2022

Jorani v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Comment parameter at applicatio

Wasmtime is a standalone runtime for WebAssembly. In affected versions wasmtime's implementation of the SIMD proposal fo

A stored cross-site scripting (XSS) vulnerability in LightCMS v1.3.11 allows attackers to execute arbitrary web scripts

rulex is a new, portable, regular expression language. When parsing untrusted rulex expressions, the stack may overflow,

rulex is a new, portable, regular expression language. When parsing untrusted rulex expressions, rulex may crash, possib

Discourse is an open source discussion platform. Under certain conditions, a logged in user can redeem an invite with an

A vulnerability classified as critical has been found in Kama Click Counter Plugin up to 3.4.8. This affects an unknown

An issue in the jmpath variable in /modules/mindmap/index.php of GUnet Open eClass Platform (aka openeclass) v3.12.4 and

A cross-site scripting (XSS) vulnerability in the System Settings/IOT Settings module of Delta Electronics DIAEnergie v1

LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP d

LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP d

GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking an

KubeEdge is built upon Kubernetes and extends native containerized application orchestration and device management to ho

In GPAC MP4Box v1.1.0, there is a heap-buffer-overflow in the function filter_parse_dyn_args function in filter_core/fil

KubeEdge is built upon Kubernetes and extends native containerized application orchestration and device management to ho

BigBlueButton is an open source web conferencing system. In affected versions an attacker can embed malicious JS in thei

BigBlueButton is an open source web conferencing system. Users in meetings with private chat enabled are vulnerable to a

Shopware is an open source e-commerce software made in Germany. Versions of Shopware 5 prior to version 5.7.12 are subje

Greenlight is a simple front-end interface for your BigBlueButton server. In affected versions an attacker can view any

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All versions of Argo CD starting with v1.3.0 a

Information Exposure vulnerability in My Account Settings of Devolutions Remote Desktop Manager before 2022.1.8 allows a

The web module in some Hikvision Hybrid SAN/Cluster Storage products have the following security vulnerability. Due to t

Brocade SANnav before Brocade SANvav v. 2.2.0.2 and Brocade SANanv v.2.1.1.8 logs the Brocade Fabric OS switch password

An authenticated user with admin privileges may be able to terminate any process on the system running Elcomplus SmartIC

Cross Site Scripting (XSS) vulnerability in Ruckus Wireless ZoneDirector 9.8.3.0.

A vulnerability was found in Album Lock 4.0 and classified as critical. Affected by this issue is some unknown functiona

Cross-site Scripting (XSS) - Stored in GitHub repository ionicabizau/parse-url prior to 7.0.0.

NULL Pointer Dereference in GitHub repository vim/vim prior to 8.2.5163.

Cross-site Scripting (XSS) - Generic in GitHub repository ionicabizau/parse-url prior to 7.0.0.

The Brizy WordPress plugin before 2.4.2 does not sanitise and escape some element content, which could allow users with

The Brizy WordPress plugin before 2.4.2 does not sanitise and escape some element URL, which could allow users with a ro

The Malware Scanner WordPress plugin before 4.5.2 does not sanitise and escape some of its settings, leading to maliciou

The Login With OTP Over SMS, Email, WhatsApp and Google Authenticator WordPress plugin before 1.0.8 does not escape its

The Nested Pages WordPress plugin before 3.1.21 does not escape and sanitize the some of its settings, which could allow

The NextCellent Gallery WordPress plugin through 1.9.35 does not sanitise and escape some of its image settings, which c

The Easy SVG Support WordPress plugin before 3.3.0 does not sanitise uploaded SVG files, which could allow users with a

The MyCSS WordPress plugin through 1.1 does not have CSRF check in place when updating its settings, which could allow a

The Active Products Tables for WooCommerce. Professional products tables for WooCommerce store WordPress plugin before 1

The Clean-Contact WordPress plugin through 1.6 does not have CSRF check in place when updating its settings, which could

The Add Post URL WordPress plugin through 2.1.0 does not have CSRF check in place when updating its settings, which coul

The Pricing Tables WordPress Plugin WordPress plugin before 3.2.1 does not sanitise and escape parameter before outputti

The Cimy Header Image Rotator WordPress plugin through 6.1.1 does not have CSRF check in place when updating its setting

The Rotating Posts WordPress plugin through 1.11 does not have CSRF check in place when updating its settings, which cou

The Tiny Contact Form WordPress plugin through 0.7 does not have CSRF check in place when updating its settings, which c

The WP Post Styling WordPress plugin before 1.3.1 does not have CSRF checks in various actions, which could allow attack

The WP Sentry WordPress plugin through 1.0 does not have CSRF check in place when updating its settings, which could all

The MailPress WordPress plugin through 7.2.1 does not have CSRF checks in various places, which could allow attackers to

The OpenBook Book Data WordPress plugin through 3.5.2 does not have CSRF check in place when updating its settings, whic

The Popups, Welcome Bar, Optins and Lead Generation Plugin WordPress plugin before 2.1.8 does not sanitize and escape so

The Social Share Buttons by Supsystic WordPress plugin before 2.2.4 does not perform CSRF checks in it's ajax endpoints