2021

An issue was discovered in UiPath Assistant 21.4.4. User-controlled data supplied to the --process-start argument of the

UiPath Assistant 21.4.4 will load and execute attacker controlled data from the file path supplied to the --dev-widget a

The RegistrationMagic WordPress plugin made it possible for unauthenticated users to log in as any site user, including

Internally used text extraction reports allow an attacker to inject code that can be executed by the application. An att

If configured to use an Oracle database and if a query is created using the flexible search java api with a parameterize

glFusion CMS 1.7.9 is affected by an access control vulnerability via /public_html/users.php.

taocms 3.0.2 is vulnerable to arbitrary file deletion via taocms\include\Model\file.php from line 60 to line 72.

There is an upload sql injection vulnerability in the background of taocms 3.0.2 in parameter id:action=cms&ctrl=update&

The olm_session_describe function in Matrix libolm before 3.2.7 is vulnerable to a buffer overflow. The Olm session obje

glFusion CMS v1.7.9 is affected by an arbitrary user impersonation vulnerability in /public_html/comment.php. The attack

A vulnerability has been identified in SiPass integrated V2.76 (All versions), SiPass integrated V2.80 (All versions), S

A vulnerability has been identified in SiPass integrated V2.76 (All versions), SiPass integrated V2.80 (All versions), S

A type confusion vulnerability could be triggered when resolving the "typeof" unary operator in Facebook Hermes prior to

IBM Spectrum Protect Plus 10.1.0.0 through 10.1.8.x uses Cross-Origin Resource Sharing (CORS) which could allow an attac

A remote code execution vulnerability in the BMP image codec of BlackBerry QNX SDP version(s) 6.4 to 7.1 could allow an

IBM Spectrum Copy Data Management 2.2.13 and earlier could allow a remote attacker to execute arbitrary commands on the

IBM Spectrum Copy Data Management 2.2.13 and earlier could allow a remote attacker to access the Spring Boot console wit

A Missing Authentication vulnerability in RobotWare for the OmniCore robot controller allows an attacker to read and mod

SQL injection bypass authentication vulnerability in PHPGURUKUL Employee Record Management System 1.2 via index.php. An

fastadmin v1.2.1 is affected by a file upload vulnerability which allows arbitrary code execution through shell access.

The LearnPress WordPress plugin before 4.1.4 does not sanitise, validate and escape the id parameter before using it in

The Modern Events Calendar Lite WordPress plugin before 6.1.5 does not sanitise and escape the time parameter before usi

The Pixel Cat WordPress plugin before 2.6.2 does not have CSRF check when saving its settings, and did not sanitise as w

The WP Block and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection Plugin StopBadBots WordPress plugin before

The ToTop Link WordPress plugin through 1.7.1 passes base64 encoded user input to the unserialize() PHP function, which

An issue was discovered in Reprise RLM 14.2. Because /goform/change_password_process does not verify authentication or a

A stack-based buffer overflow in handle_request function in DHT.c in toxcore 0.1.9 through 0.1.11 and 0.2.0 through 0.2.

The CLI 1.0.0 for Amazon AWS OpenSearch has weak permissions for the configuration file.

Zoho ManageEngine Desktop Central is vulnerable to authentication bypass, leading to remote code execution on the server

The package md-to-pdf before 5.0.0 are vulnerable to Remote Code Execution (RCE) due to utilizing the library gray-matte

Remote Code Execution (RCE) vulnerability exists in MaxSite CMS v107.5 via the Documents page.

IBM PowerVM Hypervisor FW860, FW940, and FW950 could allow an attacker that gains service access to the FSP can read and

Zip Slip vulnerability in Pluck-CMS Pluck 4.7.15 allows an attacker to upload specially crafted zip files, resulting in

Due to insufficient server-side login-attempt limit enforcement, a vulnerability in /account/login in Huntflow Enterpris

An issue was discovered in Digi TransPort DR64, SR44 VC74, and WR. The ZING protocol allows arbitrary remote command exe

Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in con

Etherpad is a real-time collaborative editor. In versions prior to 1.8.16, an attacker can craft an `*.etherpad` file th

OpUtils in Zoho ManageEngine OpManager 12.5 before 125490 mishandles authentication for a few audit directories.

Doctrine DBAL 3.x before 3.1.4 allows SQL Injection. The escaping of offset and length inputs to the generation of a LIM

An Incorrect Access Control vulnerability exists in zzcms less than or equal to 2019 via admin.php. After disabling Java

An SQL Injection vulnerability exists in Premiumdatingscript 4.2.7.7 via the ip parameter in connect.php. .

An Incorrect Access Control vulnerability exists in Premiumdatingscript 4.2.7.7 via the password change procedure in req

A command execution vulnerability exists in the wifi_country_code_update functionality of the home_security binary of An

An unprotected ssh private key exists on the Gryphon devices which could be used to achieve root access to a server affi

wbce_cms is vulnerable to Improper Neutralization of Special Elements used in an SQL Command

An out-of-bounds read flaw was found in the CLARRV, DLARRV, SLARRV, and ZLARRV functions in lapack through version 3.10.

A code injection vulnerability in the Ivanti EPM Cloud Services Appliance (CSA) allows an unauthenticated user to execut

NSS (Network Security Services) versions prior to 3.73 or 3.68.1 ESR are vulnerable to a heap overflow when handling DER

The iframe sandbox rules were not correctly applied to XSLT stylesheets, allowing an iframe to bypass restrictions such

An unauthenticated attacker is able to send a special HTTP request, that causes a service to crash. In case of a standal