2021

In-memory file operations (ie: using fopen on a data URI) did not properly restrict negative seeking, allowing for the r

xbuf_format_converter, used as part of exif_read_data, was appending a terminating null character to the generated strin

An incorrect size calculation in ldap_escape may lead to an integer overflow when overly long input is passed in, result

In deletePackageVersionedInternal of PackageManagerService.java, there is a possible way to exit Screen Pinning due to a

A request-validation issue was discovered in Open5GS 2.1.3 through 2.2.x before 2.2.1. The WebUI component allows an una

SAP Netweaver Application Server Java (Applications based on WebDynpro Java) versions 7.00, 7.10, 7.11, 7.20, 7.30, 7.31

IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to traverse directories on the sys

A vulnerability exists in IBM SPSS Modeler Subscription Installer that allows a user with create symbolic link permissio

Baby Care System 1.0 is affected by a cross-site scripting (XSS) vulnerability in the Edit Page tab through the Post tit

A stored cross-site scripting (XSS) vulnerability in cszcms 1.2.9 exists in /admin/pages/new via the content parameter.

FUEL CMS 1.4.13 contains a cross-site request forgery (CSRF) vulnerability that can delete a page via a post ID to /page

FUEL CMS 1.4.8 allows SQL injection via the 'fuel_replace_id' parameter in pages/replace/1. Exploiting this issue could

An issue was discovered in FUEL CMS 1.4.7. There is a escalation of privilege vulnerability to obtain super admin privil

An issue was discovered in FUEL CMS V1.4.7. An attacker can use a XSS payload and bypass a filter via /fuelCM/fuel/pages

Web Based Quiz System 1.0 is affected by cross-site scripting (XSS) in register.php through the name parameter.

Stored cross-site scripting vulnerability in Admin Page of GROWI (v4.2 Series) versions from v4.2.0 to v4.2.7 allows rem

Reflected cross-site scripting vulnerability due to insufficient verification of URL query parameters in GROWI (v4.2 Ser

Invalid file validation on the upload feature in GROWI versions v4.2.2 allows a remote attacker with administrative priv

Improper access control vulnerability in GROWI versions v4.2.2 and earlier allows a remote unauthenticated attacker to r

Path traversal vulnerability in GROWI versions v4.2.2 and earlier allows an attacker with administrator rights to read a

Path traversal vulnerability in GROWI versions v4.2.2 and earlier allows an attacker with administrator rights to read a

Stored cross-site scripting vulnerability due to inadequate CSP (Content Security Policy) configuration in GROWI version

The default error page for VelocityView in Apache Velocity Tools prior to 3.1 reflects back the vm file that was entered

An attacker that is able to modify Velocity templates may execute arbitrary Java code or run arbitrary system commands w

Western Digital My Cloud OS 5 devices before 5.10.122 mishandle Symbolic Link Following on SMB and AFP shares. This can

An integer buffer overflow in the Nginx webserver of ExpressVPN Router version 1 allows remote attackers to obtain sensi

Twinkle Tray (aka twinkle-tray) through 1.13.3 allows remote command execution. A remote attacker may send a crafted IPC

Squid through 4.14 and 5.x through 5.0.5, in some configurations, allows information disclosure because of an out-of-bou

The OUGC Feedback plugin before 1.8.23 for MyBB allows XSS via the comment field of feedback during an edit operation.

The Spotfire client component of TIBCO Software Inc.'s TIBCO Spotfire Analyst, TIBCO Spotfire Analytics Platform for AWS

A flaw was found in the Linux kernel in versions prior to 5.10. A violation of memory access was found while detecting a

Git is an open-source distributed revision control system. In affected versions of Git a specially crafted repository th

A stack overflow via an infinite recursion vulnerability was found in the eepro100 i8255x device emulator of QEMU. This

A heap-based buffer overflow flaw was found in libtiff in the handling of TIFF images in libtiff's TIFF2PDF tool. A spec

An integer overflow flaw was found in libtiff that exists in the tif_getimage.c file. This flaw allows an attacker to in

In LibTIFF, there is a memory malloc failure in tif_pixarlog.c. A crafted TIFF document can lead to an abort, resulting

A flaw was found in libtiff. Due to a memory allocation failure in tif_read.c, a crafted TIFF file can lead to an abort,

An issue was discovered on Athom Homey and Homey Pro devices before 5.0.0. ZigBee hub devices should generate a unique S

This affects the package jspdf before 2.3.1. ReDoS is possible via the addImage function.

This affects the package madge before 4.0.1. It is possible to specify a custom Graphviz path via the graphVizPath optio

Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable h

A flaw was found in ImageMagick in MagickCore/resample.c. An attacker who submits a crafted file that is processed by Im

A flaw was found in ImageMagick in coders/webp.c. An attacker who submits a crafted file that is processed by ImageMagic

A flaw was found in ImageMagick in MagickCore/visual-effects.c. An attacker who submits a crafted file that is processed

In versions 4.18 and earlier of the Eclipse Platform, the Help Subsystem does not authenticate active help requests to t

Hyperledger Besu is an open-source, MainNet compatible, Ethereum client written in Java. In Besu before version 1.5.1 th

Uninitialized data in PDFium in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to obtain potentially sens

Insufficient policy enforcement in payments in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to bypass n

Use after free in Blink in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to potentially exploit heap cor

Insufficient data validation in URL formatting in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to perfo