2021

Mozilla developers reported memory safety bugs present in Firefox 84 and Firefox ESR 78.6. Some of these bugs showed evi

The vulnerabilities can be exploited to cause the web visualization component of the PLC to stop and not respond, leadin

Improper Access Control in the RCP+ server of the Bosch Video Recording Manager (VRM) component allows arbitrary and una

There are multiple persistent cross-site scripting (XSS) vulnerabilities in the web interface of OpenText Content Server

LMA ISIDA Retriever 5.2 allows SQL Injection.

LMA ISIDA Retriever 5.2 is vulnerable to XSS via query['text'].

Changing the password on the module webpage does not require the user to type in the current password first. Thus, the p

ownCloud owncloud/client before 2.7 allows DLL Injection. The desktop client loaded development plugins from certain dir

best it Amazon Pay Plugin before 9.4.2 for Shopware exposes Sensitive Information to an Unauthorized Actor.

A component of Kaspersky custom boot loader allowed loading of untrusted UEFI modules due to insufficient check of their

Micro Focus Solutions Business Manager Application Repository versions prior to 11.7.1 are vulnerable to information dis

Micro Focus Solutions Business Manager Application Repository versions prior to 11.7.1 are vulnerable to session fixatio

Micro Focus Solutions Business Manager Application Repository versions prior to 11.7.1 are vulnerable to privilege escal

Micro Focus Solutions Business Manager Application Repository versions prior to 11.7.1 are vulnerable to reflected XSS.

Micro Focus Solutions Business Manager versions prior to 11.7.1 are vulnerable to XML External Entity Processing (XXE) o

Micro Focus Solutions Business Manager versions prior to 11.7.1 are vulnerable to stored XSS. The application reflects p

Firefox for Android suffered from a time-of-check-time-of-use vulnerability that allowed a malicious application to read

When sharing geolocation during an active WebRTC share, Firefox could have reset the webRTC sharing state in the user in

Incorrect use of the '<RowCountChanged>' method could have led to a user-after-poison and a potentially exploitable cras

Further techniques that built on the slipstream research combined with a malicious webpage could have exposed both an in

Performing garbage collection on re-declared JavaScript variables resulted in a user-after-poison, and a potentially exp

An XSS bug in internal error pages could have led to various spoofing attacks, including other error pages and the addre

The browser could have been confused into transferring a screen sharing state into another tab, which would leak uninten

Navigations through the Android-specific `intent` URL scheme could have been misused to escape iframe sandbox. Note: Thi

An ambiguous file picker design could have confused users who intended to select and upload a single file into uploading

The browser could have been confused into transferring a pointer lock state into another tab, which could have lead to c

Using the new logical assignment operators in a JavaScript switch statement could have caused a type confusion, leading

If a user clicked into a specifically crafted PDF, the PDF reader could be confused into leaking cross-origin informatio

A ZTE product has a memory leak vulnerability. Due to the product's improper handling of memory release in certain scena

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. In aiohttp before version 3.7.4 there is

Missing initialization of a variable in the TPM2 source may allow a privileged user to potentially enable an escalation

When accepting a malicious intent from other installed apps, Firefox for Android accepted manifests from arbitrary file

The developer page about:memory has a Measure function for exploring what object types the browser has allocated and the

The DOMParser API did not properly process '<noscript>' elements for escaping. This could be used as an mXSS vector to b

When trying to load a cross-origin resource in an audio/video context a decoding error may have resulted, and the conten

One phishing tactic on the web is to provide a link with HTTP Auth. For example 'https://[email protected]

When processing a redirect with a conflicting Referrer-Policy, Firefox would have adopted the redirect's Referrer-Policy

Context-specific code was included in a shared jump table; resulting in assertions being triggered in multithreaded wasm

As specified in the W3C Content Security Policy draft, when creating a violation report, "User agents need to ensure tha

If Content Security Policy blocked frame navigation, the full destination of a redirect served in the frame was reported

Vapor is a web framework for Swift. In Vapor before version 4.40.1, there is a DoS attack against anyone who Bootstraps

.NET Core Remote Code Execution Vulnerability

Visual Studio Code npm-script Extension Remote Code Execution Vulnerability

Windows PKU2U Elevation of Privilege Vulnerability

Microsoft Teams iOS Information Disclosure Vulnerability

Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability

.NET Core Remote Code Execution Vulnerability

.NET Framework Denial of Service Vulnerability

Microsoft Azure Kubernetes Service Elevation of Privilege Vulnerability

Windows DirectX Information Disclosure Vulnerability