2021

Tufin SecureChange prior to R19.3 HF3 and R20-1 HF1 are vulnerable to stored XSS. The successful exploitation requires a

Nagios Log Server 2.1.7 contains a cross-site scripting (XSS) vulnerability in /nagioslogserver/configure/create_snapsho

OpenEMR 5.0.1 allows an authenticated attacker to upload and execute malicious PHP scripts through /controller.php.

Vtiger CRM v7.2.0 allows an attacker to display hidden files, list directories by using /libraries and /layout directori

Reflected XSS in Vtiger CRM v7.2.0 in vtigercrm/index.php? through the view parameter can result in an attacker performi

Reflected XSS in Medintux v2.16.000 CCAM.php by manipulating the mot1 parameter can result in an attacker performing mal

Local file inclusion in FHEM 6.0 allows in fhem/FileLog_logWrapper file parameter can allow an attacker to include a fil

The Stockdio Historical Chart plugin before 2.8.1 for WordPress is affected by Cross Site Scripting (XSS) via stockdio_c

In SOOIL Developments Co., Ltd Diabecare RS, AnyDana-i and AnyDana-A, the communication protocol of the insulin pump and

In SOOIL Developments Co., Ltd Diabecare RS, AnyDana-i and AnyDana-A, a client-side control vulnerability in the insulin

In SOOIL Developments Co., Ltd Diabecare RS, AnyDana-i and AnyDana-A, a client-side control vulnerability in the insulin

Apache Guacamole 1.2.0 and earlier do not consistently restrict access to connection history based on user visibility. I

In SOOIL Developments Co., Ltd Diabecare RS, AnyDana-i and AnyDana-A, the communication protocol of the insulin pump and

In SOOIL Developments Co., Ltd Diabecare RS, AnyDana-i and AnyDana-A, an information disclosure vulnerability in the com

In SOOIL Developments Co., Ltd Diabecare RS, AnyDana-i and AnyDana-A, a hard-coded physician PIN in the physician menu o

Laravel is a web application framework. Versions of Laravel before 6.20.11, 7.30.2 and 8.22.1 contain a query binding ex

SDL (Simple DirectMedia Layer) through 2.0.12 has a heap-based buffer over-read in Blit_3or4_to_3or4__inversed_rgb in vi

SDL (Simple DirectMedia Layer) through 2.0.12 has an Integer Overflow (and resultant SDL_memcpy heap corruption) in SDL_

Clustered Data ONTAP versions prior to 9.3P20 and 9.5 are susceptible to a vulnerability which could allow an authentica

A flaw was found in jackson-databind before 2.9.10.7. FasterXML mishandles the interaction between serialization gadgets

In TinyCheck before commits 9fd360d and ea53de8, the installation script of the tool contained hard-coded credentials to

SOOIL Developments Co Ltd DiabecareRS,AnyDana-i & AnyDana-A, the communication protocol of the insulin pump and its AnyD

SOOIL Developments CoLtd DiabecareRS, AnyDana-i, AnyDana-A, The communication protocol of the insulin pump and AnyDana-i

SOOIL Developments CoLtd DiabecareRS, AnyDana-i ,AnyDana-A, communication protocol of the insulin pump & AnyDana-i,AnyDa

MISP 2.4.136 has XSS via a crafted URL to the app/View/Elements/global_menu.ctp user homepage favourite button.

MISP 2.4.136 has XSS via galaxy cluster element values to app/View/GalaxyElements/ajax/index.ctp. Reference types could

MISP 2.4.136 has Stored XSS in the galaxy cluster view via a cluster name to app/View/GalaxyClusters/view.ctp.

The default setting of MISP 2.4.136 did not enable the requirements (aka require_password_confirmation) to provide the p

XML External Entity Injection vulnerability in Micro Focus Application Lifecycle Management (Previously known as Quality

IBM Planning Analytics 2.0 could allow a remote attacker to obtain sensitive information, caused by the lack of server h

IBM Planning Analytics 2.0 could allow an attacker to obtain sensitive information due to an overly permissive CORS poli

IBM Planning Analytics 2.0 allows web pages to be stored locally which can be read by another user on the system. IBM X-

Zoho ManageEngine Applications Manager before 14 build 14880 allows an authenticated SQL Injection via a crafted Alarmvi

Files.com Fat Client 3.3.6 allows authentication bypass because the client continues to have access after a logout and a

D-Link DCS-5220 devices have a buffer overflow. NOTE: This vulnerability only affects products that are no longer suppor

rfc822.c in Mutt through 2.0.4 allows remote attackers to cause a denial of service (mailbox unavailability) by sending

This affects the package fastify-csrf before 3.0.0. 1. The generated cookie used insecure defaults, and did not have the

The package socket.io before 2.4.0 are vulnerable to Insecure Defaults due to CORS Misconfiguration. All domains are whi

The package jointjs before 3.3.0 are vulnerable to Prototype Pollution via util.setByPath (https://resources.jointjs.com

The package jointjs before 3.3.0 are vulnerable to Denial of Service (DoS) via the unsetByPath function.

Mautic before 3.2.4 is affected by stored XSS. An attacker with access to Social Monitoring, an application feature, cou

Mautic before 3.2.4 is affected by stored XSS. An attacker with permission to manage companies, an application feature,

A CSRF vulnerability exists in Anchor CMS 0.12.7 anchor/views/users/edit.php that can change the Delete admin users.

Pixelimity 1.0 has cross-site request forgery via the admin/setting.php data [Password] parameter.

Bleichenbacher's attack on PKCS #1 v1.5 padding for RSA in Microchip Libraries for Applications 2018-11-26 All up to 201

This affects the package gsap before 3.6.0.

This affects all versions of package immer.

This affects the package @aws-sdk/shared-ini-file-loader before 1.0.0-rc.9; the package aws-sdk before 2.814.0. If an at

HGiga EIP product contains SQL Injection vulnerability. Attackers can inject SQL commands into specific URL parameter (o

HGiga EIP product contains SQL Injection vulnerability. Attackers can inject SQL commands into specific URL parameter (d