2021

Specific MongoDB Rust Driver versions can include credentials used by the connection pool to authenticate connections in

QSAN Storage Manager header page parameters does not filter special characters. Remote attackers can inject JavaScript w

In MB connect line mymbCONNECT24, mbCONNECT24 and Helmholz myREX24 and myREX24.virtual in all versions through v2.11.2 a

The WP LMS – Best WordPress LMS Plugin WordPress plugin through 1.1.2 does not properly sanitise or validate its User Fi

The Popular Brand Icons – Simple Icons WordPress plugin before 2.7.8 does not sanitise or validate some of its shortcode

The Calendar Event Multi View WordPress plugin before 1.4.01 does not sanitise or escape the 'start' and 'end' GET param

The Community Events WordPress plugin before 1.4.8 does not sanitise, validate or escape its importrowscount and success

The slider import search feature and tab parameter of the Post Grid WordPress plugin before 2.1.8 settings are not prope

The Any Hostname WordPress plugin through 1.0.6 does not sanitise or escape its "Allowed hosts" setting, leading to an a

The Event Geek WordPress plugin through 2.5.2 does not sanitise or escape its "Use your own " setting before outputting

The DrawBlog WordPress plugin through 0.90 does not sanitise or validate some of its settings before outputting them bac

The Bookshelf WordPress plugin through 2.0.4 does not sanitise or escape its "Paypal email address" setting before outpu

The Migrate Users WordPress plugin through 1.0.1 does not sanitise or escape its Delimiter option before outputting in a

The Steam Group Viewer WordPress plugin through 2.1 does not sanitise or escape its "Steam Group Address" settings befor

The Awesome Weather Widget WordPress plugin through 3.0.2 does not sanitize the id parameter of its awesome_weather_refr

The User Profile Picture WordPress plugin before 2.6.0 was affected by an IDOR issue, allowing users with the upload_ima

The Yada Wiki WordPress plugin before 3.4.1 did not sanitise, validate or escape the anchor attribute of its shortcode,

The Leaflet Map WordPress plugin before 3.0.0 does not escape some shortcode attributes before they are used in JavaScri

The YouTube Embed, Playlist and Popup by WpDevArt WordPress plugin before 2.3.9 did not escape, validate or sanitise som

The Tutor LMS – eLearning and online course solution WordPress plugin before 1.9.2 did not escape the Summary field of A

The User Registration, User Profiles, Login & Membership – ProfilePress (Formerly WP User Avatar) WordPress plugin befor

The User Registration & User Profile – Profile Builder WordPress plugin before 3.4.8 does not sanitise or escape its 'Mo

The TaxoPress – Create and Manage Taxonomies, Tags, Categories WordPress plugin before 3.0.7.2 does not sanitise its Tax

The About Me widget of the Youzify – BuddyPress Community, User Profile, Social Network & Membership WordPress plugin be

The RSS for Yandex Turbo WordPress plugin through 1.30 does not sanitise or escape some of its settings before saving an

The Floating Notification Bar, Sticky Menu on Scroll, and Sticky Header for Any Theme – myStickymenu WordPress plugin be

OpenPLC runtime V3 through 2016-03-14 allows stored XSS via the Device Name to the web server's Add New Device page.

In the Linux kernel through 5.13.7, an unprivileged BPF program can obtain sensitive information from kernel memory via

In the Linux kernel through 5.13.7, an unprivileged BPF program can obtain sensitive information from kernel memory via

Zoho ManageEngine Password Manager Pro before 11.2 11200 allows login/AjaxResponse.jsp?RequestType=GetUserDomainName&use

ObjectPlanet Opinio before 7.15 allows XXE attacks via three steps: modify a .css file to have <!ENTITY content, create

The module `AccessControl` defines security policies for Python code used in restricted code within Zope applications. R

In the Pro and Enterprise versions of GTranslate < 2.8.65, the gtranslate_request_uri_var function runs at the top of al

The SendGrid WordPress plugin is vulnerable to authorization bypass via the get_ajax_statistics function found in the ~/

A privileged escalation vulnerability has been identified in Micro Focus ZENworks Configuration Management, affecting ve

It was found in OpenShift, before version 4.8, that the generated certificate for the in-cluster Service CA, incorrectly

Improper Input Validation in Emerson GE Automation Proficy Machine Edition v8.0 allows an attacker to cause a denial of

Buffer Overflow in Emerson GE Automation Proficy Machine Edition v8.0 allows an attacker to cause a denial of service an

textview_uri_security_check in textview.c in Claws Mail before 3.18.0, and Sylpheed through 3.7.0, does not have suffici

app/View/GalaxyElements/ajax/index.ctp in MISP 2.4.147 allows Stored XSS when viewing galaxy cluster elements in JSON fo

app/View/Elements/GalaxyClusters/view_relation_tree.ctp in MISP 2.4.147 allows Stored XSS when viewing galaxy cluster re

ObjectPlanet Opinio before 7.14 allows reflected XSS via the survey/admin/surveyAdmin.do?action=viewSurveyAdmin query st

Meow hash 0.5/calico does not sufficiently thwart key recovery by an attacker who can query whether there's a collision

An integer overflow in util-linux through 2.37.1 can potentially cause a buffer overflow if an attacker were able to use

Telegram Web K Alpha 0.6.1 allows XSS via a document name.

In Charm 0.43, any two users can collude to achieve the ability to decrypt YCT14 data.

In Charm 0.43, any single user can decrypt DAC-MACS or MA-ABE-YJ14 data.

engineercms 1.03 is vulnerable to Cross Site Scripting (XSS). There is no escaping in the nickname field on the user lis

Nagios Log Server before 2.1.9 contains Stored XSS in the custom column view for the alert history and audit log functio

Nagios Log Server before 2.1.9 contains Reflected XSS in the dropdown box for the alert history and audit log function.