2021

Infoblox NIOS before 8.5.2 allows entity expansion during an XML upload operation, a related issue to CVE-2003-1564.

SICK Visionary-S CX up version 5.21.2.29154R are vulnerable to an Inadequate Encryption Strength vulnerability concernin

Nessus Agent 8.2.4 and earlier for Windows were found to contain multiple local privilege escalation vulnerabilities whi

Nessus Agent 8.2.4 and earlier for Windows were found to contain multiple local privilege escalation vulnerabilities whi

Cross-site scripting vulnerability in EC-CUBE EC-CUBE 4.0.0 to 4.0.5-p1 (EC-CUBE 4 series) allows a remote attacker to i

Cross-site scripting vulnerability in EC-CUBE EC-CUBE 3.0.0 to 3.0.18-p2 (EC-CUBE 3 series) and EC-CUBE 4.0.0 to 4.0.5-p

Cross-site scripting vulnerability in Fudousan plugin ver5.7.0 and earlier, Fudousan Plugin Pro Single-User Type ver5.7.

Cross-site scripting vulnerability in WordPress Popular Posts 5.3.2 and earlier allows a remote authenticated attacker t

Mermaid before 8.11.0 allows XSS when the antiscript feature is used.

An arbitrary code execution vulnerability was discovered in Avaya Aura Device Services that may potentially allow a loca

In Phoenix Contact FL SWITCH SMCS series products in multiple versions fragmented TCP-Packets may cause a Denial of Serv

IBM Security Verify (IBM Security Verify Privilege Vault 10.9.66) is vulnerable to cross-site scripting. This vulnerabil

IBM Security Verify (IBM Security Verify Privilege Vault 10.9.66) is vulnerable to link injection. By persuading a victi

IBM Security Verify (IBM Security Verify Privilege Vault 10.9.66) could disclose sensitive information through an HTTP G

Oracle GlassFish Server 3.1.2.18 and below allows /common/logViewer/logViewer.jsf XSS. A malicious user can cause an adm

PandoraFMS <=7.54 allows Stored XSS by placing a payload in the name field of a visual console. When a user or an admini

A stored cross-site scripting (XSS) vulnerability was discovered in /Forms/device_vars_1 on TrippLite SU2200RTXL2Ua with

User credentials stored in a recoverable format within Fidelis Network and Deception CommandPost. In the event that an a

Unencrypted Bluetooth Low Energy baseband links in Bluetooth Core Specifications 4.0 through 5.2 may permit an adjacent

SAS Environment Manager 2.5 allows XSS through the Name field when creating/editing a server. The XSS will prompt when e

Shopware is an open source eCommerce platform. In versions prior to 6.4.1.1 the admin api has exposed some internal hidd

Shopware is an open source eCommerce platform. Versions prior to 5.6.10 suffer from an authenticated stored XSS in admin

Shopware is an open source eCommerce platform. Versions prior to 5.6.10 are vulnerable to system information leakage in

Shopware is an open source eCommerce platform. Potential session hijacking of store customers in versions below 6.3.5.2.

An issue was discovered in function addMeByRC in the smart contract implementation for RC, an Ethereum token, allows att

Shopware is an open source eCommerce platform. Creation of order credits was not validated by ACL in admin orders. Users

IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5, under specific circum

IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 could allow a user who

IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 could allow a local user to access and change the

Cross Site Scripting (XSS) vulnerability in Roundcube Mail <=1.4.4 via smtp config in /installer/test.php.

Cross Site Scripting (XSS) vulneraibility in Roundcube mail .4.4 via database host and user in /installer/test.php.

Cross Site Scripting (XSS) vulnerabililty in WebPort <=1.19.1 via the description parameter to script/listcalls.

Dell UEFI BIOS https stack leveraged by the Dell BIOSConnect feature and Dell HTTPS Boot feature contains an improper ce

In IBOS 4.5.4 the email function has a cross site scripting (XSS) vulnerability in emailbody[content] parameter.

Directory Traversal vulnerability in WebPort <=1.19.1 in tags of system settings.

Cross Site Scripting (XSS) vulnerability in WebPort <=1.19.1via the connection name parameter in type-conn.

Cross Site Scripting (XSS) vulnerability in gnuboard5 <=v5.3.2.8 via the act parameter in bbs/move_update.php.

An issue was discovered in JFinal framework v4.9.10 and below. The "set" method of the "Controller" class of jfinal fram

All versions of package react-bootstrap-table are vulnerable to Cross-site Scripting (XSS) via the dataFormat parameter.

In CRMEB 3.1.0+ strict domain name filtering leads to SSRF(Server-Side Request Forgery). The vulnerable code is in file

Cross Site Scripting (XSS) vulnerability in gnuboard5 <=v5.3.2.8 via the url parameter to bbs/login.php.

A malicious website that causes an HTTP Authentication dialog to be spawned could trick the built-in password manager to

Address bar search suggestions in private browsing mode were re-using session data from normal mode. *This bug only affe

Firefox for Android would become unstable and hard-to-recover when a website opened too many popups. *This bug only affe

When styling and rendering an oversized `<select>` element, Firefox did not apply correct clipping which allowed an atta

Firefox used to cache the last filename used for printing a file. When generating a filename for printing, Firefox usual

When a user has already allowed a website to access microphone and camera, disabling camera sharing would not fully prev

When a download was initiated, the client did not check whether it was in normal or private browsing mode, which led to

If a MIME encoded email contains an OpenPGP inline signed or encrypted message part, but also contains an additional unp

OpenPGP secret keys that were imported using Thunderbird version 78.8.1 up to version 78.10.1 were stored unencrypted on