2021

A deserialization of untrusted data vulnerability exists in Ivanti Avalanche before 6.3.3 using Inforail Service allows

An improper authorization control vulnerability exists in Ivanti Avalanche before 6.3.3 allows an attacker with access t

An unrestricted file upload vulnerability exists in Ivanti Avalanche before 6.3.3 allows an attacker with access to the

An improper access control vulnerability exists in Ivanti Avalanche before 6.3.3 allows an attacker with access to the I

An uncontrolled resource consumption vulnerability exists in Citrix ADC <13.0-83.27, <12.1-63.22 and 11.1-65.23 that cou

A unauthenticated denial of service vulnerability exists in Citrix ADC <13.0-83.27, <12.1-63.22 and 11.1-65.23 when conf

An issue was discovered in Mahavitaran android application 7.50 and below, allows local attackers to read cleartext user

A cross-site scripting (XSS) vulnerability in integration configuration in SquaredUp for SCOM 5.2.1.6654 allows remote a

An issue was discovered in SquaredUp for SCOM 5.2.1.6654. The Download Log feature in System / Maintenance was susceptib

A DOM-based XSS vulnerability affects SquaredUp for SCOM 5.2.1.6654. If successfully exploited, this vulnerability may a

A cross-site scripting (XSS) vulnerability in integration configuration in SquaredUp for SCOM 5.2.1.6654 allows remote a

A cross-site scripting (XSS) vulnerability in Image Tile in SquaredUp for SCOM 5.2.1.6654 allows remote attackers to inj

grant table v2 status pages may remain accessible after de-allocation (take two) Guest get permitted access to certain X

livehelperchat is vulnerable to Cross-Site Request Forgery (CSRF)

A stored Cross Site Scripting (XSS) vulnerability in Esri ArcGIS Server feature services versions 10.8.1 and 10.9 (only)

An information disclosure vulnerability in the ArcGIS Service Directory in Esri ArcGIS Enterprise versions 10.9.0 and be

A SQL injection vulnerability in feature services provided by Esri ArcGIS Server 10.9 and below allows a remote, unauthe

A remote file inclusion vulnerability in the ArcGIS Server help documentation may allow a remote, unauthenticated attack

Insecure creation of temporary directories in tmate-ssh-server 2.3.0 allows a local attacker to compromise the integrity

World-writable permissions on the /tmp/tmate/sessions directory in tmate-ssh-server 2.3.0 allow a local attacker to comp

calibre before 5.32.0 contains a regular expression that is vulnerable to ReDoS (Regular Expression Denial of Service) i

Git-it through 4.4.0 allows OS command injection at the Branches Aren't Just For Birds challenge step. During the verifi

naholyr github-todos 3.1.0 is vulnerable to command injection. The range argument for the _hook subcommand is concatenat

An issue (6 of 6) was discovered in Veritas Enterprise Vault through 14.1.2. On start-up, the Enterprise Vault applicati

An issue (5 of 6) was discovered in Veritas Enterprise Vault through 14.1.2. On start-up, the Enterprise Vault applicati

An issue (4 of 6) was discovered in Veritas Enterprise Vault through 14.1.2. On start-up, the Enterprise Vault applicati

An issue (3 of 6) was discovered in Veritas Enterprise Vault through 14.1.2. On start-up, the Enterprise Vault applicati

An issue (2 of 6) was discovered in Veritas Enterprise Vault through 14.1.2. On start-up, the Enterprise Vault applicati

An issue (1 of 6) was discovered in Veritas Enterprise Vault through 14.1.2. On start-up, the Enterprise Vault applicati

b2evolution CMS v7.2.3 was discovered to contain a SQL injection vulnerability via the parameter cfqueryparam in the Use

b2evolution CMS v7.2.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the User login page. This vulne

snipe-it is vulnerable to Server-Side Request Forgery (SSRF)

Piwigo v11.5 was discovered to contain a SQL injection vulnerability via the parameter pwg_token in /admin/batch_manager

An SSRF issue was discovered in SquaredUp for SCOM 5.2.1.6654.

ThinkPHP v6.0.8 was discovered to contain a deserialization vulnerability via the component League\Flysystem\Cached\Stor

ThinkPHP v6.0.8 was discovered to contain a deserialization vulnerability via the component vendor\league\flysystem-cach

Wiki.js is a wiki app built on Node.js. Prior to version 2.5.254, directory traversal outside of Wiki.js context is poss

The software allows the attacker to upload or transfer files of dangerous types to the WebHMI portal, that may be automa

The authentication algorithm of the WebHMI portal is sound, but the implemented mechanism can be bypassed as the result

runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. In runc, netlink is

Invenio-Drafts-Resources is a submission/deposit module for Invenio, a software framework for research data management.

It was possible to bypass 2FA for LDAP users and access some specific pages with Basic Authentication in GitLab 14.1.1 a

Assuming a database breach, nonce reuse issues in GitLab 11.6+ allows an attacker to decrypt some of the database's encr

Successful exploitation of this vulnerability could allow an unauthorized user to access sensitive data.

When a user has admin rights in Serv-U Console, the user can move, create and delete any files are able to be accessed o

Serv-U server responds with valid CSRFToken when the request contains only Session.

The Photo Gallery by 10Web WordPress plugin before 1.5.68 is vulnerable to Reflected Cross-Site Scripting (XSS) issues v

The Registrations for the Events Calendar WordPress plugin before 2.7.6 does not sanitise and escape the event_id in the

The LoginWP (Formerly Peter's Login Redirect) WordPress plugin before 3.0.0.5 does not sanitise and escape the rul_login

The WOOCS WordPress plugin before 1.3.7.1 does not sanitise and escape the key parameter of the woocs_update_profiles_da