2021

The evm crate is a pure Rust implementation of Ethereum Virtual Machine. In `evm` crate `< 0.31.0`, `JUMPI` opcode's con

OpenOlat is a web-based e-learning platform for teaching, learning, assessment and communication, an LMS, a learning man

Backstage is an open platform for building developer portals. In affected versions A malicious actor could read sensitiv

ASUSTek ZenBook Pro Due 15 UX582 laptop firmware through 203 has Insecure Permissions that allow attacks by a physically

An issue was discovered in function sofia_handle_sip_i_notify in sofia.c in SignalWire freeswitch before 1.10.6, may all

IBM Business Automation Workflow 18.0, 19.0, 20.0, and 21.0 is vulnerable to cross-site scripting. This vulnerability al

This affects the package vm2 before 3.9.4 via a Prototype Pollution attack vector, which can lead to execution of arbitr

The bluemonday sanitizer before 1.0.16 for Go, and before 0.0.8 for Python (in pybluemonday), does not properly enforce

The OWASP Java HTML Sanitizer before 20211018.1 does not properly enforce policies associated with the SELECT, STYLE, an

Apache Superset up to and including 1.3.0 when configured with ENABLE_TEMPLATE_PROCESSING on (disabled by default) allow

Apache Superset up to and including 1.1 does not sanitize titles correctly on the Explore page. This allows an attacker

An incomplete permission check on entries in Devolutions Remote Desktop Manager before 2021.2.16 allows attackers to byp

The in-memory certificate cache in strongSwan before 5.9.4 has a remote integer overflow upon receiving many requests wi

The gmp plugin in strongSwan before 5.9.4 has a remote integer overflow via a crafted certificate with an RSASSA-PSS sig

The Gutenberg PDF Viewer Block WordPress plugin before 1.0.1 does not sanitise and escape its block, which could allow u

The MainWP Child Reports WordPress plugin before 2.0.8 does not validate or sanitise the order parameter before using it

Multiple Plugins from the CatchThemes vendor do not perform capability and CSRF checks in the ctp_switch AJAX action, wh

The Podcast Subscribe Buttons WordPress plugin before 1.4.2 allows users with any role capable of editing or adding post

The Tutor LMS WordPress plugin before 1.9.9 does not escape some of its settings before outputting them in attributes, w

The Easy Download Manager and File Sharing Plugin with frontend file upload – a better Media Library — Shared Files Word

The Compact WP Audio Player WordPress plugin before 1.9.7 does not implement nonce checks, which could allow attackers t

The Compact WP Audio Player WordPress plugin before 1.9.7 does not escape some of its shortcodes attributes, which could

The PDF Flipbook, 3D Flipbook WordPress – DearFlip WordPress plugin before 1.7.10 does not escape the class attribute of

The LearnPress WordPress plugin before 4.1.3.1 does not properly sanitize or escape various inputs within course setting

The WordPress PDF Light Viewer Plugin WordPress plugin before 1.4.12 allows users with Author roles to execute arbitrary

The Find My Blocks WordPress plugin before 3.4.0 does not have authorisation checks in its REST API, which could allow u

The One User Avatar WordPress plugin before 2.3.7 does not check for CSRF when updating the Avatar in page where the [av

The One User Avatar WordPress plugin before 2.3.7 does not escape the link and target attributes of its shortcode, allow

The Scroll Baner WordPress plugin through 1.0 does not have CSRF check in place when saving its settings, nor perform an

The Customer Service Software & Support Ticket System WordPress plugin before 5.10.4 does not sanitize or escape form fi

The GamePress WordPress plugin through 1.1.0 does not escape the op_edit POST parameter before outputting it back in mul

The Wechat Reward WordPress plugin through 1.7 does not sanitise or escape its QR settings, nor has any CSRF check in pl

The Sociable WordPress plugin through 4.3.4.1 does not sanitise or escape some of its settings before outputting them in

The Wp Cookie Choice WordPress plugin through 1.1.0 is lacking any CSRF check when saving its options, and do not escape

The PlanSo Forms WordPress plugin through 2.6.3 does not escape the title of its Form before outputting it in attributes

The StreamCast – Radio Player for WordPress plugin before 2.1.1 does not sanitise or validate the parameters from its sh

The Polo Video Gallery – Best wordpress video gallery plugin WordPress plugin through 1.2 does not sanitise or validate

The Easy Twitter Feed WordPress plugin before 1.2 does not sanitise or validate the parameters from its shortcode, allow

The Html5 Audio Player – Audio Player for WordPress plugin before 2.1.3 does not sanitise or validate the parameters fro

FATEK Automation WinProladder versions 3.30 and prior lacks proper validation of user-supplied data when parsing project

FATEK Automation WinProladder versions 3.30 and prior is vulnerable to an out-of-bounds read, which may allow an attacke

A use after free vulnerability in FATEK Automation WinProladder versions 3.30 and prior may be exploited when a valid us

FATEK Automation WinProladder versions 3.30 and prior lacks proper validation of user-supplied data when parsing project

FATEK Automation WinProladder versions 3.30 and prior lacks proper validation of user-supplied data when parsing project

FATEK Automation WinProladder versions 3.30 and prior proper validation of user-supplied data when parsing project files

FATEK Automation WinProladder versions 3.30 and prior lacks proper validation of user-supplied data when parsing project

Advantech WebAccess versions 9.02 and prior are vulnerable to a stack-based buffer overflow, which may allow an attacker

Advantech WebAccess versions 9.02 and prior are vulnerable to a heap-based buffer overflow, which may allow an attacker

A code injection vulnerability exists within the firewall software of GlassWire v2.1.167 that could lead to arbitrary co

A possible open redirect vulnerability in the Host Authorization middleware in Action Pack >= 6.0.0 that could allow att