2022

Discourse is an open source discussion platform. In versions prior to 2.8.9 on the `stable` branch and prior to 2.9.0.be

Discourse is an open source discussion platform. In versions prior to 2.8.9 on the `stable` branch and prior to 2.9.0.be

Discourse is an open source discussion platform. In versions prior to 2.8.9 on the `stable` branch and prior to 2.9.0.be

DGIOT Lightweight industrial IoT v4.5.4 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities.

hms-staff.php in Projectworlds Hospital Management System Mini-Project through 2018-06-17 allows SQL injection via the t

isolated-vm is a library for nodejs which gives the user access to v8's Isolate interface. In versions 4.3.6 and prior,

SourceCodester Best Student Result Management System 1.0 is vulnerable to SQL Injection.

kkFileView v4.1.0 is vulnerable to Cross Site Scripting (XSS) via the parameter 'errorMsg.'

A memory corruption vulnerability exists in the libpthread linuxthreads functionality of uClibC 0.9.33.2 and uClibC-ng 1

dutchcoders Transfer.sh 1.4.0 is vulnerable to Cross Site Scripting (XSS).

IBM Robotic Process Automation Clients are vulnerable to proxy credentials being exposed in upgrade logs. IBM X-Force ID

matrix-nio is a Python Matrix client library, designed according to sans I/O principles. Prior to version 0.20, when a u

matrix-rust-sdk is an implementation of a Matrix client-server library in Rust, and matrix-sdk-crypto is the Matrix encr

SnapCenter versions prior to 4.7 shipped without Content Security Policy (CSP) implemented which could allow certain typ

FeehiCMS v2.1.1 was discovered to contain a cross-site scripting (XSS) vulnerability via a crafted payload injected into

A zip slip vulnerability in the file upload function of Chamilo v1.11 allows attackers to execute arbitrary code via a c

A vulnerability in /src/amf/amf-context.c in Open5GS 2.4.10 and earlier leads to AMF denial of service.

A buffer overflow in the component nfc_device_load_mifare_ul_data of Flipper Devices Inc., Flipper Zero before v0.65.2 a

Matrix JavaScript SDK is the Matrix Client-Server software development kit (SDK) for JavaScript. Prior to version 19.7.0

TOTOLINK A860R V4.1.2cu.5182_B20201027 was discovered to contain a command injection via the component /cgi-bin/download

A misconfiguration in the Service Mode profile directory of Clash for Windows v0.19.9 allows attackers to escalate privi

Use After Free in GitHub repository vim/vim prior to 9.0.0614.

Cross-site Scripting (XSS) - Stored in GitHub repository inventree/inventree prior to 0.8.3.

An issue was discovered in Samsung TizenRT through 3.0_GBM (and 3.1_PRE). l2_packet_receive_timeout in wpa_supplicant/sr

An issue was discovered in Samsung TizenRT through 3.0_GBM (and 3.1_PRE). createDB in security/provisioning/src/provisio

There is a use-after-free issue in JBIG2Stream::close() located in JBIG2Stream.cc in Xpdf 4.04. It can be triggered by s

NULL Pointer Dereference in GitHub repository vim/vim prior to 8.2.4959.

Reflected XSS on ticket filter function in GitHub repository polonel/trudesk prior to 1.2.2. This vulnerability is capab

The trudesk application allows large characters to insert in the input field "Full Name" on the signup field which can a

glFusion CMS v1.7.9 is affected by a reflected Cross Site Scripting (XSS) vulnerability. The value of the title request

An arbitrary file upload vulnerability was found in Metersphere v1.15.4. Unauthenticated users can upload any file to ar

An arbitrary file read vulnerability was found in Metersphere v1.15.4, where authenticated users can read any file on th

Time-based SQL Injection vulnerabilities were found in Metersphere v1.15.4 via the "orders" parameter.

An issue was discovered in FusionPBX before 4.5.30. The log_viewer.php Log View page allows an authenticated user to cho

An issue was discovered in the Translate extension in MediaWiki through 1.36.2. Oversighters cannot undo revisions or ov

An issue was discovered in the Growth extension in MediaWiki through 1.36.2. Any admin can add arbitrary JavaScript code

An issue was discovered in the Growth extension in MediaWiki through 1.36.2. On any Wiki with the Mentor Dashboard featu

An issue was discovered in the GlobalWatchlist extension in MediaWiki through 1.36.2. The rev-deleted-user and ntimes me

An issue was discovered in SecurePoll in the Growth extension in MediaWiki through 1.36.2. Simple polls allow users to c

It was possible for a student to view their quiz grade before it had been released, using a quiz web service.

Insufficient escaping of the LaTeX preamble made it possible for site administrators to read files available to the HTTP

An authentication bypass risk was identified in the external database authentication functionality, due to a type juggli

Insufficient capability checks made it possible for teachers to download users outside of their courses.

A session hijack risk was identified in the Shibboleth authentication plugin.

BigProf Online Invoicing System before 3.0 offers a functionality that allows an administrator to move the records of me

BigProf Online Invoicing System before 2.9 suffers from an unauthenticated SQL Injection found in /membership_passwordRe

BigBlueButton before 2.2.7 does not have a protection mechanism for separator injection in meetingId, userId, and authTo

In BigBlueButton before 2.2.7, lockSettingsProps.disablePrivateChat does not apply to already opened chats. This occurs

Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has the q6xV4aW8bQ4cfD-b password for the axiros account.

Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a /live/GLOBALS API with the CLOUDCNM key.