 and BF431 232/422 TCP/IP Converter, BF-450M and SEMAC from CHIYU Tec

aom_dsp/noise_model.c in libaom in AOMedia before 2021-03-24 has a buffer overflow.

Prototype pollution vulnerability in 'nestie' versions 0.0.0 through 1.0.0 allows an attacker to cause a denial of servi

There is an Improper Validation of Array Index vulnerability in Huawei Smartphone. Successful exploitation of this vulne

The BDew BdLib library before 1.16.1.7 for Minecraft allows remote code execution because it deserializes untrusted data

FDCMS (also known as Fangfa Content Management System) 4.0 allows remote attackers to get a webshell in the background v

FDCMS (aka Fangfa Content Management System) 4.0 contains a front-end SQL injection via Admin/Lib/Action/FloginAction.cl

aom_dsp/grain_table.c in libaom in AOMedia before 2021-03-30 has a use-after-free.

Istio before 1.8.6 and 1.9.x before 1.9.5 contains a remotely exploitable vulnerability where an external client can acc

An issue was discovered in Pillow before 8.2.0. There is an out-of-bounds read in J2kDecode, in j2ku_gray_i.

An issue was discovered in Pillow before 8.2.0. There is an out-of-bounds read in J2kDecode, in j2ku_graya_la.

Multiple buffer overflows in the (1) cdf_read_sat, (2) cdf_read_long_sector_chain, and (3) cdf_read_ssat function in fil

Multiple integer overflows in the (1) cdf_read_property_info and (2) cdf_read_sat functions in file before 5.02.

The merge-deep library before 3.0.3 for Node.js can be tricked into overwriting properties of Object.prototype or adding

A flaw was found in github.com/satori/go.uuid in versions from commit 0ef6afb2f6cdd6cdaeee3885a95099c63f18fc8c to d91630

There's a flaw in lz4. An attacker who submits a crafted file to an application linked with lz4 may be able to trigger a

Deserialization of untrusted data vulnerability in McAfee Database Security (DBSec) prior to 4.8.2 allows a remote authe

Deserialization of untrusted data vulnerability in McAfee Database Security (DBSec) prior to 4.8.2 allows a remote unaut

Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in thumbnail componen

Apache Dubbo prior to 2.6.9 and 2.7.9 supports Script routing which will enable a customer to route the request to the r

Apache Dubbo prior to 2.7.9 support Tag routing which will enable a customer to route the request to the right server. T

Apache Dubbo prior to 2.6.9 and 2.7.9 by default supports generic calls to arbitrary methods exposed by provider interfa

Each Apache Dubbo server will set a serialization id to tell the clients which serialization protocol it is working on.

The Bello - Directory & Listing WordPress theme before 1.6.0 did not sanitise the bt_bb_listing_field_price_range_to, bt

IBM Cognos Analytics 11.0 and 11.1 DQM API allows submitting of all control requests in unauthenticated sessions. This a

SQL injection in In4Suite ERP 3.2.74.1370 allows attackers to modify or delete data, causing persistent changes to the a

The restapps (aka Rest Phone apps) module for Sangoma FreePBX and PBXact 13, 14, and 15 through 15.0.19.2 allows remote