2021

The RebornCore library before 4.7.3 allows remote code execution because it deserializes untrusted data in ObjectInputSt

An argument injection vulnerability in the Dragonfly gem before 1.4.0 for Ruby allows remote attackers to read and write

Frontier ichris through 5.18 allows users to upload malicious executable files that might later be downloaded and run by

A remote code execution issue was discovered in the web UI of VoIPmonitor before 24.61. When the recheck option is used,

Deno is a runtime for JavaScript and TypeScript that uses V8 and is built in Rust. In Deno versions 1.5.0 to 1.10.1, mod

Execute arbitrary code vulnerability in Micro Focus SiteScope product, affecting versions 11.40,11.41 , 2018.05(11.50),

Authelia is a a single sign-on multi-factor portal for web apps. This affects uses who are using nginx ngx_http_auth_req

A vulnerability has been identified in SIMATIC Drive Controller family (All versions < V2.9.2), SIMATIC ET 200SP Open Co

A flaw was found in the ZeroMQ server in versions before 4.3.3. This flaw allows a malicious client to cause a stack buf

A flaw was found in keycloak in versions before 13.0.0. A Self Stored XSS attack vector escalating to a complete account

A vulnerability exists in the SAML connector of the github.com/dexidp/dex library used to process SAML Signature Validat

Deserialization of Untrusted Data vulnerability in CheckboxWeb.dll of Checkbox Survey allows an unauthenticated remote a

A flaw was found in the mysql-wsrep component of mariadb. Lack of input sanitization in `wsrep_sst_method` allows for co

A flaw was found in the way CHACHA20-POLY1305 was implemented in NSS in versions before 3.55. When using multi-part Chac

A flaw was found in Red Hat Quay, where it has a persistent Cross-site Scripting (XSS) vulnerability when displaying a r

LookupCol.c in X.Org X through X11R7.7 and libX11 before 1.7.1 might allow remote attackers to execute arbitrary code. T

A improper input sanitization vulnerability exists in Rocket.Chat server 3.11, 3.12 & 3.13 that could lead to unauthenti

A missing authorization vulnerability exists in Citrix ShareFile Storage Zones Controller before 5.7.3, 5.8.3, 5.9.3, 5.

GattLib 0.3-rc1 has a stack-based buffer over-read in get_device_path_from_mac in dbus/gattlib.c.

Use of a Broken or Risky Cryptographic Algorithm vulnerability exists in homeLYnk (Wiser For KNX) and spaceLYnk V2.60 an

Insufficiently Protected Credentials vulnerability exists in homeLYnk (Wiser For KNX) and spaceLYnk V2.60 and prior that

Weak Password Recovery Mechanism for Forgotten Password vulnerability exists on Modicon Managed Switch MCSESM* and MCSES

In Versa Director, the command injection is an attack in which the goal is execution of arbitrary commands on the host o

Files are accessible without restrictions from the /update/results page of redhat-certification 7 package, allowing an a

It was discovered that the /configuration view of redhat-certification 7 does not perform an authorization check and it

COVID19 Testing Management System 1.0 is vulnerable to SQL Injection via the admin panel.

IBM Power9 Self Boot Engine(SBE) could allow a privileged user to inject malicious code and compromise the integrity of

Prototype pollution vulnerability in 'js-extend' versions 0.0.1 through 1.0.1 allows attacker to cause a denial of servi

The vSphere Client (HTML5) contains a vulnerability in a vSphere authentication mechanism for the Virtual SAN Health Che

The vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the Virtual

If Apache Pulsar is configured to authenticate clients using tokens based on JSON Web Tokens (JWT), the signature of the

The Pixar ruby-jss gem before 1.6.0 allows remote attackers to execute arbitrary code because of the Plist gem's documen

The mq_notify function in the GNU C Library (aka glibc) versions 2.32 and 2.33 has a use-after-free. It may use the noti

Prototype pollution vulnerability in `nconf-toml` versions 0.0.1 through 0.0.2 allows an attacker to cause a denial of s

Prototype pollution vulnerability in 'deep-defaults' versions 1.0.0 through 1.0.5 allows attacker to cause a denial of s

Jenkins Nuget Plugin 1.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

Possible read out of bounds in dns read. Zephyr versions >= 1.14.2, >= 2.3.0 contain Out-of-bounds Read (CWE-125). For m

CODESYS V2 Web-Server before 1.1.9.20 has an Out-of-bounds Read.

CODESYS V2 Web-Server before 1.1.9.20 has an Out-of-bounds Write.

CODESYS V2 Web-Server before 1.1.9.20 has an Improperly Implemented Security Check.

CODESYS V2 Web-Server before 1.1.9.20 has Improper Access Control.

CODESYS V2 Web-Server before 1.1.9.20 has a Stack-based Buffer Overflow.

CODESYS V2 runtime system SP before 2.4.7.55 has a Stack-based Buffer Overflow.

Feehi CMS 2.1.1 is affected by a Server-side request forgery (SSRF) vulnerability. When the user modifies the HTTP Refer

MetInfo 7.0 beta is affected by a file modification vulnerability. Attackers can delete and modify ini files in app/syst

The @ronomon/opened library before 1.5.2 is vulnerable to a command injection vulnerability which would allow a remote a

An issue was discovered in zzcms 2019. SQL Injection exists in user/ztconfig.php via the daohang or img POST parameter.

IBM Security Guardium 11.2 contains hard-coded credentials, such as a password or cryptographic key, which it uses for i

Re-Logic Terraria before 1.4.2.3 performs Insecure Deserialization.

Creation of a Temporary Directory with Insecure Permissions in Nagios XI 5.7.5 and earlier allows for Privilege Escalati