2021

An issue was discovered in PJSIP in Asterisk before 16.19.1 and before 18.5.1. To exploit, a re-INVITE without SDP must

isomorphic-git before 1.8.2 allows Directory Traversal via a crafted repository.

The node management page in SolarWinds Orion Platform before 2020.2.5 HF1 allows an attacker to create or delete a node

OX Documents before 7.10.5-rev5 has Incorrect Access Control for documents that contain XML structures because hash coll

OX Documents before 7.10.5-rev7 has Incorrect Access Control for converted documents because hash collisions can occur,

OX Documents before 7.10.5-rev5 has Incorrect Access Control of converted images because hash collisions can occur, due

Open redirect vulnerability in GroupSession (GroupSession Free edition from ver2.2.0 to the version prior to ver5.1.0, G

Server-side request forgery (SSRF) vulnerability in GroupSession (GroupSession Free edition from ver2.2.0 to the version

Cross-site scripting vulnerability in GroupSession (GroupSession Free edition from ver2.2.0 to the version prior to ver5

Cross-site request forgery (CSRF) vulnerability in GroupSession (GroupSession Free edition from ver2.2.0 to the version

Cross-site scripting vulnerability in GroupSession (GroupSession Free edition from ver2.2.0 to the version prior to ver5

An exposure of sensitive information vulnerability exists in TCExam <= 14.8.1. If a password reset request was made for

A stored cross-site scripting vulnerability exists in TCExam <= 14.8.1. Valid files uploaded via tce_select_mediafile.ph

A stored cross-site scripting vulnerability exists in TCExam <= 14.8.1. Valid files uploaded via tce_filemanager.php wit

Cross Site Scripting (XSS) vulnerability in NukeViet cms 4.4.0 via the editor in the News module.

Cross Site Scripting vulnerabiity exists in WDScanner 1.1 in the system management page.

A stored cross site scripting (XSS) vulnerability in /app/config/of S-CMS PHP v3.0 allows attackers to execute arbitrary

A stored cross site scripting (XSS) vulnerability in /app/form_add/of S-CMS PHP v3.0 allows attackers to execute arbitra

A cross site scripting (XSS) vulnerability in S-CMS PHP v3.0 allows attackers to execute arbitrary web scripts or HTML v

Cross Site Scripting (XSS) vulnerabiity in YzmCMS 5.2 via the site_code parameter in admin/index/init.html.

Cross Site Scripting (XSS) vulnerability in HuCart 5.7.4 via nickname in index.php.

eGain Chat 15.5.5 allows XSS via the Name (aka full_name) field.

Stored XSS can execute as administrator in quarantined email detail view in Sophos UTM before version 9.706.

The package glances before 3.2.1 are vulnerable to XML External Entity (XXE) Injection via the use of Fault to parse unt

Dell EMC Avamar Server contains an open redirect vulnerability. A remote unauthenticated attacker may exploit this vulne

The PowerVM Logical Partition Mobility(LPM) (PowerVM Hypervisor FW920, FW930, FW940, and FW950) encryption key exchange

All versions of package deepmergefn are vulnerable to Prototype Pollution via deepMerge function.

This affects all versions of package curly-bracket-parser. When used as a template library, it does not properly sanitiz

IBM Jazz Foundation products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary

IBM Jazz Foundation products are vulnerable to server side request forgery (SSRF). This may allow an authenticated attac

K3s in SUSE Rancher allows any user with direct access to the datastore, or a copy of a datastore backup, to extract the

This affects the package video.js before 7.14.3. The src attribute of track tag allows to bypass HTML escaping and execu

Dell EMC Isilon OneFS supported versions 8.1 and later and Dell EMC PowerScale OneFS supported version 9.0.0 contain an

xmldom is an open source pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. x

Discourse is an open source discussion platform. In versions prior to 2.7.7 there are two bugs which led to the post cre

Nextcloud Richdocuments in an open source self hosted online office. Nextcloud uses the WOPI ("Web Application Open Plat

IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 5.2.6.5_3 and 6.1.0.0 through 6.1.0.2 vulnerable to cross-s

Cross Site Scripting (XSS) vulnerability in NavigateCMS NavigateCMS 2.9 via the name="wrong_path_redirect" feature.

Cross Site Scripting (XSS) vulnerability in NavigateCMS 2.9 when performing a Create or Edit via the Tools feature.

Cross Site Scripting (XSS) vulnerability in CMS Made Simple 2.2.14 in "Extra" via 'News > Article" feature.

Cross Site Scripting (XSS) vulnerablity in CMS Made Simple 2.2.14 via the Logic field in the Content Manager feature.

ArchiSteamFarm is a C# application with primary purpose of idling Steam cards from multiple accounts simultaneously. In

Cross Site Scripting (XSS) vulnerability in Textpattern CMS 4.8.1 via Custom fields in the Menu Preferences feature.

Cross Site Scripting (XSS) vulnerability in Evolution CMS 2.0.2 via the Document Manager feature.

Cross Site Scripting (XSS) vulnerabiity exists in LavaLite CMS 5.8.0 via the Menu Blocks feature, which can be bypassed

ArchiSteamFarm is a C# application with primary purpose of idling Steam cards from multiple accounts simultaneously. Due

In RPCMS v1.8 and below, the "nickname" variable is not properly sanitized before being displayed on page. Attacker can

In RPCMS v1.8 and below, the "nickname" variable is not properly sanitized before being displayed on page. When the API

The CheckMK management web console (versions 1.5.0 to 2.0.0) does not sanitise user input in various parameters of the W

mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Co