2021

Knowledge Management versions 7.01, 7.02, 7.30, 7.31, 7.40, 7.50 allows a remote attacker with basic privileges to deser

SAP Payment Engine version 500, does not perform necessary authorization checks for an authenticated user, resulting in

SAP Enterprise Financial Services versions, 101, 102, 103, 104, 105, 600, 603, 604, 605, 606, 616, 617, 618, 800, does n

LDAP authentication in SAP HANA Database version 2.0 can be bypassed if the attached LDAP directory server is configured

The MigrationService, which is part of SAP NetWeaver versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not perform

SAP MII allows users to create dashboards and save them as JSP through the SSCE (Self Service Composition Environment).

IBM Cloud Pak for Multicloud Management Monitoring 2.2 returns potentially sensitive information in headers which could

Web Based Quiz System 1.0 is affected by cross-site scripting (XSS) in admin.php through the options parameter.

A flaw was found in privoxy before 3.0.32. Invalid memory access with an invalid pattern passed to pcre_compile() may le

A flaw was found in privoxy before 3.0.32. A invalid read of size two may occur in chunked_body_is_complete() leading to

A flaw was found in privoxy before 3.0.32. A crash may occur due a NULL-pointer dereference when the socks server misbeh

A flaw was found in privoxy before 3.0.32. A crash can occur via a crafted CGI request if Privoxy is toggled off.

A flaw was found in privoxy before 3.0.32. An assertion failure could be triggered with a crafted CGI request leading to

react-dev-utils prior to v11.0.4 exposes a function, getProcessForPort, where an input argument is concatenated into a c

The `com.bmuschko:gradle-vagrant-plugin` Gradle plugin contains an information disclosure vulnerability due to the loggi

Products.GenericSetup is a mini-framework for expressing the configured state of a Zope Site as a set of filesystem arti

Dell iDRAC8 versions prior to 2.75.100.75 contain a host header injection vulnerability. A remote unauthenticated attack

PowerScale OneFS 8.1.2,8.2.2 and 9.1.0 contains an improper input sanitization issue in its API handler. An un-authtenti

PowerScale OneFS 8.1.2,8.2.2 and 9.1.0 contains an improper input sanitization issue in a command. The Compadmin user co

A flaw was found in keycloak in versions prior to 13.0.0. The client registration endpoint allows fetching information a

Maxum Rumpus 8.2.13 and 8.2.14 is affected by cross-site scripting (XSS). Users are able to create folders in the web ap

Maxum Rumpus 8.2.13 and 8.2.14 is affected by a command injection vulnerability. The web administration contains functio

A document disclosure flaw was found in Elasticsearch versions after 7.6.0 and before 7.11.0 when Document or Field Leve

Products.PluggableAuthService is a pluggable Zope authentication and authorization framework. In Products.PluggableAuthS

Products.PluggableAuthService is a pluggable Zope authentication and authorization framework. In Products.PluggableAuthS

In the SPNEGO HTTP Authentication Module for nginx (spnego-http-auth-nginx-module) before version 1.1.1 basic Authentica

Maxum Rumpus 8.2.13 and 8.2.14 is affected by cross-site request forgery (CSRF). If an authenticated user visits a malic

MinIO is an open-source high performance object storage service and it is API compatible with Amazon S3 cloud storage se

Pollbot is open source software which "frees its human masters from the toilsome task of polling for the state of things

RATCF is an open-source framework for hosting Cyber-Security Capture the Flag events. In affected versions of RATCF user

IBM DataPower Gateway V10 and V2018 could allow a local attacker with administrative privileges to execute arbitrary cod

IBM API Connect V10 and V2018 could allow an attacker who has intercepted a registration invitation link to impersonate

IBM API Connect V10 is impacted by insecure communications during database replication. As the data replication happens

GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses track

GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses track

GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses track

GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses track

In the "Time in Status" app before 4.13.0 for Jira, remote authenticated attackers can cause Stored XSS.

Dr.Web Security Space versions 11 and 12 allow elevation of privilege for local users without administrative privileges

Oryx Embedded CycloneTCP 1.7.6 to 2.0.0, fixed in 2.0.2, is affected by incorrect input validation, which may cause a de

The package github.com/pires/go-proxyproto before 0.5.0 are vulnerable to Denial of Service (DoS) via the parseVersion1(

An issue was discovered in MantisBT before 2.24.5. It associates a unique cookie string with each user. This string is n

This affects all versions of package github.com/nats-io/nats-server/server. Untrusted accounts are able to crash the ser

An issue was discovered in the Linux kernel through 5.11.3. Certain iSCSI data structures do not have appropriate length

An issue was discovered in the Linux kernel through 5.11.3. drivers/scsi/scsi_transport_iscsi.c is adversely affected by

An issue was discovered in the Linux kernel through 5.11.3. A kernel pointer leak can be used to determine the address o

An issue was discovered in AfterLogic Aurora through 7.7.9 and WebMail Pro through 7.7.9. They allow directory traversal

Wazuh API in Wazuh from 4.0.0 to 4.0.3 allows authenticated users to execute arbitrary code with administrative privileg

The Blog module in Kentico CMS 5.5 R2 build 5.5.3996 allows SQL injection via the tagname parameter.

Deutsche Post Mailoptimizer 4.3 before 2020-11-09 allows Directory Traversal via a crafted ZIP archive to the Upload fea