2022

IBM CICS TX Standard and Advanced 11.1 is vulnerable to stored cross-site scripting. This vulnerability allows users to

IBM CICS TX Standard and Advanced 11.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed a

IBM CICS TX Standard and Advanced 11.1 is vulnerable to HTML injection. A remote attacker could inject malicious HTML co

A URL disclosure issue was discovered in Burp Suite before 2022.6. If a user views a crafted response in the Repeater or

A potential security vulnerability has been identified in certain HPE FlexNetwork and FlexFabric switch products. The vu

An issue in the isSVG() function of Known v1.2.2+2020061101 allows attackers to execute arbitrary code via a crafted SVG

A cross-site scripting (XSS) vulnerability in Known v1.2.2+2020061101 allows authenticated attackers to execute arbitrar

Known v1.3.1 was discovered to contain an Insecure Direct Object Reference (IDOR).

An arbitrary file upload vulnerability in the Select User function under the People Menu component of Snipe-IT v6.0.2 al

An arbitrary file upload vulnerability in the Update Branding Settings component of Snipe-IT v6.0.2 allows attackers to

AdminLTE is a Pi-hole Dashboard for stats and configuration. In affected versions inserting code like `<script>alert("XS

In Eclipse Lyo versions 1.0.0 to 4.1.0, a TransformerFactory is initialized with the defaults that do not restrict DTD l

Magnolia CMS v6.2.19 was discovered to contain a cross-site scripting (XSS) vulnerability via the Edit Contact function.

In Apache Druid 0.22.1 and earlier, the server did not set appropriate headers to prevent clickjacking. Druid 0.23.0 and

In Apache Druid 0.22.1 and earlier, certain specially-crafted links result in unescaped URL parameters being sent back i

The Google Login Plugin (versions 1.0 and 1.1) allows malicious anonymous users to authenticate successfully against Jen

Bookwyrm is an open source social reading and reviewing program. Versions of Bookwyrm prior to 0.4.1 did not properly sa

Akashi is an open source server implementation of the Attorney Online video game based on the Ace Attorney universe. Aff

HumHub is an Open Source Enterprise Social Network. Affected versions of HumHub are vulnerable to a stored Cross-Site Sc

A memory corruption in Hex Rays Ida Pro v6.6 allows attackers to cause a Denial of Service (DoS) via a crafted file. Rel

When curl < 7.84.0 does FTP transfers secured by krb5, it handles message verification failures wrongly. This flaw makes

curl < 7.84.0 supports "chained" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple t

A malicious server can serve excessive amounts of `Set-Cookie:` headers in a HTTP response to curl and curl < 7.84.0 sto

In Openshift Origin 3 the cookies being set in console have no 'secure', 'HttpOnly' attributes.

In nextgen-galery wordpress plugin before 2.0.77.3 there are two vulnerabilities which can allow an attacker to gain ful

EQS Integrity Line Professional through 2022-07-01 allows a stored XSS via a crafted whistleblower entry.

The password reset token in CWP v0.9.8.1126 is generated using known or predictable values.

The Appfire Jira Misc Custom Fields (JMCF) app 2.4.6 for Atlassian Jira allows XSS via a crafted project name to the Add

Cross-site Scripting (XSS) - Stored in GitHub repository outline/outline prior to v0.64.4.

HCL Launch may store certain data for recurring activities in a plain text format.

HCL Launch stores user credentials in plain clear text which can be read by a local user.

A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM) and Cisco Uni

A vulnerability in the Disaster Recovery framework of Cisco Unified Communications Manager (Unified CM), Cisco Unified C

A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM), Cisco Unifie

A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM), Cisco Unifie

A vulnerability in the database user privileges of Cisco Unified Communications Manager (Unified CM), Cisco Unified Comm

A vulnerability in the logging component of Cisco TelePresence Collaboration Endpoint (CE) and RoomOS Software could all

A vulnerability in Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Session Manag

EidoGo is susceptible to Cross-Site Scripting (XSS) attacks via maliciously crafted SGF input.

There are use-after-free vulnerabilities caused by timer handler in net/rose/rose_timer.c of linux that allow attackers

HTML injection vulnerability in secure messages of Devolutions Server before 2022.2 allows attackers to alter the render

Nextcloud mail is a Mail app for the Nextcloud home server product. Versions of Nextcloud mail prior to 1.12.2 were foun

Frontier is Substrate's Ethereum compatibility layer. In affected versions the truncation done when converting between E

A heap out-of-bounds write may heppen during the handling of Huffman tables in the PNG reader. This may lead to data cor

A crafted 16-bit grayscale PNG image may lead to a out-of-bounds write in the heap area. An attacker may take advantage

Editable SQL Queries behind Base64 encoding sending from the Client-Side to The Server-Side for a particular API used in

A cross-site-scripting (XSS) vulnerability was discovered in the Vega Charts Kibana integration which could allow arbitr

this vulnerability affect user that even not allowed to access via the web interface. First of all, the attacker needs t

An attacker can access to "Forgot my password" button, as soon as he puts users is valid in the system, the system would

In audio DSP, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation