2021

IBM Edge 4.2 could reveal sensitive version information about the server from error pages that could aid an attacker in

OpenVPN Access Server 2.9.0 through 2.9.4 allow remote attackers to inject arbitrary web script or HTML via the web logi

Authenticated Persistent Cross-Site Scripting (XSS) vulnerability in WordPress Popular Posts plugin (versions <= 5.3.3).

A CSRF in Concrete CMS version 8.5.5 and below allows an attacker to clone topics which can lead to UI inconvenience, an

Concrete CMS prior to 8.5.6 had a CSFR vulnerability allowing attachments to comments in the conversation section to be

A CSRF in Concrete CMS version 8.5.5 and below allows an attacker to duplicate files which can lead to UI inconvenience,

The vCenter Server contains a denial-of-service vulnerability in the Analytics service. Successful exploitation of this

The vCenter Server contains an arbitrary file deletion vulnerability in a VMware vSphere Life-cycle Manager plug-in. A m

Rhttproxy as used in vCenter Server contains a vulnerability due to improper implementation of URI normalization. A mali

The vCenter Server contains a reflected cross-site scripting vulnerability due to a lack of input sanitization. An attac

vCenter Server contains an unauthenticated API endpoint vulnerability in vCenter Server Content Library. A malicious act

The vCenter Server contains a local information disclosure vulnerability in the Analytics service. An authenticated user

The vCenter Server contains an SSRF (Server Side Request Forgery) vulnerability due to improper validation of URLs in vC

A vulnerability in the CLI of Cisco IOS XE SD-WAN Software and Cisco IOS XE Software could allow an authenticated, local

A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to inject arbitrary com

A vulnerability in the CLI of Cisco IOS XE SD-WAN Software could allow an authenticated, local attacker to inject arbitr

A vulnerability in the Cisco IOS XE SD-WAN Software CLI could allow an authenticated, local attacker to elevate privileg

A vulnerability in a specific CLI command that is run on Cisco IOS XE SD-WAN Software could allow an authenticated, loca

A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, rem

A vulnerability in the Voice Telephony Service Provider (VTSP) service of Cisco IOS Software and Cisco IOS XE Software c

A vulnerability in the Link Layer Discovery Protocol (LLDP) message parser of Cisco IOS Software and Cisco IOS XE Softwa

A vulnerability in the Protection Against Distributed Denial of Service Attacks feature of Cisco IOS XE Software could a

A vulnerability in the access control list (ACL) programming of Cisco ASR 900 and ASR 920 Series Aggregation Services Ro

A vulnerability in the Zone-Based Policy Firewall feature of Cisco IOS XE Software could allow an unauthenticated, remot

A vulnerability in the H.323 application level gateway (ALG) used by the Network Address Translation (NAT) feature of Ci

A vulnerability in the Cisco IOS XE SD-WAN Software CLI could allow an authenticated, local attacker to overwrite arbitr

A vulnerability in the disaster recovery feature of Cisco SD-WAN vManage Software could allow an authenticated, remote a

A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to access sensitive inf

CMS Made Simple 2.2.14 was discovered to contain a cross-site scripting (XSS) vulnerability which allows attackers to ex

The vCenter Server contains a denial-of-service vulnerability due to improper XML entity parsing. A malicious actor with

The Ninja Forms WordPress plugin is vulnerable to arbitrary email sending via the trigger_email_action function found in

The Ninja Forms WordPress plugin is vulnerable to sensitive information disclosure via the bulk_export_submissions funct

Improper privilege management vulnerability in maconfig for McAfee Agent for Windows prior to 5.7.4 allows a local user

MaianAffiliate v1.0 allows an authenticated administrative user to save an XSS to the database.

The Telefication WordPress plugin is vulnerable to Open Proxy and Server-Side Request Forgery via the ~/bypass.php file

Some components in Apache Kafka use `Arrays.equals` to validate a password or key, which is vulnerable to timing attacks

Heap-buffer overflow in the randomize_iparp function in edit_packet.c. of Tcpreplay v4.3.2 allows attackers to cause a d

An issue was discovered in gpac 0.8.0. The stbl_GetSampleSize function in isomedia/stbl_read.c has a heap-based buffer o

An issue was discovered in gpac 0.8.0. The OD_ReadUTF8String function in odf_code.c has a heap-based buffer overflow whi

in-toto-golang is a go implementation of the in-toto framework to protect software supply chain integrity. In affected v

Cross Site Scripting (XSS) vulnerability exists in ManageEngine OPManager <=12.5.174 when the API key contains an XML-ba

Cross Site Scripting (XSS) vlnerability exists in WUZHI CMS up to and including 4.1.0 in the config function in corefram

In Cloudron 6.2, the returnTo parameter on the login page is vulnerable to Reflected XSS.

This affects the package jointjs before 3.4.2. A type confusion vulnerability can lead to a bypass of CVE-2020-28480 whe

This affects the package edge.js before 5.3.2. A type confusion vulnerability can be used to bypass input sanitization w

IBM PowerVM Hypervisor FW860, FW930, FW940, and FW950 could allow a local user to create a specially crafted sequence of

An issue related to modification of otherwise restricted files through a locally authenticated attacker exists in FlexNe

Zoho ManageEngine ADSelfService Plus before 6112 is vulnerable to mail spoofing.

An information disclosure vulnerability exists in AMD Platform Security Processor (PSP) chipset driver. The discretionar

Cross-site scripting vulnerability due to the inadequate tag sanitization in GROWI versions v4.2.19 and earlier allows r