2022

A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to gain elevated privil

A vulnerability in the authentication functionality of Cisco Wireless LAN Controller (WLC) AireOS Software could allow a

A vulnerability in the client forwarding code of multiple Cisco Access Points (APs) could allow an unauthenticated, adja

A vulnerability in the smart card login authentication of Cisco Duo for macOS could allow an unauthenticated attacker wi

Insecure direct object references (IDOR) vulnerability in ExpressTech Quiz And Survey Master plugin <= 7.3.4 at WordPres

RealVNC VNC Server before 6.11.0 and VNC Viewer before 6.22.826 on Windows allow local privilege escalation via MSI inst

AP Manager in Innovaphone before 13r2 Service Release 17 allows command injection via a modified service ID during app u

Dairy Farm Shop Management System 1.0 is vulnerable to SQL Injection via sales-report-ds.php file.

Directory Traversal vulnerability in htmly before 2.8.1 allows remote attackers to perform arbitrary file deletions via

The H5P activity attempts report did not filter by groups, which in separate groups mode could reveal information to non

A limited SQL injection risk was identified in the "browse list of users" site administration page.

A remote code execution risk when restoring backup files originating from Moodle 1.9 was identified.

Recursive rendering of Mustache template helpers containing user input could, in some cases, result in an XSS risk or a

Joplin version 2.8.8 allows an external attacker to execute arbitrary commands remotely on any client that opens a link

Gridea version 0.9.3 allows an external attacker to execute arbitrary code remotely on any client attempting to view a m

Insufficient sanitization of inputs in QoE application input field could lead to stored and Dom based XSS attack. This i

A vulnerable component of Orion Platform was vulnerable to SQL Injection, an authenticated attacker could leverage this

Information Disclosure in Operator Client application in BVMS 10.1.1, 11.0 and 11.1.0 and VIDEOJET Decoder VJD-7513 vers

Adobe Experience Manager versions 6.5.13.0 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerabi

Pulse Secure version 9.115 and below may be susceptible to client-side http request smuggling, When the application rece

AppLock version 7.9.29 allows an attacker with physical access to the device to bypass biometric authentication. This is

Cross-Site Scripting (XSS) via Cross-Site Request Forgery (CSRF) vulnerability in Booking Ultra Pro plugin <= 1.1.4 at W

Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in Booking Ultra Pro plugin <= 1.1.4 at WordPress.

Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Social Media Follow Buttons Bar plugin <= 4.73

Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Comment Guestbook plugin <= 0.8.0 at WordPress

Billing System Project v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /phpinventor

Billing System Project v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /phpinventor

Billing System Project v1.0 was discovered to contain a remote code execution (RCE) vulnerability via the component /php

PingCentral versions prior to listed versions expose Spring Boot actuator endpoints that with administrative authenticat

Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.5.0a3.

Multiple cross-site scripting (XSS) vulnerabilities in Canon Medical Vitrea View 7.x before 7.7.6 allow remote attackers

sflow decode package does not employ sufficient packet sanitisation which can lead to a denial of service attack. Attack

Relative Path Traversal in GitHub repository dnnsoftware/dnn.platform prior to 9.11.0.

roccat_report_event in drivers/hid/hid-roccat.c in the Linux kernel through 5.19.12 has a race condition and resultant u

drivers/video/fbdev/smscufx.c in the Linux kernel through 5.19.12 has a race condition and resultant use-after-free if a

drivers/char/pcmcia/synclink_cs.c in the Linux kernel through 5.19.12 has a race condition and resultant use-after-free

An issue was discovered in Bento4 1.6.0-639. A memory leak exists in AP4_StdcFileByteStream::Create(AP4_FileByteStream*,

An issue was discovered in Bento4 1.6.0-639. There ie excessive memory consumption in the function AP4_DataBuffer::Reall

An issue was discovered in Bento4 1.6.0-639. There ie excessive memory consumption in the function AP4_Array<AP4_ElstEnt

An issue was discovered in Xpdf 4.04. There is a crash in XRef::fetch(int, int, Object*, int) in xpdf/XRef.cc, a differe

An issue was discovered in Xpdf 4.04. There is a crash in convertToType0 in fofi/FoFiType1C.cc, a different vulnerabilit

An issue was discovered in Xpdf 4.04. There is a crash in gfseek(_IO_FILE*, long, int) in goo/gfile.cc.

An issue was discovered in Bento4 through 1.6.0-639. A NULL pointer dereference occurs in AP4_File::ParseStream in Core/

The package react-native-reanimated before 3.0.0-rc.1 are vulnerable to Regular Expression Denial of Service (ReDoS) due

The package css-what before 2.1.3 are vulnerable to Regular Expression Denial of Service (ReDoS) due to the usage of ins

In affected versions of Octopus Deploy it is possible to bypass rate limiting on login using null bytes.

In Amazon AWS Redshift JDBC Driver (aka amazon-redshift-jdbc-driver or redshift-jdbc42) before 2.1.0.8, the Object Facto

Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.5.0a3.

Discourse is an open source discussion platform. Starting with version 2.9.0.beta5 and prior to version 2.9.0.beta10, an

ZKTeco Xiamen Information Technology ZKBio Time 8.0.7 Build: 20220721.14829 was discovered to contain a CSV injection vu