2021

An issue was discovered in the _send_secure_msg() function of Yubico yubihsm-shell through 2.0.3. The function does not

An issue was discovered in Joomla! 1.6.0 through 3.9.24. Inadequate filtering of form contents could allow to overwrite

An issue was discovered in Joomla! 3.0.0 through 3.9.24. Extracting an specifilcy crafted zip package could write files

An issue was discovered in Joomla! 3.0.0 through 3.9.24. Incorrect ACL checks could allow unauthorized change of the cat

An issue was discovered in Joomla! 3.0.0 through 3.9.24. com_media allowed paths that are not intended for image uploads

An issue was discovered in Joomla! 3.2.0 through 3.9.24. Missing input validation within the template manager.

An issue was discovered in Joomla! 2.5.0 through 3.9.24. Missing filtering of feed fields could lead to xss issues.

An issue was discovered in Joomla! 2.5.0 through 3.9.24. Missing filtering of messages showed to users that could lead t

An issue was discovered in Joomla! 3.2.0 through 3.9.24. The core shipped but unused randval implementation within FOF (

An issue was discovered in Joomla! 3.2.0 through 3.9.24. Usage of an insufficient length for the 2FA secret accoring to

An issue was discovered in Joomla! 3.2.0 through 3.9.24. Usage of the insecure rand() function within the process of gen

An improper access control vulnerability in FortiProxy SSL VPN portal 2.0.0, 1.2.9 and below versions may allow an authe

When traffic other than HTTP/S (eg: SSH traffic, etc...) traverses the FortiGate in version below 6.2.5 and below 6.4.2

This affects the package html-parse-stringify before 2.0.1; all versions of package html-parse-stringify2. Sending certa

The package total.js before 3.4.8 are vulnerable to Remote Code Execution (RCE) via set.

Courier Management System 1.0 1.0 is affected by SQL Injection via 'MULTIPART street '.

Courier Management System 1.0 - 'First Name' Stored XSS

SQL injection vulnerability was discovered in Courier Management System 1.0, which can be exploited via the ref_no (POST

Starting with version 13.7 the Gitlab CE/EE editions were affected by a security issue related to the validation of the

An issue has been discovered in GitLab affecting all versions starting with 11.8. GitLab was vulnerable to a stored XSS

A PHP object injection bug in profile.php in qcubed (all versions including 3.1.1) unserializes the untrusted data of th

A SQL injection vulnerability in qcubed (all versions including 3.1.1) in profile.php via the strQuery parameter allows

A reflected cross-site scripting (XSS) vulnerability in qcubed (all versions including 3.1.1) in profile.php via the stQ

PHP object injection in the Ajax endpoint of the backend in ForkCMS below version 5.8.3 allows an authenticated remote u

Xerox AltaLink B8045/B8055/B8065/B8075/B8090 and C8030/C8035/C8045/C8055/C8070 multifunction printers with software rele

Xerox AltaLink B8045/B8055/B8065/B8075/B8090 and C8030/C8035/C8045/C8055/C8070 multifunction printers with software rele

The Java client for the Datadog API before version 1.0.0-beta.9 has a local information disclosure of sensitive informat

resources/public/js/orchestrator.js in openark orchestrator before 3.2.4 allows XSS via the orchestrator-msg parameter.

An issue was discovered in AdGuard before 0.105.2. An attacker able to get the user's cookie is able to bruteforce their

LumisXP (aka Lumis Experience Platform) before 10.0.0 allows unauthenticated blind XXE via an API request to PageControl

GLPI is open source software which stands for Gestionnaire Libre de Parc Informatique and it is a Free Asset and IT Mana

GLPI is open source software which stands for Gestionnaire Libre de Parc Informatique and it is a Free Asset and IT Mana

GLPI is open source software which stands for Gestionnaire Libre de Parc Informatique and it is a Free Asset and IT Mana

A CSV injection vulnerability found in Online Invoicing System (OIS) 4.3 and below can be exploited by users to perform

Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to DNS rebinding attacks as the whitelist includes “

Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to a denial of service attack when too many connecti

Nextcloud Server prior to 20.0.6 is vulnerable to reflected cross-site scripting (XSS) due to lack of sanitization in `O

A missing user check in Nextcloud prior to 20.0.6 inadvertently populates a user's own credentials for other users exter

Rockwell Automation Studio 5000 Logix Designer Versions 21 and later, and RSLogix 5000 Versions 16 through 20 use a key

An issue has been discovered in GitLab affecting all versions starting with 13.0. Confidential issue titles in Gitlab we

An issue has been discovered in GitLab affecting all versions starting with 13.7. GitLab was vulnerable to a stored XSS

VMware View Planner 4.x prior to 4.6 Security Patch 1 contains a remote code execution vulnerability. Improper input val

Nextcloud Server prior to 20.0.0 stores passwords in a recoverable format even when external storage is not configured.

The wp-hotel-booking plugin through 1.10.2 for WordPress allows remote attackers to execute arbitrary code because of an

A predictable seed vulnerability exists in the password reset functionality of Epignosis EfrontPro 5.2.21. By predicting

An out-of-bounds read vulnerability exists in the AMF File AMFParserContext::endElement() functionality of Slic3r libsli

A code execution vulnerability exists in the AudioSourceProviderGStreamer functionality of Webkit WebKitGTK 2.30.1. A sp

In Zabbix from 4.0.x before 4.0.28rc1, 5.0.0alpha1 before 5.0.10rc1, 5.2.x before 5.2.6rc1, and 5.4.0alpha1 before 5.4.0

Fatek FvDesigner Version 1.5.76 and prior is vulnerable to an out-of-bounds write while processing project files, allowi

An uninitialized pointer may be exploited in Fatek FvDesigner Version 1.5.76 and prior while the application is processi