2022

A vulnerability named 'Non-Responsive Delegation Attack' (NRDelegation Attack) has been discovered in various DNS resolv

Mist is the command-line interface for the makedeb Package Repository. Prior to version 0.9.5, a user-provided `sudo` bi

NuProcess is an external process execution implementation for Java. In all the versions of NuProcess where it forks proc

Bifrost is a middleware package which can synchronize MySQL/MariaDB binlog data to other types of databases. Versions 1.

An HTTP response splitting attack in web application in ASUS RT-AX88U before v3.0.0.4.388.20558 allows an attacker to cr

Online Leave Management System v1.0 is vulnerable to SQL Injection via /leave_system/classes/Master.php?f=delete_applica

Online Leave Management System v1.0 is vulnerable to SQL Injection via /leave_system/classes/Master.php?f=delete_designa

Online Leave Management System v1.0 is vulnerable to SQL Injection via /leave_system/classes/Master.php?f=delete_leave_t

Zoo Management System v1.0 has an arbitrary file upload vulnerability in the picture upload point of the "save_event" fi

Zoo Management System v1.0 has an arbitrary file upload vulnerability in the picture upload point of the "save_animal" f

Wedding Planner v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/select.php.

Wedding Planner v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/feature_edit

Wedding Planner v1.0 was discovered to contain a SQL injection vulnerability via the booking parameter at /admin/client_

A vulnerability was found in Open5GS up to 2.4.10. It has been declared as problematic. Affected by this vulnerability i

Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.4.8.

The SEO Smart Links WordPress plugin through 3.0.1 does not sanitise and escape some of its settings, which could allow

The OAuth client Single Sign On WordPress plugin before 3.0.4 does not have authorisation and CSRF when updating its set

The Login Block IPs WordPress plugin through 1.0.0 does not have CSRF check in place when updating its settings, which c

The CM Download Manager WordPress plugin before 2.8.6 allows high privilege users such as admin to upload arbitrary file

The Slider Hero WordPress plugin before 8.4.4 does not escape the slider Name, which could allow high-privileged users t

The Generate PDF WordPress plugin before 3.6 does not sanitise and escape its settings, allowing high privilege users su

The WordLift WordPress plugin before 3.37.2 does not sanitise and escape its settings, allowing high privilege users suc

The Simple File List WordPress plugin before 4.4.12 does not escape parameters before outputting them back in attributes

The Bitcoin / Altcoin Faucet WordPress plugin through 1.6.0 does not have any CSRF check when saving its settings, allow

The Simple Bitcoin Faucets WordPress plugin through 1.7.0 does not have any authorisation and CSRF in an AJAX action, al

The Ldap WP Login / Active Directory Integration WordPress plugin before 3.0.2 does not have any authorisation and CSRF

The Download Manager WordPress plugin before 3.2.55 does not validate one of its settings, which could allow high privil

The Ninja Forms Contact Form WordPress plugin before 3.6.13 unserialises the content of an imported file, which could le

The WP Popup Builder WordPress plugin before 1.2.9 does not have authorisation and CSRF check in an AJAX action, allowin

The WP Popup Builder WordPress plugin before 1.2.9 does not sanitise and escape a parameter before outputting it back in

The Post SMTP Mailer/Email Log WordPress plugin before 2.1.7 does not have proper authorisation in some AJAX actions, wh

The SVG Support WordPress plugin before 2.5 does not properly handle SVG added via an URL, which could allow users with

The Restricted Site Access WordPress plugin before 7.3.2 prioritizes getting a visitor's IP from certain HTTP headers ov

The Scripts Organizer WordPress plugin before 3.0 does not have capability and CSRF checks in the saveScript AJAX action

Improper Cleanup on Thrown Exception in GitHub repository ikus060/rdiffweb prior to 2.4.8.

ieGeek IG20 hipcam RealServer V1.0 is vulnerable to Incorrect Access Control. The algorithm used to generate device IDs

Contec FXA3200 version 1.13 and under were discovered to contain a hard coded hash password for root stored in the compo

Contec FXA3200 version 1.13.00 and under suffers from Insecure Permissions in the Wireless LAN Manager interface which a

Academy Learning Management System before v5.9.1 was discovered to contain a reflected cross-site scripting (XSS) vulner

The package joblib from 0 and before 1.2.0 are vulnerable to Arbitrary Code Execution via the pre_dispatch flag in Paral

The package express-xss-sanitizer before 1.1.3 are vulnerable to Prototype Pollution via the allowedTags attribute, allo

An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0. An attacker can upload arbitrary files through ama

An issue was discovered in Zimbra Collaboration (ZCS) 8.8.x and 9.x (e.g., 8.8.15). The Sudo configuration permits the z

registerFont in FontMetrics.php in Dompdf before 2.0.1 allows remote file inclusion because a URI validation failure doe

Use After Free in GitHub repository vim/vim prior to 9.0.0579.

Stack-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0577.

The secp256k1-js package before 1.1.0 for Node.js implements ECDSA without required r and s validation, leading to signa

Nepxion Discovery is a solution for Spring Cloud. Discovery is vulnerable to a potential Server-Side Request Forgery (SS

Nepxion Discovery is a solution for Spring Cloud. Discover is vulnerable to SpEL Injection in discovery-commons. Discove

Jodit Editor is a WYSIWYG editor written in pure TypeScript without the use of additional libraries. Jodit Editor is vul