2021

The move_uploaded_file function in godomall5 does not perform an integrity check of extension or authority when user upl

An improper input validation vulnerability in Helpu solution could allow a local attacker to arbitrary file creation and

Race condition issues were found in Calibre at devices/linux_mount_helper.c allowing unprivileged users the ability to m

HHVM supports the use of an "admin" server which accepts administrative requests over HTTP. One of those request handler

The Web Reporting component of TIBCO Software Inc.'s TIBCO Nimbus contains easily exploitable Stored Cross Site Scriptin

Mycodo is an environmental monitoring and regulation system. An exploit in versions prior to 8.12.7 allows anyone with a

Pi-hole's Web interface (based on AdminLTE) provides a central location to manage one's Pi-hole and review the statistic

OpenClinic GA 5.194.18 is affected by Insecure Permissions. By default the Authenticated Users group has the modify perm

An Insecure Permissions issue exists in Gestionale Open 11.00.00. A low privilege account is able to rename the mysqld.e

Nameko through 2.13.0 can be tricked into performing arbitrary code execution when deserializing the config file.

Online Student Admission System 1.0 is affected by an insecure file upload vulnerability. A low privileged user can uplo

A vulnerability was found in Mangboard(WordPress plugin). A SQL-Injection vulnerability was found in order_type paramete

An Improper input validation in execDefaultBrowser method of NEXACRO17 allows a remote attacker to execute arbitrary com

An issue was discovered in Nagios XI 5.8.5. In the Manage Dashlets section of the Admin panel, an administrator can uplo

An issue was discovered in Nagios XI 5.8.5. In the Custom Includes section of the Admin panel, an administrator can uplo

An issue was discovered in Nagios XI 5.8.5. Insecure file permissions on the nagios_unbundler.py file allow the nagios u

A crafted request with invalid offsets may cause an out-of-bounds read or write access in CODESYS V2 Runtime Toolkit 32

In CODESYS V2 Runtime Toolkit 32 Bit full and PLCWinNT prior to versions V2.4.7.56 unauthenticated crafted invalid reque

In the CODESYS V2 web server prior to V1.1.9.22 crafted web server requests may cause a Null pointer dereference in the

In the CODESYS V2 web server prior to V1.1.9.22 crafted web server requests can trigger a parser error. Since the parser

Crafted web server requests may cause a heap-based buffer overflow and could therefore trigger a denial-of- service cond

Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to view the names of p

Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to view private project and

Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to view the names of private

Nextcloud is an open-source, self-hosted productivity platform. Prior to versions 20.0.13, 21.0.5, and 22.2.0, a file tr

Nextcloud is an open-source, self-hosted productivity platform. Prior to versions 20.0.13, 21.0.5, and 22.2.0, Nextcloud

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to

Nextcloud is an open-source, self-hosted productivity platform. A missing permission check in Nextcloud Deck before 1.2.

NXP MCUXpresso SDK v2.7.0 was discovered to contain a buffer overflow in the function USB_HostParseDeviceConfigurationDe

NXP MCUXpresso SDK v2.7.0 was discovered to contain a buffer overflow in the function USB_HostProcessCallback().

This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.1.3 (

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-2

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-2

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-2

This vulnerability allows remote attackers to execute arbitrary code on affected installations of TeamViewer 15.16.8.0.

This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.1.3 (

This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.1.3 (

This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.1.3 (

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to

The Check & Log Email WordPress plugin before 1.0.3 does not validate and escape the "order" and "orderby" GET parameter

The Permalink Manager Lite WordPress plugin before 2.2.13.1 does not validate and escape the orderby parameter before us

The Game Server Status WordPress plugin through 1.0 does not validate or escape the server_id parameter before using it

The St-Daily-Tip WordPress plugin through 4.7 does not have any CSRF check in place when saving its 'Default Text to Dis

In acc_read of f_accessory.c, there is a possible memory corruption due to a use after free. This could lead to local es

In wifi driver, there is a possible system crash due to a missing bounds check. This could lead to remote denial of serv

In wifi driver, there is a possible system crash due to a missing bounds check. This could lead to remote denial of serv

Exposure of senstive information to an unauthorised actor in the "com.onepeloton.erlich" mobile application up to and in

In PHP versions 7.3.x up to and including 7.3.31, 7.4.x below 7.4.25 and 8.0.x below 8.0.12, when running PHP FPM SAPI w

Portable Ltd Playable v9.18 was discovered to contain an arbitrary file upload vulnerability in the filename parameter o