2021

The Weather Effect WordPress plugin before 1.3.4 does not have any CSRF checks in place when saving its settings, and do

The Duplicate Page WordPress plugin through 4.4.2 does not sanitise or escape the Duplicate Post Suffix settings before

The Simple Social Media Share Buttons WordPress plugin before 3.2.4 does not escape the Share Title settings before outp

The Coming soon and Maintenance mode WordPress plugin before 3.5.3 does not properly sanitize inputs submitted by authen

The Easy Accordion WordPress plugin before 2.0.22 does not properly sanitize inputs when adding new items to an accordio

The Frontend Uploader WordPress plugin through 1.3.2 does not prevent HTML files from being uploaded via its form, allow

The WP HTML Author Bio WordPress plugin through 1.2.0 does not sanitise the HTML allowed in the Bio of users, allowing t

/way4acs/enroll in OpenWay WAY4 ACS before 1.2.278-2693 allows unauthenticated attackers to leverage response difference

OpenWay WAY4 ACS before 1.2.278-2693 allows XSS via the /way4acs/enroll action parameter.

It is possible for an attacker to manipulate the timestamp of signed documents. All versions of Apache OpenOffice up to

MediaWiki before 1.36.2 allows a denial of service (resource consumption because of lengthy query processing time). Visi

MediaWiki before 1.36.2 allows XSS. Month related MediaWiki messages are not escaped before being used on the Special:Se

An issue was discovered in Zammad before 5.0.1. In some cases, there is improper enforcement of the privilege requiremen

The Unicorn framework before 0.36.1 for Django allows XSS via a component. NOTE: this issue exists because of an incompl

Inappropriate implementation in Memory in Google Chrome prior to 94.0.4606.71 allowed a remote attacker to obtain potent

Incorrect security UI in Web Browser UI in Google Chrome prior to 94.0.4606.54 allowed a remote attacker to spoof the co

Inappropriate implementation in Background Fetch API in Google Chrome prior to 94.0.4606.54 allowed a remote attacker to

Inappropriate implementation in Background Fetch API in Google Chrome prior to 94.0.4606.54 allowed a remote attacker wh

Inappropriate implementation in Compositing in Google Chrome on Android prior to 94.0.4606.54 allowed a remote attacker

Inappropriate implementation in Background Fetch API in Google Chrome prior to 94.0.4606.54 allowed a remote attacker to

Side-channel information leakage in DevTools in Google Chrome prior to 94.0.4606.54 allowed a remote attacker to bypass

Inappropriate implementation in Navigation in Google Chrome on Windows prior to 94.0.4606.54 allowed a remote attacker t

The "File upload question" functionality in LimeSurvey 3.x-LTS through 3.27.18 allows XSS in assets/scripts/modaldialog.

Inappropriate implementation in Blink in Google Chrome prior to 93.0.4577.82 allowed a remote attacker who had compromis

IBM App Connect Enterprise Certified Container 1.0, 1.1, 1.2, 1.3, 1.4 and 1.5 could disclose sensitive information to a

IBM Sterling File Gateway 2.2.0.0 through 6.1.1.0 could allow an authenticated user to obtain sensitive information due

A flaw was found in postgresql. Using an UPDATE ... RETURNING command on a purpose-crafted table, an authenticated datab

Uncontrolled resource consumption in Mitsubishi Electric MELSEC iQ-R series C Controller Module R12CCPU-V Firmware Versi

Tad Uploader edit book list function is vulnerable to authorization bypass, thus remote attackers can use the function t

webTareas version 2.4 and earlier allows an authenticated user to inject arbitrary web script or HTML due to incorrect s

webTareas version 2.4 and earlier allows an authenticated user to store arbitrary web script or HTML by creating or edit

Verint Workforce Optimization (WFO) 15.2.5.1033 allows HTML injection via the /wfo/control/signin username parameter.

Tad Web is vulnerable to authorization bypass, thus remote attackers can exploit the vulnerability to use the original f

The new add subject parameter of Tad Uploader view book list function fails to filter special characters. Unauthenticate

TadTools special page parameter does not properly restrict the input of specific characters, thus remote attackers can i

Tad Honor viewing book list function is vulnerable to authorization bypass, thus remote attackers can use special parame

Tad Book3 editing book function does not filter special characters. Unauthenticated attackers can remotely inject JavaSc

An XML external entity (XXE) vulnerability in Alkacon OpenCms 11.0, 11.0.1 and 11.0.2 allows remote authenticated users

A Denial-of-Service (DoS) vulnerability was discovered in F-Secure Atlant whereby the AVRDL unpacking module component u

A Denial-of-Service (DoS) vulnerability was discovered in F-Secure Atlant whereby the AVPACK module component used in ce

A local attacker could read or write arbitrary files with administrator privileges in HitmanPro before version Build 318

A local attacker could execute arbitrary code with administrator privileges in HitmanPro.Alert before version Build 901.

Zulip is an open source team chat server. In affected versions Zulip allows organization administrators on a server to c

JEECMS x1.1 contains a stored cross-site scripting (XSS) vulnerability in the component of /member-vipcenter.htm, which

An issue was discovered in Zammad before 4.1.1. The Chat functionality allows XSS because clipboard data is mishandled.

An issue was discovered in Zammad before 4.1.1. An admin can discover the application secret via the API.

An issue was discovered in Zammad before 4.1.1. There is stored XSS via a custom Avatar.

An issue was discovered in Zammad before 4.1.1. An attacker with valid agent credentials may send a series of crafted re

An issue was discovered in Zammad before 4.1.1. Stored XSS may occur via an Article during addition of an attachment to

Extensible Service Proxy, a.k.a. ESP is a proxy which enables API management capabilities for JSON/REST or gRPC API serv