2022

In Bender/ebee Charge Controllers in multiple versions are prone to Command injection via Web interface. An authenticate

In Bender/ebee Charge Controllers in multiple versions are prone to Command injection via Web interface. An authenticate

In Bender/ebee Charge Controllers in multiple versions are prone to Local privilege Escalation. An authenticated attacke

In Bender/ebee Charge Controllers in multiple versions are prone to an RFID leak. The RFID of the last charge event can

In Bender/ebee Charge Controllers in multiple versions are prone to unprotected data export. Backup export is protected

Due to build misconfiguration in openssl dependency, LINE for Windows before 7.8 is vulnerable to DLL injection that cou

In ControlUp Real-Time Agent before 8.6, an unquoted path can result in privilege escalation. An attacker would require

In cifs-utils through 6.14, a stack-based buffer overflow when parsing the mount.cifs ip= command-line argument could le

In the "webupg" binary of D-Link DIR-825 G1, because of the lack of parameter verification, attackers can use "cmd" para

Franklin Fueling Systems FFS T5 Series 1.8.7.7299 is affected by an unauthenticated directory traversal vulnerability, w

Franklin Fueling Systems FFS TS-550 evo 2.23.4.8936 is affected by an unauthenticated directory traversal vulnerability,

A lack of rate limiting in the 'forgot password' feature of Zammad v5.1.0 allows attackers to send an excessive amount o

A lack of password length restriction in Zammad v5.1.0 allows for the creation of extremely long passwords which can cau

A flaw was found in htmldoc commit 31f7804. A heap buffer overflow in the function pdf_write_names in ps-pdf.cxx may lea

GreenCMS v2.3.0603 was discovered to contain an arbitrary file deletion vulnerability via /index.php?m=admin&c=custom&a=

bloofoxCMS v0.5.2.1 was discovered to contain an arbitrary file upload vulnerability via /admin/index.php?mode=content&p

dhcms v20170919 was discovered to contain an arbitrary folder deletion vulnerability via /admin.php?r=admin/AdminBackup/

ED01-CMS v20180505 was discovered to contain an arbitrary file upload vulnerability via /admin/users.php?source=edit_use

HongCMS 3.0.0 allows arbitrary file deletion via the component /admin/index.php/template/ajax?action=delete.

Verydows v2.0 was discovered to contain an arbitrary file deletion vulnerability via \backend\database_controller.php.

Verydows v2.0 was discovered to contain an arbitrary file deletion vulnerability via \backend\file_controller.php.

A path traversal vulnerability in XPLATFORM's runtime archive function could lead to arbitrary file creation. When the .

Insufficient script validation of the admin page enables XSS, which causes unauthorized users to steal admin privileges.

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP). Prior to version 2.7.0, server side authenticatio

Ballcat Codegen provides the function of online editing code to generate templates. In versions prior to 1.0.0.beta.2, a

Apache Doris, prior to 1.0.0, used a hardcoded key and IV to initialize the cipher used for ldap password, which may lea

ESAPI (The OWASP Enterprise Security API) is a free, open source, web application security control library. Prior to ver

A researcher reported a Directory Transversal Vulnerability in Serv-U 15.3. This may allow access to files relating to t

The package czproject/git-php before 4.0.3 are vulnerable to Command Injection via git argument injection. When calling

MP4Box is a component of GPAC-2.0.0, which is a widely-used third-party package on RPM Fusion. When MP4Box tries to pars

PJSIP is a free and open source multimedia communication library written in C. A denial-of-service vulnerability affects

IBM Planning Analytics Local 2.0 could allow an attacker to upload arbitrary executable files which, when executed by an

The Videos sync PDF WordPress plugin through 1.7.4 does not validate the p parameter before using it in an include state

The Web To Print Shop : uDraw WordPress plugin before 3.3.3 does not validate the url parameter in its udraw_convert_url

The SP Project & Document Manager WordPress plugin before 4.24 allows any authenticated users, such as subscribers, to u

IBM Planning Analytics Workspace 2.0 could be vulnerable to malicious file upload by not validating the file types or si

The Tatsu WordPress plugin before 3.3.12 add_custom_font action can be used without prior authentication to upload a rog

The Advanced Page Visit Counter WordPress plugin before 6.1.6 does not escape the artID parameter before using it in a S

The BeanShell components of IRISNext through 9.8.28 allow execution of arbitrary commands on the target server by creati

Typemill v1.5.3 was discovered to contain an arbitrary file upload vulnerability via the upload function. This vulnerabi

VeryFitPro (com.veryfit2hr.second) 3.2.8 hashes the account's password locally on the device and uses the hash to authen

It is possible to obtain the first administrator's hash set up in Terramaster F4-210, F2-210 TOS 4.2.X (4.2.15-210714151

In Terramaster F4-210, F2-210 TOS 4.2.X (4.2.15-2107141517), an attacker can self-sign session cookies by knowing the ta

An authenticated attacker can execute arbitrary commands as root in Terramaster F4-210, F2-210 TOS 4.2.X (4.2.15-2107141

Non-Privilege User Can View Patient’s Disclosures in GitHub repository openemr/openemr prior to 6.1.0.1.

There is a Directory Traversal vulnerability in Artica Proxy (4.30.000000 SP206 through SP255, and VMware appliance 4.30

A SQL Injection vulnerability exists in UniverSIS UniverSIS-API through 1.2.1 via the $select parameter to multiple API

Artifex Ghostscript through 9.26 mishandles .completefont. NOTE: this issue exists because of an incomplete fix for CVE-

HtmlUnit NekoHtml Parser before 2.61.0 suffers from a denial of service vulnerability. Crafted input associated with the

Out-of-bounds Read in r_bin_java_bootstrap_methods_attr_new function in GitHub repository radareorg/radare2 prior to 5.7