2021

An issue was discovered in Xen through 4.11.x, allowing x86 Intel HVM guest OS users to achieve unintended read/write DM

HMI/SCADA iFIX (Versions 6.1 and prior) allows a local authenticated user to modify system-wide iFIX configurations thro

The package prismjs before 1.23.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via the prism-asciidoc,

All versions of package merge are vulnerable to Prototype Pollution via _recursiveMerge .

This affects the package com.fasterxml.jackson.dataformat:jackson-dataformat-cbor from 0 and before 2.11.4, from 2.12.0-

All versions of package reportlab are vulnerable to Server-side Request Forgery (SSRF) via img tags. In order to reduce

This affects the package pimcore/pimcore before 6.8.8. A Local FIle Inclusion vulnerability exists in the downloadCsvAct

IBM Maximo for Civil Infrastructure 7.6.2 is vulnerable to cross-site scripting. This vulnerability allows users to embe

IBM Maximo for Civil Infrastructure 7.6.2 could allow a user to obtain sensitive information due to insecure storeage of

IBM Maximo for Civil Infrastructure 7.6.2 is vulnerable to cross-site scripting. This vulnerability allows users to embe

IBM Maximo for Civil Infrastructure 7.6.2 includes executable functionality (such as a library) from a source that is ou

IBM WebSphere Application Server 8.0, 8.5, and 9.0 could allow a remote attacker to traverse directories. An attacker co

IBM Jazz Reporting Service 6.0.6.1, 7.0, 7.0.1, and 7.0.2 is vulnerable to cross-site scripting. This vulnerability allo

This affects the package three before 0.125.0. This can happen when handling rgb or hsl colors. PoC: var three = require

The package async-git before 1.13.2 are vulnerable to Command Injection via shell meta-characters (back-ticks). For exam

HMI/SCADA iFIX (Versions 6.1 and prior) allows a local authenticated user to modify system-wide iFIX configurations thro

In Endalia Selection Portal before 4.205.0, an Insecure Direct Object Reference (IDOR) allows any authenticated user to

A command injection issue in dji_sys in DJI Mavic 2 Remote Controller before firmware version 01.00.0510 allows for code

An issue was discovered in the rand_core crate before 0.6.2 for Rust. Because read_u32_into and read_u64_into mishandle

An issue was discovered in the yottadb crate before 1.2.0 for Rust. For some memory-allocation patterns, ydb_subscript_n

An issue was discovered in the nb-connect crate before 1.0.3 for Rust. It may have invalid memory access for certain ver

SQL injection in the expertise parameter in search_result.php in Doctor Appointment System v1.0 allows an authenticated

Traefik before 2.4.5 allows the loading of IFRAME elements from other domains.

Tesla SolarCity Solar Monitoring Gateway through 5.46.43 has a "Use of Hard-coded Credentials" issue because Digi Connec

Digi ConnectPort X2e before 3.2.30.6 allows an attacker to escalate privileges from the python user to root via a symlin

The boot loader in Das U-Boot before 2021.04-rc2 mishandles use of unit addresses in a FIT.

The boot loader in Das U-Boot before 2021.04-rc2 mishandles a modified FIT.

BIND servers are vulnerable if they are running an affected version and are configured to use GSS-TSIG features. In a co

VertiGIS WebOffice 10.7 SP1 before patch20210202 and 10.8 SP1 before patch20210207 allows attackers to achieve "Zugriff

avahi-daemon-check-dns.sh in the Debian avahi package through 0.8-4 is executed as root via /etc/network/if-up.d/avahi-d

GramAddict through 1.2.3 allows remote attackers to execute arbitrary code because of use of UIAutomator2 and ATX-Agent.

OpenNMS Meridian 2016, 2017, 2018 before 2018.1.25, 2019 before 2019.1.16, and 2020 before 2020.1.5, Horizon 1.2 through

Controller/Backend/FileEditController.php and Controller/Backend/FilemanagerController.php in Bolt before 4.1.13 allow D

core/imap/MCIMAPSession.cpp in Canary Mail before 3.22 has Missing SSL Certificate Validation for IMAP in STARTTLS mode.

Cleartext transmission of sensitive information in Agora Video SDK prior to 3.1 allows a remote attacker to obtain acces

An exploitable local privilege elevation vulnerability exists in the file system permissions of Advantech WebAccess/SCAD

An exploitable local privilege elevation vulnerability exists in the file system permissions of Advantech WebAccess/SCAD

An exploitable local privilege elevation vulnerability exists in the file system permissions of Advantech WebAccess/SCAD

An exploitable local privilege elevation vulnerability exists in the file system permissions of Advantech WebAccess/SCAD

A local file inclusion vulnerability exists in the installation functionality of Advantech WebAccess/SCADA 9.0.1. A spec

Multiple vulnerabilities in the Admin portal of Cisco Identity Services Engine (ISE) could allow an authenticated, remot

Multiple vulnerabilities in the Admin portal of Cisco Identity Services Engine (ISE) could allow an authenticated, remot

A vulnerability in the SSH service of the Cisco StarOS operating system could allow an unauthenticated, remote attacker

A vulnerability in Cisco Webex Meetings Desktop App and Webex Productivity Tools for Windows could allow an authenticate

A vulnerability in the interprocess communication (IPC) channel of Cisco AnyConnect Secure Mobility Client for Windows c

A vulnerability in the web-based interface of Cisco Webex Meetings could allow an unauthenticated, remote attacker to co

The WPG plugin before 3.1.0.0 for IrfanView 4.57 has a Read Access Violation on Control Flow starting at WPG!ReadWPG_W+0

The WPG plugin before 3.1.0.0 for IrfanView 4.57 has a user-mode write access violation starting at WPG+0x0000000000012e

PHPGurukul Car Rental Project version 2.0 suffers from a remote shell upload vulnerability in changeimage1.php.

The lineage endpoint of the deprecated Experimental API was not protected by authentication in Airflow 2.0.0. This allow