2022

CSCMS Music Portal System v4.2 was discovered to contain a blind SQL injection vulnerability via the id parameter at /ad

74cmsSE v3.5.1 was discovered to contain a SQL injection vulnerability via the keyword parameter at /home/jobfairol/resu

74cmsSE v3.5.1 was discovered to contain an arbitrary file read vulnerability via the component \index\controller\Downlo

Piwigo 11.5.0 is affected by a SQL injection vulnerability via admin.php and the id parameter.

A stack buffer overflow exists in Mini-XML v3.2. When inputting an unformed XML string to the mxmlLoadString API, it wil

A memory leak issue was discovered in Mini-XML v3.2 that could cause a denial of service. NOTE: testing reports are inco

XWiki Platform Wiki UI Main Wiki is a package for managing subwikis. Starting with version 5.3-milestone-2, XWiki Platfo

XWiki Platform Flamingo Theme UI is a tool that allows customization and preview of any Flamingo-based skin. Starting wi

An information disclosure vulnerability exists in the OAS Engine SecureBrowseFile functionality of Open Automation Softw

An external config control vulnerability exists in the OAS Engine SecureAddUser functionality of Open Automation Softwar

A cleartext transmission of sensitive information vulnerability exists in the OAS Engine configuration communications fu

An external config control vulnerability exists in the OAS Engine SecureAddSecurity functionality of Open Automation Sof

A denial of service vulnerability exists in the OAS Engine SecureConfigValues functionality of Open Automation Software

Guzzle is a PHP HTTP client. Guzzle prior to versions 6.5.6 and 7.4.3 contains a vulnerability with the cookie middlewar

In ginadmin through 05-10-2022, the incoming path value is not filtered, resulting in arbitrary file reading.

In ginadmin through 05-10-2022 the incoming path value is not filtered, resulting in directory traversal.

Gibbon v23 does not generate a new session ID cookie after a user authenticates, making the application vulnerable to se

Docker Desktop 4.3.0 has Incorrect Access Control.

Tableau is aware of a broken access control vulnerability present in Tableau Server affecting Tableau Server customers u

The affected Baker Hughes Bentley Nevada products (3500 System 1 6.x, Part No. 3060/00 versions 6.98 and prior, 3500 Sys

An arbitrary file upload vulnerability in the Select Image function of Online Food Ordering System v1.0 allows attackers

Out-of-bounds Read in GitHub repository vim/vim prior to 8.2.

go-getter up to 1.5.11 and 2.0.2 panicked when processing password-protected ZIP files. Fixed in 1.6.1 and 2.1.0.

go-getter up to 1.5.11 and 2.0.2 allowed asymmetric resource exhaustion when go-getter processed malicious HTTP response

go-getter up to 1.5.11 and 2.0.2 allowed arbitrary host access via go-getter path traversal, symlink processing, and com

SQL Injection in GitHub repository camptocamp/terraboard prior to 2.2.0.

Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository jgraph/drawio prior to 18.1.2.

IBM Aspera Faspex 4.4.1 and 5.0.0 could allow unauthorized access due to an incorrectly computed security token. IBM X-F

A vulnerability in CyberLink Power Director v14 allows attackers to escalate privileges via a crafted .exe file.

ManageEngine AppManager15 (Build No:15510) allows an authenticated admin user to upload a DLL file to perform a DLL hija

VMware Tools for Windows(12.0.0, 11.x.y and 10.x.y) contains an XML External Entity (XXE) vulnerability. A malicious act

A use after free in info_width_internal in bk_info.c in Halibut 1.2 allows an attacker to cause a segmentation fault or

A double free in cleanup_index in index.c in Halibut 1.2 allows an attacker to cause a denial of service or possibly hav

A use after free in cleanup_index in index.c in Halibut 1.2 allows an attacker to cause a segmentation fault or possibly

A flaw was found in Wildfly. An incorrect JBOSS_LOCAL_USER challenge location when using the elytron configuration may l

Delta Electronics DIAScreen versions prior to 1.1.0 are vulnerable to an out-of-bounds write condition, which may result

Delta Electronics DIAScreen versions prior to 1.1.0 are vulnerable to type confusion, which may allow an attacker to rem

The AGG Software Web Server version 4.0.40.1014 and prior is vulnerable to cross-site scripting, which may allow an atta

IBM i 7.3, 7.4, and 7.5 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, w

JavaEZ is a library that adds new functions to make Java easier. A weakness in JavaEZ 1.6 allows force decryption of loc

A vulnerability classified as critical has been found in Cardo Systems Scala Rider Q3. Affected is the file /cardo/api o

An XXE issue was discovered in Morpheus through 5.2.16 and 5.4.x through 5.4.4. A successful attack requires a SAML iden

Room-rent-portal-site v1.0 is vulnerable to SQL Injection via /rrps/classes/Master.php?f=delete_category, id.

Azure RTOS USBX is a USB host, device, and on-the-go (OTG) embedded stack. In versions prior to 6.1.10, an attacker can

Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. Prio

Lodestar is a TypeScript implementation of the Ethereum Consensus specification. Prior to version 0.36.0, there is a pos

PyJWT is a Python implementation of RFC 7519. PyJWT supports multiple different JWT signing algorithms. With JWT, an att

Path Traversal in GitHub repository filegator/filegator prior to 7.8.0.

Automotive Shop Management System v1.0 is vulnerable to SQL Injection via /asms/classes/Master.php?f=delete_product.

ChatBot App with Suggestion in PHP/OOP v1.0 is vulnerable to SQL Injection via /simple_chat_bot/classes/Master.php?f=del