2021

When ORT (now via atstccfg) generates ip_allow.config files in Apache Traffic Control 3.0.0 to 3.1.0 and 4.0.0 to 4.1.0,

FPWIN Pro is vulnerable to an out-of-bounds read vulnerability when a user opens a maliciously crafted project file, whi

In A2DP_GetCodecType of a2dp_codec_config, there is a possible out-of-bounds read due to improper input validation. This

LuCI in OpenWrt 18.06.0 through 18.06.4 allows stored XSS via a crafted SSID.

IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to an XML External Entity Injection (XXE) attack w

IBM Spectrum Scale 5.0.0 through 5.0.5.4 and 5.1.0 could allow a local user to poison log files which could impact suppo

The MediaWiki "Report" extension has a Cross-Site Request Forgery (CSRF) vulnerability. Before fixed version, there was

ORAS is open source software which enables a way to push OCI Artifacts to OCI Conformant registries. ORAS is both a CLI

An XML external entity (XXE) injection vulnerability was discovered in the Nutch DmozParser and is known to affect Nutch

When handler-router component is enabled in servicecomb-java-chassis, authenticated user may inject some data and cause

M&M Software fdtCONTAINER Component in versions below 3.5.20304.x and between 3.6 and 3.6.20304.x is vulnerable to deser

Pepperl+Fuchs Comtrol IO-Link Master in Version 1.5.48 and below is prone to a NULL Pointer Dereference that leads to a

Pepperl+Fuchs Comtrol IO-Link Master in Version 1.5.48 and below is prone to an authenticated blind OS Command Injection

Pepperl+Fuchs Comtrol IO-Link Master in Version 1.5.48 and below is prone to an authenticated reflected POST Cross-Site

Pepperl+Fuchs Comtrol IO-Link Master in Version 1.5.48 and below is prone to a Cross-Site Request Forgery (CSRF) in the

OctopusDSC is a PowerShell module with DSC resources that can be used to install and configure an Octopus Deploy Server

Online Invoicing System (OIS) is open source software which is a lean invoicing system for small businesses, consultants

This affects the package vis-timeline before 7.4.4. An attacker with the ability to control the items of a Timeline elem

HedgeDoc is open source software which lets you create real-time collaborative markdown notes. In HedgeDoc before versio

IBM MQ Internet Pass-Thru 2.1 and 9.2 could allow a remote user to cause a denial of service by sending malformed MQ dat

Hyweb HyCMS-J1 backend editing function does not filter special characters. Users after log-in can inject JavaScript syn

Hyweb HyCMS-J1's API fail to filter POST request parameters. Remote attackers can inject SQL syntax and execute commands

Kubernetes Java client libraries in version 10.0.0 and versions prior to 9.0.1 allow writes to paths outside of the curr

Kubernetes CSI snapshot-controller prior to v2.1.3 and v3.0.2 could panic when processing a VolumeSnapshot custom resour

Kubernetes Secrets Store CSI Driver versions v0.0.15 and v0.0.16 allow an attacker who can modify a SecretProviderClassP

Kubernetes Secrets Store CSI Driver Vault Plugin prior to v0.0.6, Azure Plugin prior to v0.0.10, and GCP Plugin prior to

Kubernetes API server in all versions allow an attacker who is able to create a ClusterIP service and set the spec.exter

OnlineVotingSystem is an open source project hosted on GitHub. OnlineVotingSystem before version 1.1.2 hashes user passw

PySAML2 is a pure python implementation of SAML Version 2 Standard. PySAML2 before 6.5.0 has an improper verification of

PySAML2 is a pure python implementation of SAML Version 2 Standard. PySAML2 before 6.5.0 has an improper verification of

IBM Security Identity Governance and Intelligence 5.2.6 could allow a remote attacker to obtain sensitive information, c

IBM Security Identity Governance and Intelligence 5.2.6 uses weaker than expected cryptographic algorithms that could al

IBM Security Identity Governance and Intelligence 5.2.6 does not set the secure attribute on authorization tokens or ses

IBM Security Identity Governance and Intelligence 5.2.6 does not perform any authentication for functionality that requi

OpenMage is a community-driven alternative to Magento CE. In OpenMage before versions 19.4.10 and 20.0.5, an administrat

OpenMage is a community-driven alternative to Magento CE. In OpenMage before versions 19.4.10 and 20.0.5, there is a vul

Possible out of bound memory access in audio due to integer underflow while processing modified contents in Snapdragon A

Local privilege escalation in admin services in Windows environment can occur due to an arbitrary read issue.

Possible memory out of bound issue during music playback when an incorrect bit stream content is copied into array witho

Pointer variable which is freed is not cleared can result in memory corruption and leads to denial of service in Snapdra

Out of bound access in WLAN driver due to lack of validation of array length before copying into array in Snapdragon Aut

A possible double free or invalid memory access in audio driver while reading Speaker Protection parameters in Snapdrago

Buffer over read can happen in video driver when playing clip with atomsize having value UINT32_MAX in Snapdragon Auto,

An out of bounds read can happen when processing VSA attribute due to improper minimum required length check in Snapdrag

Buffer over-read while processing NDL attribute if attribute length is larger than expected and then FW is treating it a

Out of bound reads might occur in while processing Service descriptor due to improper validation of length of fields in

Out of bounds reads while parsing NAN beacons attributes and OUIs due to improper length of field check in Snapdragon Au

Buffer over-read while parsing RPS due to lack of check of input validation on values received from user side. in Snapdr

Possible integer overflow can occur when stream info update is called when total number of streams detected are zero whi

Out of bound issue in WLAN driver while processing vdev responses from firmware due to lack of validation of data receiv