2021

The user identification mechanism used by CyberArk Credential Provider prior to 12.1 is susceptible to a local host race

Affected versions of Atlassian Jira Server and Data Center allow users who have watched an issue to continue receiving u

WTCMS 1.0 contains a stored cross-site scripting (XSS) vulnerability in the link address field under the background link

WTCMS 1.0 contains a stored cross-site scripting (XSS) vulnerability in the link field under the background menu managem

WTCMS 1.0 contains a stored cross-site scripting (XSS) vulnerability in the source field under the article management mo

WTCMS 1.0 contains a reflective cross-site scripting (XSS) vulnerability in the page management background which allows

WTCMS 1.0 contains a reflective cross-site scripting (XSS) vulnerability in the keyword search function under the backgr

WTCMS 1.0 contains a cross-site request forgery (CSRF) vulnerability in the index.php?g=admin&m=nav&a=add_post component

GlobalNewFiles is a MediaWiki extension maintained by Miraheze. Prior to commit number cee254e1b158cdb0ddbea716b1d3edc31

This affects the package mpath before 0.8.4. A type confusion vulnerability can lead to a bypass of CVE-2018-16490. In p

This affects the package immer before 9.0.6. A type confusion vulnerability can lead to a bypass of CVE-2020-28477 when

IBM Planning Analytics 2.0 could expose information that could be used to to create attacks by not validating the return

IBM Planning Analytics 2.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary Jav

IBM Planning Analytics 2.0 could allow a remote attacker to obtain sensitive information when a stack trace is returned

The underConstruction plugin <= 1.18 for WordPress echoes out the raw value of `$GLOBALS['PHP_SELF']` in the ucOptions.p

Adobe Bridge version 11.1 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a m

Adobe Connect version 11.2.2 (and earlier) is affected by a Reflected Cross-site Scripting vulnerability that could be a

Adobe Connect version 11.2.2 (and earlier) is affected by a Reflected Cross-site Scripting vulnerability that could be a

Adobe Connect version 11.2.2 (and earlier) is affected by a secure design principles violation vulnerability via the 'pb

XMP Toolkit SDK version 2020.1 (and earlier) is affected by an Integer Overflow vulnerability potentially resulting in a

XMP Toolkit SDK version 2020.1 (and earlier) is affected by a buffer overflow vulnerability potentially resulting in arb

Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an imprope

Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an imprope

Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an imprope

Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by a stored c

Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by a stored c

Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by a business

Adobe Captivate version 11.5.5 (and earlier) is affected by an Creation of Temporary File In Directory With Incorrect Pe

This affects all versions of package Proto. It is possible to inject pollute the object property of an application using

OpenEMR 6.0.0 has a pnotes_print.php?noteid= Insecure Direct Object Reference vulnerability via which an attacker can re

CyberArk Identity 21.5.131, when handling an invalid authentication attempt, sometimes reveals whether the username is v

User with Orion Platform Admin Rights could store XSS through URL POST parameter in CreateExternalWebsite website.

An issue was discovered in OpenStack Neutron before 16.4.1, 17.x before 17.2.1, and 18.x before 18.1.1. Authenticated at

A stored cross-site scripting (XSS) vulnerability exists in FileBrowser < v2.16.0 that allows an authenticated user auth

Use of a hard-coded cryptographic key in MIK.starlight 7.9.5.24363 allows local users to decrypt credentials via unspeci

The function AdminGetFirstFileContentByFilePath in MIK.starlight 7.9.5.24363 allows (by design) an authenticated attacke

HashiCorp Vault Enterprise 0.9.2 through 1.6.2 allowed the read of license metadata from DR secondaries without authenti

A flaw has been found in libssh in versions prior to 0.9.6. The SSH protocol keeps track of two shared secrets during th

An information disclosure exists in Brave Browser Desktop prior to version 1.28.62, where logged warning messages that i

A security researcher stored XSS via a Help Server setting. This affects customers using Internet Explorer, because they

Jenkins Nomad Plugin 0.7.4 and earlier stores Docker passwords unencrypted in the global config.xml file on the Jenkins

Cross Site Scripting (XSS) in MyBB v1.8.20 allows remote attackers to inject arbitrary web script or HTML via the "Descr

Cross Site Scripting (XSS) in MyBB v1.8.20 allows remote attackers to inject arbitrary web script or HTML via the "Title

Cross Site Scripting (XSS) in S-CMS v1.0 allows remote attackers to execute arbitrary code via the component '/admin/tpl

Improper Access Control Tampering Vulnerability using ImportAlert function which can lead to a Remote Code Execution (RC

ExportToPdfCmd Arbitrary File Read Information Disclosure Vulnerability using ImportAlert function within the Alerts Set

Any cookie-stealing vulnerabilities within the application or browser would enable an attacker to steal the user's crede

In PEPPERL+FUCHS WirelessHART-Gateway 3.0.8 it is possible to inject arbitrary JavaScript into the application's respons

In PEPPERL+FUCHS WirelessHART-Gateway <= 3.0.9 a form contains a password field with autocomplete enabled. The stored cr

In PEPPERL+FUCHS WirelessHART-Gateway <= 3.0.8 a vulnerability may allow remote attackers to rewrite links and URLs in c