2021

Modern DRAM devices (PC-DDR4, LPDDR4X) are affected by a vulnerability in their internal Target Row Refresh (TRR) mitiga

A flaw was found in Apache ShenYu Admin. The incorrect use of JWT in ShenyuAdminBootstrap allows an attacker to bypass a

An attacker-controlled pointer free in Busybox's hush applet leads to denial of service and possible code execution when

cron-utils is a Java library to define, parse, validate, migrate crons as well as get human readable descriptions for th

Grafana is an open-source platform for monitoring and observability. In affected versions when the fine-grained access c

Sourcecodester Online Learning System 2.0 is vunlerable to sql injection authentication bypass in admin login file (/adm

A directory traversal issue in ResourceSpace 9.6 before 9.6 rev 18277 allows remote unauthenticated attackers to delete

A SQL injection issue in pages/edit_fields/9_ajax/add_keyword.php of ResourceSpace 9.5 and 9.6 < rev 18274 allows remote

An improper handling of exceptional conditions vulnerability exists in Open Design Alliance ODA Viewer sample before 202

The NetConfig UI administrative interface in Extreme Networks ExtremeWireless Aerohive HiveOS and IQ Engine through 10.0

Laravel Framework through 8.70.2 does not sufficiently block the upload of executable PHP content because Illuminate/Val

The npm ci command in npm 7.x and 8.x through 8.1.3 proceeds with an installation even if dependency information in pack

The PING function on the TP-Link TL-WR840N EU v5 router with firmware through TL-WR840N(EU)_V5_171211 is vulnerable to r

json-schema is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

The server in Jamf Pro before 10.32.0 has an SSRF vulnerability, aka PI-006352. NOTE: Jamf Nation will also publish an a

OpenZeppelin Contracts is a library for smart contract development. In affected versions upgradeable contracts using `UU

Possible buffer overflow due to lack of parameter length check during MBSSID scan IE parse in Snapdragon Compute, Snapdr

Possible heap overflow due to improper length check of domain while parsing the DNS response in Snapdragon Auto, Snapdra

Information disclosure through timing and power side-channels during mod exponentiation for RSA-CRT in Snapdragon Auto,

Broadcom Emulex HBA Manager/One Command Manager versions before 11.4.425.0 and 12.8.542.31, if not installed in Strictly

Broadcom Emulex HBA Manager/One Command Manager versions before 11.4.425.0 and 12.8.542.31, if not installed in Strictly

An unauthenticated Apache Traffic Control Traffic Ops user can send a request with a specially-crafted username to the P

Zoho ManageEngine ADAudit Plus before 7006 allows attackers to write to, and execute, arbitrary files.

Zoho ManageEngine ADManager Plus before 7115 is vulnerable to a filter bypass that leads to file-upload remote code exec

Zoho ManageEngine Patch Connect Plus before 90099 is vulnerable to unauthenticated remote code execution.

Zoho ManageEngine Network Configuration Manager before 125465 is vulnerable to SQL Injection in a configuration search

Zoho ManageEngine Network Configuration Manager before 125465 is vulnerable to SQL Injection in a hardware details sea

A buffer overflow was discovered on Realtek RTL8195AM devices before 2.0.10. It exists in the client code when processin

The website builder module in Dolibarr 13.0.2 allows remote PHP code execution because of an incomplete protection mecha

pdf2json v0.71 was discovered to contain a stack buffer overflow in the component XRef::fetch.

pdf2xml v2.0 was discovered to contain a stack buffer overflow in the component getObjectStream.

pdf2xml v2.0 was discovered to contain a heap-buffer overflow in the function TextPage::addAttributsNode.

pdf2xml v2.0 was discovered to contain a heap-buffer overflow in the function TextPage::dump.

Airangel HSMX Gateway devices through 5.2.04 have Weak SSH Credentials.

A memory corruption vulnerability exists in Palo Alto Networks GlobalProtect portal and gateway interfaces that enables

Airangel HSMX Gateway devices through 5.2.04 allow Remote Code Execution.

Airangel HSMX Gateway devices through 5.2.04 have Hard-coded Database Credentials.

In uClibc and uClibc-ng before 1.0.39, incorrect handling of special characters in domain names returned by DNS servers

An authentication bypass issue in FormaLMS <= 2.4.4 allows an attacker to bypass the authentication mechanism and obtain

Microsoft Virtual Machine Bus (VMBus) Remote Code Execution Vulnerability

The verify function in the Stark Bank Python ECDSA library (aka starkbank-escada or ecdsa-python) before 2.0.1 fails to

The verify function in the Stark Bank Node.js ECDSA library (ecdsa-node) 1.1.2 fails to check that the signature is non-

The verify function in the Stark Bank Java ECDSA library (ecdsa-java) 1.0.0 fails to check that the signature is non-zer

The verify function in the Stark Bank .NET ECDSA library (ecdsa-dotnet) 1.3.1 fails to check that the signature is non-z

The verify function in the Stark Bank Elixir ECDSA library (ecdsa-elixir) 1.0.0 fails to check that the signature is non

In JetBrains TeamCity before 2021.1.2, permission checks in the Agent Push functionality were insufficient.

In JetBrains TeamCity before 2021.1.2, remote code execution via the agent push functionality is possible.

JetBrains YouTrack before 2021.3.23639 is vulnerable to Host header injection.

In JetBrains Hub before 2021.1.13690, the authentication throttling mechanism could be bypassed.

A Buffer Overflow and Information Disclosure issue exists in HP OfficeJet Pro Printers before 001.1937C, and HP PageWide