2021

Command Injection in Nagios Fusion 4.1.8 and earlier allows for Privilege Escalation to nagios.

Incorrect SSL certificate validation in Nagios Fusion 4.1.8 and earlier allows for Escalation of Privileges or Code Exec

Execution with Unnecessary Privileges in Nagios Fusion 4.1.8 and earlier allows for Privilege Escalation as nagios via i

Command Injection in Nagios Fusion 4.1.8 and earlier allows Privilege Escalation from apache to root in cmd_subsys.php.

Command Injection in Nagios Fusion 4.1.8 and earlier allows for Privilege Escalation or Code Execution as root via vecto

Insufficient Verification of Data Authenticity in Nagios Fusion 4.1.8 and earlier and Nagios XI 5.7.5 and earlier allows

Projectsworlds College Management System Php 1.0 is vulnerable to SQL injection issues over multiple parameters.

On WAGO PFC200 devices in different firmware versions with special crafted packets an authorised attacker with network a

Dutchcoders transfer.sh before 1.2.4 allows Directory Traversal for deleting files.

Plone through 5.2.4 allows remote authenticated managers to perform disk I/O via crafted keyword arguments to the ReStru

A flaw was found in libwebp in versions before 1.0.1. An out-of-bounds read was found in function ChunkAssignData. The h

A flaw was found in libwebp in versions before 1.0.1. An out-of-bounds read was found in function ChunkVerifyAndAssign.

A flaw was found in libwebp in versions before 1.0.1. A use-after-free was found due to a thread being killed too early.

A flaw was found in libwebp in versions before 1.0.1. A heap-based buffer overflow in function WebPDecodeRGBInto is poss

A use of uninitialized value was found in libwebp in versions before 1.0.1 in ReadSymbol().

A heap-based buffer overflow was found in libwebp in versions before 1.0.1 in ShiftBytes().

A heap-based buffer overflow was found in libwebp in versions before 1.0.1 in GetLE24().

A heap-based buffer overflow was found in libwebp in versions before 1.0.1 in PutLE16().

A heap-based buffer overflow was found in libwebp in versions before 1.0.1 in ApplyFilter().

A heap-based buffer overflow was found in libwebp in versions before 1.0.1 in GetLE16().

This vulnerability allows remote attackers to execute arbitrary code on affected installations of SolarWinds Network Per

An issue was discovered in Nitrokey FIDO U2F firmware through 1.1. Communication between the microcontroller and the sec

Admidio is a free, open source user management system for websites of organizations and groups. In Admidio before versio

A vulnerability has been found in multiple revisions of Emerson Rosemount X-STREAM Gas Analyzer. The webserver of the af

KonaWiki2 versions prior to 2.2.4 allows a remote attacker to upload arbitrary files via unspecified vectors. If the fil

SQL injection vulnerability in the KonaWiki2 versions prior to 2.2.4 allows remote attackers to execute arbitrary SQL co

An issue was discovered in Smartstore (aka SmartStoreNET) before 4.1.0. Administration/Controllers/ImportController.cs a

In the pg_partman (aka PG Partition Manager) extension before 4.5.1 for PostgreSQL, arbitrary code execution can be achi

BMC Remedy Mid Tier 9.1SP3 is affected by remote and local file inclusion. Due to the lack of restrictions on what can b

The unprivileged user portal part of CentOS Web Panel is affected by a Command Injection vulnerability leading to root R

The unprivileged user portal part of CentOS Web Panel is affected by a SQL Injection via the 'idsession' HTTP POST param

Path Traversal in HongCMS v4.0.0 allows remote attackers to view, edit, and delete arbitrary files via a crafted POST re

WebSVN before 2.6.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the search paramet

In Pluck-4.7.10-dev2 admin background, a remote command execution vulnerability exists when uploading files.

SITEL CAP/PRX firmware version 5.2.01 makes use of a hardcoded password. An attacker with access to the device could mod

The Goto WordPress theme before 2.1 did not sanitise, validate of escape the keywords GET parameter from its listing pag

IBM Planning Analytics Local 2.0 connects to a Redis server. The Redis server, an in-memory data structure store, runnin

IBM Planning Analytics Local 2.0 connects to a MongoDB server. MongoDB, a document-oriented database system, is listenin

Hirschmann HiOS 07.1.01, 07.1.02, and 08.1.00 through 08.5.xx and HiSecOS 03.3.00 through 03.5.01 allow remote attackers

Delta Industrial Automation CNCSoft ScreenEditor Versions 1.01.28 (with ScreenEditor Version 1.01.2) and prior are vulne

An integer overflow and several buffer overflow reads in libyara/modules/macho/macho.c in YARA v4.0.3 and earlier could

YFCMF v2.3.1 has a Remote Command Execution (RCE) vulnerability in the index.php.

Prototype pollution vulnerability in '101' versions 1.0.0 through 1.6.3 allows an attacker to cause a denial of service

Prototype pollution vulnerability in 'deep-override' versions 1.0.0 through 1.0.1 allows an attacker to cause a denial o

Unrestricted File Upload in LAOBANCMS v2.0 allows remote attackers to upload arbitrary files by attaching a file with a

The request_list_request AJAX call of the Car Seller - Auto Classifieds Script WordPress plugin through 2.1.0, available

The Kaswara Modern VC Addons WordPress plugin through 3.0.1 allows unauthenticated arbitrary file upload via the 'upload

The Flask-Caching extension through 1.10.1 for Flask relies on Pickle for serialization, which may lead to remote code e

Piwigo 11.4.0 allows admin/user_list_backend.php order[0][dir] SQL Injection.

A file upload issue exists in all versions of ArticleCMS which allows malicious users to getshell.