2021

There is an improper permission assignment vulnerability in Huawei ManageOne product. Due to improper security hardening

There is an information leakage vulnerability in some huawei products. Due to the properly storage of specific informati

A potential security vulnerability has been identified in HPE Network Orchestrator (NetO) version(s): Prior to 2.5. The

A malicious website could execute code remotely in Sophos Connect Client before version 2.1.

There is insecure algorithm vulnerability in Huawei products. A module uses less random input in a secure mechanism. Att

There is a denial of service vulnerability in some huawei products. In specific scenarios, due to the improper handling

There is a vulnerability in some version of USG9500 that the device improperly handles the information when a user logs

The eUDC660 product has a resource management vulnerability. An attacker with high privilege needs to perform specific o

In drivers/pci/hotplug/rpadlpar_sysfs.c in the Linux kernel through 5.11.8, the RPA PCI Hotplug driver has a user-tolera

In intel_pmu_drain_pebs_nhm in arch/x86/events/intel/ds.c in the Linux kernel through 5.11.8 on some Haswell CPUs, users

When a user opens manipulated Autodesk 3D Studio for MS-DOS (.3DS) files received from untrusted sources in SAP 3D Visua

When a user opens manipulated Portable Document Format (.PDF) files received from untrusted sources in SAP 3D Visual Ent

When a user opens manipulated Windows Bitmap (.BMP) files received from untrusted sources in SAP 3D Visual Enterprise Vi

When a user opens manipulated Graphics Interchange Format (.GIF) files received from untrusted sources in SAP 3D Visual

IBM Planning Analytics 2.0 could be vulnerable to a Server-Side Request Forgery (SSRF) attack by constucting URLs from u

An issue was discovered in PunBB before 1.4.6. An XSS vulnerability in the [email] BBcode tag allows (with authenticatio

One of the usage insights HTTP API endpoints in Grafana Enterprise 6.x before 6.7.6, 7.x before 7.3.10, and 7.4.x before

The team sync HTTP API in Grafana Enterprise 6.x before 6.7.6, 7.x before 7.3.10, and 7.4.x before 7.4.5 has an Incorrec

A cross-site scripting (XSS) vulnerability in the admin login panel in 4images version 1.8 allows remote attackers to in

The team sync HTTP API in Grafana Enterprise 7.4.x before 7.4.5 has an Incorrect Access Control issue. On Grafana instan

Grafana Enterprise 7.2.x and 7.3.x before 7.3.10 and 7.4.x before 7.4.5 allows a dashboard editor to bypass a permission

Apache OFBiz has unsafe deserialization prior to 17.12.06. An unauthenticated attacker can use this vulnerability to suc

This affects the package es6-crawler-detect before 3.1.3. No limitation of user agent string length supplied to regex op

A race condition was discovered in get_old_root in fs/btrfs/ctree.c in the Linux kernel through 5.11.8. It allows attack

Agents are able to see linked FAQ articles without permissions (defined in FAQ Category). This issue affects: FAQ versio

Agents are able to see linked Config Items without permissions, which are defined in General Catalog. This issue affects

Shibboleth Service Provider before 3.2.1 allows content injection because template generation uses attacker-controlled p

The unofficial vscode-sass-lint (aka Sass Lint) extension through 1.0.7 for Visual Studio Code allows attackers to execu

git-bug before 0.7.2 has an Uncontrolled Search Path Element. It will execute git.bat from the current directory in cert

Affected versions of Atlassian Jira Server and Data Center allow remote attackers to evade behind-the-firewall protectio

Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to download temporary

SOPlanning before 1.47 has Incorrect Access Control because certain secret key information, and the related authenticati

This affects the package killport before 1.0.2. If (attacker-controlled) user input is given, it is possible for an atta

applications/luci-app-ddns/luasrc/model/cbi/ddns/detail.lua in the DDNS package for OpenWrt 19.07 allows remote authenti

An XSS vulnerability was discovered in python-lxml's clean module versions before 4.6.3. When disabling the safe_attrs_o

In Chris Walz bit before 1.0.5 on Windows, attackers can run arbitrary code via a .exe file in a crafted repository.

The unofficial C/C++ Advanced Lint extension before 1.9.0 for Visual Studio Code allows attackers to execute arbitrary b

An issue was discovered in the Linux kernel before 5.11.8. kernel/bpf/verifier.c has an off-by-one error (with a resulta

An issue was discovered in the Linux kernel before 5.11.8. kernel/bpf/verifier.c performs undesirable out-of-bounds spec

An issue was discovered in the Linux kernel through 5.11.8. The sound/soc/qcom/sdm845.c soundwire device driver has a bu

libdiscover/backends/KNSBackend/KNSResource.cpp in KDE Discover before 5.21.3 automatically creates links to potentially

An issue was discovered in fs/io_uring.c in the Linux kernel through 5.11.8. It allows attackers to cause a denial of se

An issue was discovered in fs/fuse/fuse_i.h in the Linux kernel before 5.11.8. A "stall on CPU" can occur because a retr

Schema-Inspector is an open-source tool to sanitize and validate JS objects (npm package schema-inspector). In before ve

A vulnerability was found in Moodle 3.7 to 3.7.1, 3.6 to 3.6.5, 3.5 to 3.5.7 and earlier unsupported versions, where for

A vulnerability was found in Moodle 3.7 to 3.7.1, 3.6 to 3.6.5, 3.5 to 3.5.7 and earlier unsupported versions, where the

A vulnerability was found in Moodle affection 3.7 to 3.7.1, 3.6 to 3.6.5, 3.5 to 3.5.7 and earlier unsupported versions

A vulnerability was found in Moodle affecting 3.7 to 3.7.1, 3.6 to 3.6.5, 3.5 to 3.5.7 and earlier unsupported versions,

A flaw was found in atomic-openshift of openshift-4.2 where the basic-user RABC role in OpenShift Container Platform doe

A flaw was discovered in OpenShift Container Platform 4 where, by default, users with access to create pods also have th