2021

In mjs_json.c in Cesanta MongooseOS mJS 1.26, a maliciously formed JSON string can trigger an off-by-one heap-based buff

ManageWiki is an extension to the MediaWiki project. The 'wikiconfig' API leaked the value of private configuration vari

AVE DOMINAplus <=1.10.x suffers from clear-text credentials disclosure vulnerability that allows an unauthenticated atta

AVE DOMINAplus <=1.10.x suffers from an authentication bypass vulnerability due to missing control check when directly c

SQL Injection in PHPSHE Mall System v1.7 allows remote attackers to execute arbitrary code by injecting SQL commands int

An arbitrary code execution vulnerability exists in Micro Focus Application Performance Management, affecting versions 9

The sensitive information of webcam device is not properly protected. Remote attackers can unauthentically grant adminis

The manage users profile services of the network camera device allows an authenticated. Remote attackers can modify URL

Externally controlled reference to a resource in another sphere in quarantine functionality in Synology Antivirus Essent

A SQL Injection vulnerability in the REST API in Layer5 Meshery 0.5.2 allows an attacker to execute arbitrary SQL comman

PHPMailer 6.1.8 through 6.4.0 allows object injection through Phar Deserialization via addAttachment with a UNC pathname

Hidden functionality in multiple Buffalo network devices (BHR-4RV firmware Ver.2.55 and prior, FS-G54 firmware Ver.2.04

Requests is a HTTP library written in PHP. Requests mishandles deserialization in FilteredIterator. The issue has been p

Apache OFBiz has unsafe deserialization prior to 17.12.07 version

Apache OFBiz has unsafe deserialization prior to 17.12.07 version An unauthenticated user can perform an RCE attack

HomeAutomation 3.3.2 suffers from an authentication bypass vulnerability when spoofing client IP address using the X-For

An input validation flaw in the Symantec Security Analytics web UI 7.2 prior 7.2.7, 8.1, prior to 8.1.3-NSR3, 8.2, prior

Delta Industrial Automation COMMGR Versions 1.12 and prior are vulnerable to a stack-based buffer overflow, which may al

Unbound before 1.9.5 allows an out-of-bounds write via a compressed name in rdata_copy. NOTE: The vendor disputes that t

Unbound before 1.9.5 allows an integer overflow in a size calculation in respip/respip.c. NOTE: The vendor disputes that

Unbound before 1.9.5 allows an integer overflow in a size calculation in dnscrypt/dnscrypt.c. NOTE: The vendor disputes

Unbound before 1.9.5 allows an out-of-bounds write in sldns_bget_token_par. NOTE: The vendor disputes that this is a vul

Unbound before 1.9.5 allows an integer overflow in sldns_str2wire_dname_buf_origin, leading to an out-of-bounds write. N

Unbound before 1.9.5 allows an integer overflow in the regional allocator via the ALIGN_UP macro. NOTE: The vendor dispu

Unbound before 1.9.5 allows an integer overflow in the regional allocator via regional_alloc. NOTE: The vendor disputes

Gestsup before 3.2.10 allows account takeover through the password recovery functionality (remote). The affected compone

HedgeDoc (formerly known as CodiMD) is an open-source collaborative markdown editor. An attacker is able to receive arbi

Use after free in navigation in Google Chrome prior to 90.0.4430.85 allowed a remote attacker who had compromised the re

Integer overflow in Mojo in Google Chrome prior to 90.0.4430.85 allowed a remote attacker who had compromised the render

Use after free in permissions in Google Chrome prior to 90.0.4430.72 allowed a remote attacker who had compromised the r

A weak password requirement vulnerability exists in the Create New User function of MintHCM RELEASE 3.0.8, which could l

An access control vulnerability in Hame SD1 Wi-Fi firmware <=V.20140224154640 allows an attacker to get system administr

Prototype pollution vulnerability in 'safe-obj' versions 1.0.0 through 1.0.2 allows an attacker to cause a denial of ser

Prototype pollution vulnerability in 'safe-flat' versions 2.0.0 through 2.0.1 allows an attacker to cause a denial of se

Aterm WG2600HS firmware Ver1.5.1 and earlier allows an attacker to execute arbitrary OS commands via unspecified vectors

Missing authentication for critical function in DAP-1880AC firmware version 1.21 and earlier allows a remote attacker to

Webmin 1.973 is affected by reflected Cross Site Scripting (XSS) to achieve Remote Command Execution through Webmin's ru

Akuvox C315 115.116.2613 allows remote command Injection via the cfgd_server service. The attack vector is sending a pay

The unofficial vscode-ghc-simple (aka Simple Glasgow Haskell Compiler) extension before 0.2.3 for Visual Studio Code all

An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. GitLab was not properly validati

Pulse Connect Secure 9.0R3/9.1R1 and higher is vulnerable to an authentication bypass vulnerability exposed by the Windo

Apache Maven will follow repositories that are defined in a dependency’s Project Object Model (pom) which may be surpris

The xmlhttprequest-ssl package before 1.6.1 for Node.js disables SSL certificate validation by default, because rejectUn

Vulnerability in the Oracle Cloud Infrastructure Storage Gateway product of Oracle Storage Gateway (component: Managemen

Vulnerability in the Oracle Cloud Infrastructure Storage Gateway product of Oracle Storage Gateway (component: Managemen

Vulnerability in the Oracle Cloud Infrastructure Storage Gateway product of Oracle Storage Gateway (component: Managemen

Vulnerability in the Oracle Cloud Infrastructure Storage Gateway product of Oracle Storage Gateway (component: Managemen

Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: OPSS). Supported

Vulnerability in the Oracle Storage Cloud Software Appliance product of Oracle Storage Gateway (component: Management Co

Vulnerability in the Oracle Advanced Supply Chain Planning product of Oracle Supply Chain (component: Core). Supported v