2021

Delta Electronic DOPSoft 2 (Version 2.00.07 and prior) lacks proper validation of user-supplied data when parsing specif

A Denial of Service vulnerability has been identified in FlexNet Publisher's lmadmin.exe version 11.16.6. A certain mess

nLight ECLYPSE (nECY) system Controllers running software prior to 1.17.21245.754 contain a default key vulnerability. T

Improper input validation in the National Instruments NI-PAL driver in versions 20.0.0 and prior may allow a privileged

An issue was discovered in CMS Made Simple 2.2.8. It is possible to achieve unauthenticated path traversal in the CGExte

The Device42 Main Appliance before 17.05.01 does not sanitize user input in its Nmap Discovery utility. An attacker (wit

The Device42 Remote Collector before 17.05.01 does not sanitize user input in its SNMP Connectivity utility. This allows

A buffer overflow vulnerability in McAfee Data Loss Prevention (DLP) Discover prior to 11.6.100 allows an attacker in th

A buffer overflow vulnerability in McAfee Data Loss Prevention (DLP) Endpoint for Windows prior to 11.6.200 allows a loc

Improper privileges management vulnerability in McAfee Endpoint Security (ENS) Windows prior to 10.7.0 September 2021 Up

This affects all versions of package @cookiex/deep. The global proto object can be polluted using the __proto__ object.

code-server is vulnerable to Inefficient Regular Expression Complexity

ansi-regex is vulnerable to Inefficient Regular Expression Complexity

taro is vulnerable to Inefficient Regular Expression Complexity

nth-check is vulnerable to Inefficient Regular Expression Complexity

Possible integer and heap overflow due to lack of input command size validation while handling beacon template update co

Possible Integer overflow to buffer overflow issue can occur due to improper validation of input parameters when extscan

Use-after-free vulnerability in kernel graphics driver because of storing an invalid pointer in Snapdragon Compute, Snap

Null pointer dereference occurs due to improper validation when the preemption feature enablement is toggled in Snapdrag

object-path is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

Certain NETGEAR smart switches are affected by a \n injection in the web UI's password field, which - due to several fau

libde265 v1.0.4 contains a heap buffer overflow in the ff_hevc_put_unweighted_pred_8_sse function, which can be exploite

IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) could disclose sensitive information when using ADMIN_

Apache Tomcat 8.5.0 to 8.5.63, 9.0.0-M1 to 9.0.43 and 10.0.0-M1 to 10.0.2 did not properly validate incoming TLS packets

A vulnerability in XML processing in Apache Jena, in versions up to 4.1.0, may allow an attacker to execute XML External

mitmproxy is an interactive, SSL/TLS-capable intercepting proxy. In mitmproxy 7.0.2 and below, a malicious client or ser

A carefully crafted request uri-path can cause mod_proxy_uwsgi to read above the allocated memory and crash (DoS). This

Malformed requests may cause the server to dereference a NULL pointer. This issue affects Apache HTTP Server 2.4.48 and

There is command injection in the meshd program in the routing system, resulting in command execution under administrato

Affected versions of Atlassian Jira Server or Data Center using the Jira Service Management addon allow remote attackers

Improper access control in Jfinal CMS 5.1.0 allows attackers to access sensitive information via /classes/conf/db.proper

An arbitrary file upload vulnerability in Jizhicms v1.5 allows attackers to execute arbitrary code via a crafted .jpg fi

An arbitrary file upload vulnerability in RGCMS v1.06 allows attackers to execute arbitrary code via a crafted .txt file

An arbitrary file write vulnerability in RGCMS v1.06 allows attackers to execute arbitrary code via a crafted PHP file.

HashiCorp Terraform Enterprise up to v202108-1 contained an API endpoint that erroneously disclosed a sensitive URL to a

The SAP NetWeaver Portal, versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, component Iviews Editor contains a Server

The Service Layer of SAP Business One, version - 10.0, allows an authenticated attacker to invoke certain functions that

SAP Business One, version - 10.0, allows a local attacker with access to the victim's browser under certain circumstance

SAP Business One, version - 10.0, allows an attacker with business authorization to upload any files (including script f

SAP Cloud Connector, version - 2.0, allows the upload of zip files as backup. This backup file can be tricked to inject

A Cross-Site Request Forgery (CSRF) vulnerability exists in TinyFileManager all version up to and including 2.4.6 that a

Jitsi Meet is an open source video conferencing application. In versions prior to 2.0.5963, a Prosody module allows the

IBM QRadar SIEM 7.3 and 7.4 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt h

A maliciously crafted DWG file in Autodesk Navisworks 2019, 2020, 2021, 2022 can be forced to write beyond allocated bou

A maliciously crafted DWG file in Autodesk Navisworks 2019, 2020, 2021, 2022 can be forced to read beyond allocated boun

semver-regex is vulnerable to Inefficient Regular Expression Complexity

A Memory Corruption vulnerability for PDF files in Autodesk Navisworks 2019, 2020, 2021, 2022 may lead to code execution

A maliciously crafted PDF file in Autodesk Navisworks 2019, 2020, 2021, 2022 can be forced to read beyond allocated boun

MetInfo 7.0.0 contains a Cross-Site Request Forgery (CSRF) via admin/?n=admin&c=index&a=doSaveInfo.

GLPI is a free Asset and IT management software package. In versions prior to 9.5.6, a user who is logged in to GLPI can