2021

Cross-Site Scripting (XSS) vulnerability exists in Csdn APP 4.10.0, which can be exploited by attackers to obtain sensit

ShowDoc 2.8.3 ihas a file upload vulnerability, where attackers can use the vulnerability to obtain server permissions.

All versions of yongyou PLM are affected by a command injection issue. UFIDA PLM (Product Life Cycle Management) is a st

The scheduler service running on a specific TCP port enables the user to start and stop jobs. There is no sanitation of

Many API function codes receive raw pointers remotely from the user and trust these pointers as valid in-bound memory re

There are multiple API function codes that permit reading and writing data to or from files and directories, which could

The database connection to the server is performed by calling a specific API, which could allow an unprivileged user to

The affected product’s code base doesn’t properly control arguments for specific functions, which could lead to a stack

There are multiple API function codes that permit data writing to any file, which may allow an attacker to modify existi

Many of the services used by the affected product do not specify full paths for the DLLs they are loading. An attacker c

A specific function code receives a raw pointer supplied by the user and deallocates this pointer. The user can then con

The webinstaller is a Golang web server executable that enables the generation of an Auvesy image agent. Resource consum

The affected product does not properly control the allocation of resources. A user may be able to allocate unlimited mem

The affected product uses a hard-coded blowfish key for encryption/decryption processes. The key can be easily extracted

The data of a network capture of the initial handshake phase can be used to authenticate at a SYSDBA level. If a specifi

The server permits communication without any authentication procedure, allowing the attacker to initiate a session with

The affected product’s OS Service does not verify any given parameter. A user can supply any type of parameter that will

Some API functions allow interaction with the registry, which includes reading values as well as data modification.

The affected product’s proprietary protocol CSC allows for calling numerous function codes. In order to call those funct

Some API functions permit by-design writing or copying data into a given buffer. Since the client controls these paramet

An issue was discovered in OpenPOWER 2.6 firmware. unpack_timestamp() calls le32_to_cpu() for endian conversion of a uin

As a result of an unquoted service path vulnerability present in the Kiwi CatTools Installation Wizard, a local attacker

The login portal for the Automated Logic WebCTRL/WebCTRL OEM web application contains a vulnerability that allows for re

Cross-Site Scripting vulnerability in McAfee ePolicy Orchestrator (ePO) prior to 5.10 Update 11 allows ePO administrator

Stored Cross-Site Scripting vulnerability in McAfee ePolicy Orchestrator (ePO) prior to 5.10 Update 11 allows ePO admini

A command injection vulnerability has been reported to affect QNAP device running Media Streaming add-on. If exploited,

Sulu is an open-source PHP content management system based on the Symfony framework. In versions before 1.6.43 are subje

Rasa is an open source machine learning framework to automate text-and voice-based conversations. In affected versions a

Reflected Cross-Site Scripting (XSS) vulnerability in WordPress Ivory Search plugin (versions <= 4.6.6). Vulnerable para

"HCL Connections Security Update for Reflected Cross-Site Scripting (XSS) Vulnerability"

Snudown is a reddit-specific fork of the Sundown Markdown parser used by GitHub, with Python integration added. In affec

Adobe Connect version 11.2.3 (and earlier) is affected by a Deserialization of Untrusted Data vulnerability to achieve a

The Leaky Paywall WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and

The Content Staging WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation a

The Easy Digital Downloads WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the $start_date and $end

The Catch Themes Demo Import WordPress plugin is vulnerable to arbitrary file uploads via the import functionality found

The LearnPress WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient escaping on the $custom

The Simple Job Board WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient escaping on the $

Version 3.3.23 of the Sassy Social Share WordPress plugin is vulnerable to PHP Object Injection via the wp_ajax_heateor_

Releases prior to VMware vRealize Operations Tenant App 8.6 contain an Information Disclosure Vulnerability.

An issue was discovered in stb stb_image.h 2.27. The PNM loader incorrectly interpreted 16-bit PGM files as 8-bit when c

An issue was discovered in stb stb_image.h 1.33 through 2.27. The HDR loader parsed truncated end-of-file RLE scanlines

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. In affected ve

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. All FreeRDP cl

qutebrowser is an open source keyboard-focused browser with a minimal GUI. Starting with qutebrowser v1.7.0, the Windows

This vulnerability occurred due to missing input sanitization for one of the output fields that is extracted from header

The HTTP interface was enabled for RabbitMQ Plugin in ARM 2020.2.6 and the ability to configure HTTPS was not available.

Each authenticated Orion Platform user in a MSP (Managed Service Provider) environment can view and browse all NetPath S

dp_link_settings_write in drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c in the Linux kernel through 5.14.14

IBM Standards Processing Engine (IBM Transformation Extender Advanced 9.0 and 10.0) does not set the secure attribute on