2021

webTareas version 2.4 and earlier allows an authenticated user to store arbitrary web script or HTML by creating or edit

A Cross-Site Request Forgery (CSRF) vulnerability in webTareas version 2.4 and earlier allows a remote attacker to creat

Verint Workforce Optimization (WFO) 15.2.5.1033 allows HTML injection via the /wfo/control/signin username parameter.

Tad Web is vulnerable to authorization bypass, thus remote attackers can exploit the vulnerability to use the original f

The new add subject parameter of Tad Uploader view book list function fails to filter special characters. Unauthenticate

The file extension of the TadTools file upload function fails to filter, thus remote attackers can upload any types of f

TadTools special page parameter does not properly restrict the input of specific characters, thus remote attackers can i

Tad Honor viewing book list function is vulnerable to authorization bypass, thus remote attackers can use special parame

Tad Book3 editing book function does not filter special characters. Unauthenticated attackers can remotely inject JavaSc

An XML external entity (XXE) vulnerability in Alkacon OpenCms 11.0, 11.0.1 and 11.0.2 allows remote authenticated users

In Digi RealPort through 4.10.490, authentication relies on a challenge-response mechanism that gives access to the serv

An issue was discovered in Digi RealPort through 4.8.488.0. The 'encrypted' mode is vulnerable to man-in-the-middle atta

An issue was discovered in Digi RealPort for Windows through 4.8.488.0. A buffer overflow exists in the handling of ADDP

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In versions prior t

A SQL injection vulnerability exists in Subrion CMS v4.2.1 in the visual-mode.

A Denial-of-Service (DoS) vulnerability was discovered in F-Secure Atlant whereby the AVRDL unpacking module component u

A Denial-of-Service (DoS) vulnerability was discovered in F-Secure Atlant whereby the AVPACK module component used in ce

A local attacker could read or write arbitrary files with administrator privileges in HitmanPro before version Build 318

A local attacker could execute arbitrary code with administrator privileges in HitmanPro.Alert before version Build 901.

Zulip is an open source team chat server. In affected versions Zulip allows organization administrators on a server to c

Zoho ManageEngine ADManager Plus before 7110 is vulnerable to blind XXE.

JEECMS x1.1 contains a stored cross-site scripting (XSS) vulnerability in the component of /member-vipcenter.htm, which

OpenSNS v6.1.0 contains a blind SQL injection vulnerability in /Controller/ChinaCityController.class.php via the cid par

OpenSNS v6.1.0 contains a blind SQL injection vulnerability in /Controller/ChinaCityController.class.php via the pid par

Xshell before 7.0.0.76 allows attackers to cause a crash by triggering rapid changes to the title bar.

An issue was discovered in Zammad before 4.1.1. SSRF can occur via GitHub or GitLab integration.

An issue was discovered in Zammad before 4.1.1. The Form functionality allows remote code execution because deserializat

An issue was discovered in Zammad before 4.1.1. The REST API discloses sensitive information.

An issue was discovered in Zammad before 4.1.1. The Chat functionality allows XSS because clipboard data is mishandled.

An issue was discovered in Zammad before 4.1.1. An admin can discover the application secret via the API.

An issue was discovered in Zammad before 4.1.1. An Agent account can modify account data, and gain admin access, via a c

An issue was discovered in Zammad before 4.1.1. There is stored XSS via a custom Avatar.

An issue was discovered in Zammad before 4.1.1. An attacker with valid agent credentials may send a series of crafted re

ThinkPHP50-CMS v1.0 contains a remote code execution (RCE) vulnerability in the component /public/?s=captcha.

An issue was discovered in Zammad before 4.1.1. Command Injection can occur via custom Packages.

An issue was discovered in Zammad before 4.1.1. An admin can execute code on the server via a crafted request that manip

An issue was discovered in Zammad before 4.1.1. Stored XSS may occur via an Article during addition of an attachment to

Extensible Service Proxy, a.k.a. ESP is a proxy which enables API management capabilities for JSON/REST or gRPC API serv

IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 6.1.1.0 could allow an authneticated attacker to obtain sen

IBM Sterling File Gateway 2.2.0.0 through 6.1.1.0 could allow a remote attacker to upload arbitrary files, caused by imp

IBM Sterling B2B Integrator 5.2.0.0 through 6.1.1.0 is vulnerable to stored cross-site scripting. This vulnerability all

IBM Sterling File Gateway 2.2.0.0 through 6.1.1.0 is vulnerable to cross-site scripting. This vulnerability allows users

IBM Sterling File Gateway 6.0.0.0 through 6.1.1.0 could allow a remote attacker to obtain sensitive information when a d

IBM Sterling File Gateway 2.2.0.0 through 6.1.1.0 is vulnerable to cross-site request forgery which could allow an attac

IBM Sterling File Gateway 2.2.0.0 through 6.1.1.0 is vulnerable to cross-site scripting. This vulnerability allows users

IBM Sterling File Gateway User Interface 2.2.0.0 through 6.1.1.0 does not invalidate session after logout which could al

IBM Sterling File Gateway 2.2.0.0 through 6.1.1.0 could allow an authenticated attacker to enumerate usernames due to th

IBM Sterling File Gateway 2.2.0.0 through 6.1.1.0 could allow an authenticated user to intercept and replace a message s

IBM Sterling File Gateway 2.2.0.0 through 6.1.1.0 could allow a remote authenticated user to cause a denial of another u

In Visual Tools DVR VX16 4.2.28.0, an unauthenticated attacker can achieve remote command execution via shell metacharac