2021

Delta Electronics DIALink versions 1.2.4.0 and prior insecurely loads libraries, which may allow an attacker to use DLL

Delta Electronics DIALink versions 1.2.4.0 and prior is vulnerable to cross-site scripting because an authenticated atta

Delta Electronics DIALink versions 1.2.4.0 and prior is vulnerable to cross-site scripting because an authenticated atta

Delta Electronics DIALink versions 1.2.4.0 and prior is vulnerable to cross-site scripting because an authenticated atta

Possible system denial of service in case of arbitrary changing Firefox browser parameters. An attacker could change spe

In Druid 1.2.3, visiting the path with parameter in a certain function can lead to directory traversal.

The parse function in llhttp < 2.1.4 and < 6.0.6. ignores chunk extensions when parsing the body of chunked requests. Th

HP Print and Scan Doctor may potentially be vulnerable to local elevation of privilege.

HP has identified a security vulnerability with the I.R.I.S. OCR (Optical Character Recognition) software available with

Cross Site Scripting (XSS) vulnerability exists in Sourcecodester Simple Subscription Website 1.0 via the id parameter i

SQL Injection vulnerability exists in Sourcecodester. Simple Subscription Website 1.0. via the login.

Grafana is an open-source platform for monitoring and observability. In affected versions if an attacker is able to conv

nbdime provides tools for diffing and merging of Jupyter Notebooks. In affected versions a stored cross-site scripting (

This affects all versions of package json-pointer. A type confusion vulnerability can lead to a bypass of CVE-2020-7709

This affects the package jsonpointer before 5.0.0. A type confusion vulnerability can lead to a bypass of a previous Pro

This affects the package tempura before 0.4.0. If the input to the esc function is of type object (i.e an array) it is r

This affects the package dotty before 0.1.2. A type confusion vulnerability can lead to a bypass of CVE-2021-25912 when

This affects the package json-ptr before 3.0.0. A type confusion vulnerability can lead to a bypass of CVE-2020-7766 whe

This affects versions before 1.19.1 of package bootstrap-table. A type confusion vulnerability can lead to a bypass of i

PHP-CMS v1.0 was discovered to contain a SQL injection vulnerability in the component search.php via the search paramete

ED01-CMS v1.0 was discovered to contain a SQL injection in the component cposts.php via the cid parameter.

An arbitrary file upload vulnerability in the image upload function of ED01-CMS v1.0 allows attackers to execute arbitra

ED01-CMS v1.0 was discovered to contain a reflective cross-site scripting (XSS) vulnerability in the component sposts.ph

A stack-based buffer under-read in htmldoc before 1.9.12, allows attackers to cause a denial of service via a crafted BM

An issue was discoverered in in function xls_getWorkSheet in xls.c in libxls 1.6.2, allows attackers to cause a denial o

An issue was discoverered in in customercentric-selling-poland PlayTube, allows authenticated attackers to execute arbit

An issue was found in /showReports.do Zoho ManageEngine Applications Manager up to 14550, allows attackers to gain escal

SQL Injection vulnerability in eyoucms cms v1.4.7, allows attackers to execute arbitrary code and disclose sensitive inf

An issue was discovered in function StartPage in text2pdf.c in pdfcorner text2pdf 1.1, allows attackers to cause denial

Buffer overflow vulnerability in Renleilei1992 Linux_Network_Project 1.0, allows attackers to execute arbitrary code, vi

Chamilo LMS version 1.11.10 contains an XSS vulnerability in the personal profile edition form, affecting the user him/h

Buffer overflow vulnerability in function convert_colorspace in heif_colorconversion.cc in libheif v1.6.2, allows attack

Cross Site Scripting (XSS) vulnerability in shadoweb wdja v1.5.1, allows attackers to execute arbitrary code and gain es

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in the stats-over-http plugin of Ap

Improper Input Validation vulnerability in accepting socket connections in Apache Traffic Server allows an attacker to m

Improper Authentication vulnerability in TLS origin verification of Apache Traffic Server allows for man in the middle a

Improper Input Validation vulnerability in header parsing of Apache Traffic Server allows an attacker to smuggle request

Improper input validation vulnerability in header parsing of Apache Traffic Server allows an attacker to smuggle request

Improper input validation vulnerability in header parsing of Apache Traffic Server allows an attacker to smuggle request

LibreNMS through 21.10.2 allows XSS via a widget title.

An SQL Injection vulnerability exists in Sourcecodester Customer Relationship Management System (CRM) 1.0 via the userna

Pandora FMS through 755 allows XSS via a new Event Filter with a crafted name.

With an admin account, the .htaccess file in Artica Pandora FMS <=755 can be overwritten with the File Manager component

In Mahara before 20.04.5, 20.10.3, 21.04.2, and 21.10.0, the account associated with a web services token is vulnerable

In Mahara before 20.04.5, 20.10.3, 21.04.2, and 21.10.0, exported CSV files could contain characters that a spreadsheet

An exposure of sensitive information to an unauthorized actor [CWE-200] vulnerability in FortiManager 7.0.1 and below, 6

An issue was discovered in Fimer Aurora Vision before 2.97.10. The response to a failed login attempt discloses whether

An issue was discovered in Fimer Aurora Vision before 2.97.10. An attacker can (in the WebUI) obtain plant information w

Affected versions of Atlassian Jira Server and Data Center allow a remote attacker who has had their access revoked from

Certain HP Enterprise LaserJet, HP LaserJet Managed, HP Enterprise PageWide, HP PageWide Managed products may be vulnera