2022

Jenkins Storable Configs Plugin 1.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) a

A cross-site request forgery (CSRF) vulnerability in Jenkins Autocomplete Parameter Plugin 1.1 and earlier allows attack

A cross-site request forgery (CSRF) vulnerability in Jenkins SSH Plugin 2.6.1 and earlier allows attackers to connect to

Jenkins WMI Windows Agents Plugin 1.8 and earlier includes the Windows Remote Command library does not implement access

Jenkins WMI Windows Agents Plugin 1.8 and earlier includes the Windows Remote Command library which has a buffer overflo

Jenkins Mercurial Plugin 2.16 and earlier allows attackers able to configure pipelines to check out some SCM repositorie

Jenkins Git Plugin 4.11.1 and earlier allows attackers able to configure pipelines to check out some SCM repositories st

Jenkins Pipeline: Groovy Plugin 2689.v434009a_31b_f1 and earlier allows loading any Groovy source files on the classpath

Server-Side Request Forgery (SSRF) in GitHub repository jgraph/drawio prior to 18.0.5.

cmseasy V7.7.5_20211012 is affected by an arbitrary file write vulnerability. Through this vulnerability, a PHP script f

Server-Side Request Forgery (SSRF) in GitHub repository jgraph/drawio prior to 18.0.6.

In Apache ShenYui, ShenYu-Bootstrap, RegexPredicateJudge.java uses Pattern.matches(conditionData.getParamValue(), realDa

A authenticated remote command injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10

Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Snap Deploy

Local privilege escalation due to a DLL hijacking vulnerability. The following products are affected: Acronis Snap Deplo

Local privilege escalation due to excessive permissions assigned to child processes. The following products are affected

A use-after-free flaw was found in the Linux kernel’s Atheros wireless adapter driver in the way a user forces the ath9k

Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticat

Trend Micro Password Manager (Consumer) version 5.0.0.1266 and below is vulnerable to a Link Following Privilege Escalat

Path Traversal in WellKnownServlet in GitHub repository jgraph/drawio prior to 18.0.5. Read local files of the web appli

SSRF on /proxy in GitHub repository jgraph/drawio prior to 18.0.4. An attacker can make a request as the server and read

The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.5.8 does not properly validate images, allowing high

The Visual Slide Box Builder WordPress plugin through 3.2.9 does not sanitise and escape various parameters before using

The Advanced Uploader WordPress plugin through 4.2 allows any authenticated users like subscriber to upload arbitrary fi

JFrog Artifactory before 7.36.1 and 6.23.41, is vulnerable to Insecure Deserialization of untrusted data which can lead

The AGIL WordPress plugin through 1.0 accepts all zip files and automatically extracts the zip file without validating t

An arbitrary file upload vulnerability in the file upload module of Express Connect-Multiparty 2.2.0 allows attackers to

ACCEL-PPP 1.12.0 has an out-of-bounds read in post_msg when processing a call_clear_request.

In the POST request of the appointment.php page of HMS v.0, there are SQL injection vulnerabilities in multiple paramete

Openmoney API through 2020-06-29 uses the JavaScript Math.random function, which does not provide cryptographically secu

Konica Minolta bizhub MFP devices before 2022-04-14 use cleartext password storage for the /var/log/nginx/html/ADMINPASS

Konica Minolta bizhub MFP devices before 2022-04-14 allow a Sandbox Escape. An attacker must attach a keyboard to a USB

Gitea before 1.16.7 does not escape git fetch remote.

Janet before 1.22.0 mishandles arrays.

A Server-Side Request Forgery (SSRF) in Rebuild v2.8.3 allows attackers to obtain the real IP address and scan Intranet

FISCO-BCOS release-3.0.0-rc2 was discovered to contain an issue where a malicious node, via an invalid proposal with an

FISCO-BCOS release-3.0.0-rc2 was discovered to contain an issue where a malicious node can trigger an integer overflow a

A SQL injection vulnerability exists in ChurchCRM version 2.0.0 to 4.4.5 that allows an authenticated attacker to issue

Webmin through 1.991, when the Authentic theme is used, allows remote code execution when a user has been manually creat

OpenClinica is an open source software for Electronic Data Capture (EDC) and Clinical Data Management (CDM). Versions pr

The package workspace-tools before 0.18.4 are vulnerable to Command Injection via git argument injection. When calling t

A buffer overflow vulnerability in the SonicWall SSL-VPN NetExtender Windows Client (32 and 64 bit) in 10.2.322 and earl

This affects the package convict before 6.2.3. This is a bypass of [CVE-2022-22143](https://security.snyk.io/vuln/SNYK-J

SonicWall SMA1000 series firmware 12.4.0, 12.4.1-02965 and earlier versions uses a shared and hard-coded encryption key

The DFX module has a UAF vulnerability.Successful exploitation of this vulnerability may affect system stability.

mySCADA myPRO versions prior to 8.20.0 does not restrict unauthorized read access to sensitive system information.

mySCADA myPRO versions prior to 8.20.0 allows an unauthenticated remote attacker to upload arbitrary files to the file s

mySCADA myPRO versions prior to 8.20.0 allows an unauthenticated remote attacker to upload arbitrary files to arbitrary

mySCADA myPRO versions prior to 8.20.0 does not restrict unauthorized read access to sensitive directory listing informa

Covid-19 Travel Pass Management System v1.0 is vulnerable to SQL Injection via ctpms/admin/?page=user/manage_user&id=.