2021

All versions of package launchpad are vulnerable to Command Injection via stop.

Polr is an open source URL shortener. in Polr before version 2.3.0, a vulnerability in the setup process allows attacker

ASUS RT-AX86U router firmware below version under 9.0.0.4_386 has a buffer overflow in the blocking_request.cgi function

Variable underflow exists in accel-ppp radius/packet.c when receiving a RADIUS vendor-specific attribute with length fie

Monal before 4.9 does not implement proper sender verification on MAM and Message Carbon (XEP-0280) results. This allows

An issue was discovered on Mofi Network MOFI4500-4GXeLTE 4.1.5-std devices. The authentication function passes untrusted

An issue was discovered on Mofi Network MOFI4500-4GXeLTE 4.1.5-std devices. The authentication function contains undocum

An issue was discovered on Mofi Network MOFI4500-4GXeLTE 4.1.5-std devices. The Dropbear SSH daemon has been modified to

An issue was discovered on Mofi Network MOFI4500-4GXeLTE 4.0.8-std devices. A format error in /etc/shadow, coupled with

An issue was discovered on Mofi Network MOFI4500-4GXeLTE 3.6.1-std and 4.0.8-std devices. They contain two undocumented

In Nim before 1.2.6, the standard library asyncftpclient lacks a check for whether a message contains a newline characte

TerraMaster TOS before 4.1.29 has Invalid Parameter Checking that leads to code injection as root. This is a dynamic cla

An issue was discovered on D-Link DIR-825 R1 devices through 3.0.1 before 2020-11-20. A buffer overflow in the web inter

Foris before 101.1.1, as used in Turris OS, lacks certain HTML escaping in the login template.

A library index page in NuPoint Messenger in Mitel MiCollab before 9.2 FP1 could allow an unauthenticated attacker to ga

An issue was discovered in Deserializer::read_vec in the cdr crate before 0.2.4 for Rust. A user-provided Read implement

Deserialization of untrusted data in the login page of ASSUWEB 359.3 build 1 subcomponent of ACA ASSUREX RENTES product

IBM MQ 7.5, 8.0, 9.0, 9.1, 9.2 LTS, and 9.2 CD could allow a remote attacker to execute arbitrary code on the system, ca

A cross-site scripting (XSS) vulnerability in the assets component of Mautic before 3.2.4 allows remote attackers to inj

An issue was discovered on Accfly Wireless Security IR Camera System 720P with software versions v3.10.73 through v4.15.

An issue was discovered on Accfly Wireless Security IR Camera System 720P with software versions v3.10.73 through v4.15.

An issue was discovered on Accfly Wireless Security IR Camera System 720P with software versions v3.10.73 through v4.15.

An issue was discovered on Accfly Wireless Security IR Camera 720P System with software versions v3.10.73 through v4.15.

WinSCP before 5.17.10 allows remote attackers to execute arbitrary programs when the URL handler encounters a crafted UR

Monitorix 3.13.0 allows remote attackers to bypass Basic Authentication in a default installation (i.e., an installation

condor_credd in HTCondor before 8.9.11 allows Directory Traversal outside the SEC_CREDENTIAL_DIRECTORY_OAUTH directory,

phpList 3.5.3 allows type juggling for login bypass because == is used instead of === for password hashes, which mishand

oscommerce v2.3.4.1 has a functional problem in user registration and password rechecking, where a non-identical passwor

WeBid 1.2.2 admin/newuser.php has an issue with password rechecking during registration because it uses a loose comparis

The ftpd gem 0.2.1 for Ruby allows remote attackers to execute arbitrary OS commands via shell metacharacters in a LIST

The affected product is vulnerable to an out-of-bounds read, which may allow an attacker to obtain and disclose sensitiv

The affected product is vulnerable to a heap-based buffer overflow, which may allow an attacker to manipulate memory wit

Sagemcom F@ST 3686 v2 3.495 devices have a buffer overflow via a long sessionKey to the goform/login URI.

SQL injection exists in Spotweb 1.4.9 because the notAllowedCommands protection mechanism is inadequate, e.g., a variati

Local Service Search Engine Management System 1.0 has a vulnerability through authentication bypass using SQL injection

Directory traversal with remote code execution can occur in /upload in ONLYOFFICE Document Server before 5.6.3, when JWT

Improper access and command validation in the Nagios Docker Config Wizard before 1.1.2, as used in Nagios XI through 5.7

The async-git package before 1.13.2 for Node.js allows OS Command Injection via shell metacharacters, as demonstrated by

phpList 3.6.0 allows CSV injection, related to the email parameter, and /lists/admin/ exports.

A flaw was found in the gstreamer h264 component of gst-plugins-bad before v1.18.1 where when parsing a h264 header, an

An issue was discovered in the containers crate before 0.9.11 for Rust. When a panic occurs, a util::{mutate,mutate2} do

An issue was discovered in the bra crate before 0.1.1 for Rust. It lacks soundness because it can read uninitialized mem

An issue was discovered in the smallvec crate before 0.6.14 and 1.x before 1.6.1 for Rust. There is a heap-based buffer

Use of Hard-coded Credentials in the database of Bosch FSM-2500 server and Bosch FSM-5000 server up to and including ver

TinyCheck before commits 9fd360d and ea53de8 was vulnerable to command injection due to insufficient checks of input par

Student Result Management System In PHP With Source Code is affected by SQL injection. An attacker can able to access of

EgavilanMedia User Registration & Login System 1.0 is affected by SQL injection to the admin panel, which may allow arbi

An issue was discovered on Geeni GNC-CW013 doorbell 1.8.1 devices. A vulnerability exists in the Telnet service that all

A CWE-20: Improper Input Validation vulnerability exists in EcoStruxure™ Operator Terminal Expert and Pro-face BLUE (ver

IBM InfoSphere Information Server 8.5.0.0 is affected by deserialization of untrusted data which could allow remote unau