2021

Lucee Server is a dynamic, Java based (JSR-223), tag and scripting language used for rapid web application development.

The get-ip-range package before 4.0.0 for Node.js is vulnerable to denial of service (DoS) if the range is untrusted inp

Pelco Digital Sentry Server 7.18.72.11464 has an XML External Entity vulnerability (exploitable via the DTD parameter en

A null pointer dereference in Teradici PCoIP Soft Client versions prior to 20.07.3 could allow an attacker to crash the

An out of bounds write in Teradici PCoIP soft client versions prior to version 20.10.1 could allow an attacker to remote

Under certain conditions, Teradici PCoIP Agents for Windows prior to version 20.10.0 and Teradici PCoIP Agents for Linux

The Host Authorization middleware in Action Pack before 6.1.2.1, 6.0.3.5 suffers from an open redirect vulnerability. Sp

The PostgreSQL adapter in Active Record before 6.1.2.1, 6.0.3.5, 5.2.4.5 suffers from a regular expression denial of ser

Advantech iView versions prior to v5.7.03.6112 are vulnerable to a SQL injection, which may allow an attacker to escalat

Advantech iView versions prior to v5.7.03.6112 are vulnerable to directory traversal, which may allow an attacker to rea

Advantech iView versions prior to v5.7.03.6112 are vulnerable to a SQL injection, which may allow an unauthorized attack

Access to the Advantech iView versions prior to v5.7.03.6112 configuration are missing authentication, which may allow a

Wire is an open-source collaboration platform. In Wire for iOS (iPhone and iPad) before version 3.75 there is a vulnerab

hyper is an open-source HTTP library for Rust (crates.io). In hyper from version 0.12.0 and before versions 0.13.10 and

A flaw was found in podman before 1.7.0. File permissions for non-root users running in a privileged container are not c

A vulnerability was found in openvswitch. A limitation in the implementation of userspace packet parsing can allow a mal

Oclean Mobile Application 2.1.2 communicates with an external website using HTTP so it is possible to eavesdrop the netw

A flaw was found in Keycloak 7.0.1. A logged in user can do an account email enumeration attack.

An Anti CSRF mechanism was discovered missing in the Teradici Cloud Access Connector v31 and earlier in a specific web f

Certain web application pages in the authenticated section of the Teradici Cloud Access Connector prior to v18 were acce

A vulnerability was found in keycloak in the way that the OIDC logout endpoint does not have CSRF protection. Versions s

IBM Security Verify Information Queue 1.0.6 and 1.0.7 could allow a user to perform unauthorized activities due to impro

IBM Security Verify Information Queue 1.0.6 and 1.0.7 could allow a user on the network to cause a denial of service due

IBM Security Verify Information Queue 1.0.6 and 1.0.7 is vulnerable to cross-site request forgery which could allow an a

IBM Security Verify Information Queue 1.0.6 and 1.0.7 could allow a remote attacker to obtain sensitive information when

IBM Case Manager 5.2 and 5.3 and IBM Business Automation Workflow 18.0, 19.0, and 20.0 are vulnerable to cross-site scri

A Insecure Temporary File vulnerability in skuba of SUSE CaaS Platform 4.5 allows local attackers to leak the bootstrapT

A Incorrect Permission Assignment for Critical Resource vulnerability in skuba of SUSE CaaS Platform 4.5 allows local at

A Insecure Temporary File vulnerability in openldap2 of SUSE Linux Enterprise Server 15-LTSS, SUSE Linux Enterprise Serv

A Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Open Build Servi

All versions of package is-user-valid are vulnerable to LDAP Injection which can lead to either authentication bypass or

For MongoDB Ops Manager versions prior to and including 4.2.24 with multiple OM application servers, that have SSL turne

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Tencent WeChat 7.0.18.

This vulnerability allows remote attackers to create arbitrary files on affected installations of SolarWinds Orion Platf

This vulnerability allows remote attackers to disclose sensitive information on affected installations of SolarWinds Ori

Fluent Bit 1.6.10 has a NULL pointer dereference when an flb_malloc return value is not validated by flb_avro.c or http_

The samba-client package before 4.0.0 for Node.js allows command injection because of the use of process.exec.

The Trend Micro Security 2020 and 2021 families of consumer products are vulnerable to a code injection vulnerability wh

A stack-based buffer overflow vulnerability exists in the Objparser::objparse() functionality of Prusa Research PrusaSli

An out-of-bounds write vulnerability exists in the Obj.cpp load_obj() functionality of Prusa Research PrusaSlicer 2.2.0

In SoftMaker Software GmbH SoftMaker Office PlanMaker 2021 (Revision 1014), a specially crafted document can cause the d

PNPSCADA 2.200816204020 allows cross-site scripting (XSS), which can execute arbitrary JavaScript in the victim's browse

An out-of-bounds write vulnerability exists in the PSD Header processing functionality of Accusoft ImageGear 19.8. A spe

A denial-of-service vulnerability exists in the HTTP Server functionality of Micrium uC-HTTP 3.01.00. A specially crafte

In SoftMaker Software GmbH SoftMaker Office PlanMaker 2021 (Revision 1014), a specially crafted document can cause the d

A heap overflow vulnerability exists in the way the GIF parser decodes LZW compressed streams in Accusoft ImageGear 19.8

An out-of-bounds write vulnerability exists in the SGI RLE decompression functionality of Accusoft ImageGear 19.8. A spe

An out-of-bounds write vulnerability exists in the TIFF parser of Accusoft ImageGear 19.8. A specially crafted malformed

An internal product security audit of Lenovo XClarity Administrator (LXCA) prior to version 3.1.0 discovered the Windows

Fleet is an open source osquery manager. In Fleet before version 3.7.0 a malicious actor with a valid node key can send