2022

Out-of-bounds Read in r_bin_java_constant_value_attr_new function in GitHub repository radareorg/radare2 prior to 5.7.0.

Out-of-bounds Read in mrb_obj_is_kind_of in in GitHub repository mruby/mruby prior to 3.2. # Impact: Possible arbitrary

A vulnerability was reported in Lenovo System Update that could allow a local user with interactive system access the ab

A DLL search path vulnerability was reported in Lenovo PCManager prior to version 4.0.40.2175 that could allow privilege

MCMS v5.2.7 contains a Cross-Site Request Forgery (CSRF) via /role/saveOrUpdateRole.do. This vulnerability allows attack

IBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7 is vulnerable to cross-site request forgery which could allow an attacke

service_windows.go in the kardianos service package for Go omits quoting that is sometimes needed for execution of a Win

In the Linux kernel before 5.17.3, fs/io_uring.c has a use-after-free due to a race condition in io_uring timeouts. This

There is a pointer double free vulnerability in Some MIUI Services. When a function is called, the memory pointer is cop

Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.7.0. The bug causes the program reads data

An attacker may be able to inject client-side JavaScript code on multiple instances within all versions of Uffizio GPS T

FreeType commit 22a0cccb4d9d002f33c1ba7a4b36812c7d4f46b5 was discovered to contain a segmentation violation via the func

FreeType commit 53dfdcd8198d2b3201a23c4bad9190519ba918db was discovered to contain a segmentation violation via the func

SQL injection in GridHelperService.php in GitHub repository pimcore/pimcore prior to 10.3.6. This vulnerability is capab

ASUS WebStorage has a hardcoded API Token in the APP source code. An unauthenticated remote attacker can use this token

Certain Neko-related HTML parsers allow a denial of service via crafted Processing Instruction (PI) input that causes ex

Dell EMC Repository Manager version 3.4.0 contains a plain-text password storage vulnerability. A local attacker could p

Dell EMC AppSync versions from 3.9 to 4.3 contain a path traversal vulnerability in AppSync server. A remote unauthentic

UCMS v1.6 was discovered to contain an arbitrary file read vulnerability.

An arbitrary file upload vulnerability in UCMS v1.6 allows attackers to execute arbitrary code via a crafted PHP file.

Attendance and Payroll System v1.0 was discovered to contain a SQL injection vulnerability via the component \admin\posi

Attendance and Payroll System v1.0 was discovered to contain a SQL injection vulnerability via the component \admin\empl

Attendance and Payroll System v1.0 was discovered to contain a SQL injection vulnerability via the component \admin\sche

Attendance and Payroll System v1.0 was discovered to contain a SQL injection vulnerability via the component \admin\over

Attendance and Payroll System v1.0 was discovered to contain a SQL injection vulnerability via the component \admin\dedu

Attendance and Payroll System v1.0 was discovered to contain a SQL injection vulnerability via the component \admin\cash

Attendance and Payroll System v1.0 was discovered to contain a SQL injection vulnerability via the component \admin\atte

Attendance and Payroll System v1.0 was discovered to contain a SQL injection vulnerability via the component \admin\sche

Attendance and Payroll System v1.0 was discovered to contain a SQL injection vulnerability via the component \admin\posi

Attendance and Payroll System v1.0 was discovered to contain a SQL injection vulnerability via the component \admin\sche

Attendance and Payroll System v1.0 was discovered to contain a SQL injection vulnerability via the component \admin\over

Attendance and Payroll System v1.0 was discovered to contain a SQL injection vulnerability via the component \admin\atte

Attendance and Payroll System v1.0 was discovered to contain a SQL injection vulnerability via the component \admin\atte

Attendance and Payroll System v1.0 was discovered to contain a SQL injection vulnerability via the component \admin\cash

Attendance and Payroll System v1.0 was discovered to contain a SQL injection vulnerability via the component \admin\empl

Victor v1.0 was discovered to contain a remote code execution (RCE) vulnerability via the component admin/profile.php?se

The Bulletproofs 2017/1066 paper mishandles Fiat-Shamir generation because the hash computation fails to include all of

A vulnerability in the packet processing functionality of Cisco TelePresence Collaboration Endpoint (CE) Software and Ci

A vulnerability in the key-based SSH authentication mechanism of Cisco Umbrella Virtual Appliance (VA) could allow an un

A vulnerability in the configuration file protections of Cisco Virtualized Infrastructure Manager (VIM) could allow an a

Some Xiaomi models have a vulnerability in a certain application. The vulnerability is caused by the lack of checksum wh

An intent redirection vulnerability in the Mi Browser product. This vulnerability is caused by the Mi Browser does not v

Combodo iTop is a web based IT Service Management tool. In 3.0.0 beta releases prior to 3.0.0 beta3 a malicious script c

GLPI is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and

GLPI is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and

Blazer before 2.6.0 allows SQL Injection. In certain circumstances, an attacker could get a user to run a query they wou

The CreateRedirect extension before 2022-04-14 for MediaWiki does not properly check whether the user has permissions to

Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts file

Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 allows an unauthenticated attacker to inject arbitrary memcache commands i

In GNOME Epiphany before 41.4 and 42.x before 42.2, an HTML document can trigger a client buffer overflow (in ephy_strin