2022

An issue was discovered in MISP before 2.4.158. In UsersController.php, password confirmation can be bypassed via vector

Shopware is an open commerce platform based on Symfony Framework and Vue. Permissions set to sales channel context by ad

A denial of service vulnerability exists in MDT's firmware for the KNXnet/IP Secure router SCN-IP100.03 and KNX IP inter

Shopware is an open commerce platform based on Symfony Framework and Vue. In affected versions an attacker can abuse the

Databasir is a team-oriented relational database model document management platform. Databasir 1.01 has Server-Side Requ

Authorized users may install a maliciously modified package file when updating the device via the web user interface. Th

An issue was discovered on Olivetti d-COLOR MF3555 2XD_S000.002.271 devices. The Web Application is affected by Denial o

An issue was discovered on Olivetti d-COLOR MF3555 2XD_S000.002.271 devices. The Web Application is affected by Broken A

Amazon AWS amazon-ssm-agent before 3.1.1208.0 creates a world-writable sudoers file, which allows local attackers to inj

The generic P-256 feature in crypto/elliptic in Go before 1.17.9 and 1.18.x before 1.18.1 allows a panic via long scalar

Certificate.Verify in crypto/x509 in Go 1.18.x before 1.18.1 can be caused to panic on macOS when presented with certain

encoding/pem in Go before 1.17.9 and 1.18.x before 1.18.1 has a Decode stack overflow via a large amount of PEM data.

In APache APISIX before 3.13.1, the jwt-auth plugin has a security issue that leaks the user's secret key because the er

Cross-site request forgery (CSRF) vulnerability in 'MicroPayments - Paid Author Subscriptions, Content, Downloads, Membe

Databasir is a team-oriented relational database model document management platform. Databasir 1.01 has Use of Hard-code

Incomplete fix for CVE-2021-3101. Hotdog, prior to v1.0.2, did not mimic the resource limits, device restrictions, or sy

Incomplete fix for CVE-2021-3100. The Apache Log4j hotpatch package starting with log4j-cve-2021-44228-hotpatch-1.1-16 w

Hotdog, prior to v1.0.1, did not mimic the capabilities or the SELinux label of the target JVM process. This would allow

The Apache Log4j hotpatch package before log4j-cve-2021-44228-hotpatch-1.1-13 didn’t mimic the permissions of the JVM be

A Memory Corruption vulnerability may lead to code execution through maliciously crafted DLL files. It was fixed in PDFT

A maliciously crafted JT file in Autodesk AutoCAD 2022 may be used to write beyond the allocated buffer while parsing JT

Vulnerability in the Oracle Web Services Manager product of Oracle Fusion Middleware (component: Web Services Security).

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries).

Vulnerability in the Oracle Commerce Guided Search product of Oracle Commerce (component: Tools and Frameworks). The sup

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Business Logic Infra SEC).

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries).

Vulnerability in the Oracle Solaris product of Oracle Systems (component: Utility). The supported version that is affect

Vulnerability in Oracle GoldenGate (component: OGG Core Library). The supported version that is affected is Prior to 23.

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions th

Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications Applications

Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications Applications

Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications Applications

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Ana

Vulnerability in the Oracle Database - Enterprise Edition Sharding component of Oracle Database Server. The supported ve

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Reactive WebServer). Supported versions tha

The Elementor Website Builder plugin for WordPress is vulnerable to unauthorized execution of several AJAX actions due t

The Simple File List WordPress plugin is vulnerable to Arbitrary File Download via the eeFile parameter found in the ~/i

The SiteGround Security plugin for WordPress is vulnerable to authentication bypass that allows unauthenticated users to

The Fancy Product Designer plugin for WordPress is vulnerable to Cross-Site Request Forgery via the FPD_Admin_Import cla

Real-time image information exposure is caused by insufficient authentication for activated RTSP port. This vulnerabilit

Improper input validation vulnerability in XPLATFORM's execBrowser method can cause execute arbitrary commands. IF the s

Insufficient Verification of input Data leading to arbitrary file download and execute was discovered in Nexacro platfor

ecjia-daojia 1.38.1-20210202629 is vulnerable to information leakage via content/apps/installer/classes/Helper.php. When

The package git before 1.11.0 are vulnerable to Command Injection via git argument injection. When calling the fetch(rem

IBM Security Guardium 10.5 and 11.3 uses weaker than expected cryptographic algorithms that could allow an attacker to d

HashiCorp Consul and Consul Enterprise up to 1.9.16, 1.10.9, and 1.11.4 may allow server side request forgery when the C

In Citrix XenMobile Server through 10.12 RP9, there is an Authenticated Directory Traversal vulnerability, leading to re

Invicti Acunetix before 14 allows CSV injection via the Description field on the Add Targets page, if the Export CSV fea

A vulnerability within the authentication process of Abacus ERP allows a remote attacker to bypass the second authentica