2021

In Dataiku DSS before 8.0.6, insufficient access control in the Jupyter notebooks integration allows users (who have cod

SerComm AG Combo VD625 AGSOT_2.1.0 devices allow CRLF injection (for HTTP header injection) in the download function via

An issue was discovered in SaltStack Salt before 3002.5. The salt-api's ssh client is vulnerable to a shell injection by

i-doit before 1.16.0 is affected by Stored Cross-Site Scripting (XSS) issues that could allow remote authenticated attac

An issue was discovered in SaltStack Salt before 3002.5. Sending crafted web requests to the Salt API can result in salt

In SaltStack Salt before 3002.5, eauth tokens can be used once after expiration. (They might be used to run command agai

An issue was discovered in through SaltStack Salt before 3002.5. salt.modules.cmdmod can log credentials to the info or

An issue was discovered in through SaltStack Salt before 3002.5. The jinja renderer does not protect against server side

An issue was discovered in through SaltStack Salt before 3002.5. The salt.wheel.pillar_roots.write method is vulnerable

An issue was discovered in through SaltStack Salt before 3002.5. salt-api does not honor eauth credentials for the wheel

In SaltStack Salt before 3002.5, when authenticating to services using certain modules, the SSL certificate is not alway

In SaltStack Salt before 3002.5, authentication to VMware vcenter, vsphere, and esxi servers (in the vmware.py files) do

An issue was discovered in SaltStack Salt before 3002.5. The minion's restartcheck is vulnerable to command injection vi

An issue was discovered in Scytl sVote 2.1. Because the IP address from an X-Forwarded-For header (which can be manipula

An issue was discovered in Scytl sVote 2.1. An attacker can inject code that gets executed by creating an election-event

An issue was discovered in Scytl sVote 2.1. Due to the implementation of the database manager, an attacker can access th

An issue was discovered in Scytl sVote 2.1. Because the sdm-ws-rest API does not require authentication, an attacker can

A vulnerability was discovered in how p2p/p2p_pd.c in wpa_supplicant before 2.10 processes P2P (Wi-Fi Direct) provision

An issue was discovered in Visualware MyConnection Server before v11.1a. Unauthenticated Remote Code Execution can occur

Zenphoto through 1.5.7 is affected by authenticated arbitrary file upload, leading to remote code execution. The attacke

The iconv function in the GNU C Library (aka glibc or libc6) 2.32 and earlier, when processing invalid multi-byte input

ean_leading_zeroes in backend/upcean.c in Zint Barcode Generator 2.9.1 has a stack-based buffer overflow that is reachab

Stack-based buffer overflow vulnerability in frontend/main.c in faad2 before 2.2.7.1 allow local attackers to execute ar

Insertion of sensitive information into sent data vulnerability in synorelayd in Synology DiskStation Manager (DSM) befo

Cleartext transmission of sensitive information vulnerability in synorelayd in Synology DiskStation Manager (DSM) before

Cleartext transmission of sensitive information vulnerability in synorelayd in Synology DiskStation Manager (DSM) before

Incorrect authorization vulnerability in synoagentregisterd in Synology DiskStation Manager (DSM) before 6.2.4-25553 all

Out-of-bounds write vulnerability in synoagentregisterd in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allow

Stack-based buffer overflow vulnerability in synoagentregisterd in Synology DiskStation Manager (DSM) before 6.2.3-25426

Cleartext transmission of sensitive information vulnerability in synoagentregisterd in Synology DiskStation Manager (DSM

Redis is an open-source, in-memory database that persists on disk. In affected versions of Redis an integer overflow bug

In Eclipse Jetty 9.4.6.v20170531 to 9.4.36.v20210114 (inclusive), 10.0.0, and 11.0.0 when Jetty handles a request contai

In cameraisp, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation

In performance driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local e

In mobile_log_d, there is a possible information disclosure due to improper input validation. This could lead to local i

In netdiag, there is a possible information disclosure due to a missing permission check. This could lead to local infor

In jpeg, there is a possible out of bounds write due to improper input validation. This could lead to local escalation o

In vow, there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege

In vpu, there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege

In vpu, there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege

PrestaShop is a fully scalable open source e-commerce solution. In PrestaShop before version 1.7.2 the soft logout syste

PrestaShop is a fully scalable open source e-commerce solution. In PrestaShop before version 1.7.2 there is a CSV Inject

All versions of package github.com/thecodingmachine/gotenberg are vulnerable to Server-side Request Forgery (SSRF) via t

Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for ope

Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for ope

Node-Red is a low-code programming for event-driven applications built using nodejs. Node-RED 1.2.7 and earlier has a vu

Node-Red is a low-code programming for event-driven applications built using nodejs. Node-RED 1.2.7 and earlier contains

Mozilla developers reported memory safety bugs present in Firefox 85. Some of these bugs showed evidence of memory corru

Mozilla developers reported memory safety bugs present in Firefox 85 and Firefox ESR 78.7. Some of these bugs showed evi

Mozilla developers reported memory safety bugs present in Firefox 84. Some of these bugs showed evidence of memory corru