2022

Authenticated (author+) Stored Cross-Site Scripting (XSS) vulnerability in Themes Awesome History Timeline plugin <= 1.0

Authenticated (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Awesome UG Torro Forms plugin <= 1.0.16

Cross-Site Request Forgery (CSRF) vulnerability in YDS Support Ticket System plugin <= 1.0 at WordPress.

Unauthenticated Plugin Settings Change vulnerability in Awesome Filterable Portfolio plugin <= 1.9.7 at WordPress.

There is a broken access control vulnerability in ZTE ZXvSTB product. Due to improper permission control, attackers coul

Tenda AC15 and AC18 routers V15.03.05.19 contain stack overflow vulnerabilities in the function fromDhcpListClient with

Tenda AC15 and AC18 routers V15.03.05.19 contain heap overflow vulnerabilities in the function setSchedWifi with the req

Tenda AC15 and AC18 routers V15.03.05.19 contain stack overflow vulnerabilities in the function setSmartPowerManagement

Tenda AC15 and AC18 router V15.03.05.19 contains stack overflow vulnerability in the function fromNatStaticSetting with

Tenda AC15 router V15.03.05.19 contains a stack overflow vulnerability in the function formSetQosBand->FUN_0007dd20 with

Tenda AC15 router V15.03.05.19 contains a stack overflow via the list parameter at /goform/fast_setting_wifi_set

Multiple Authenticated (contributor+) Stored Cross-Site Scripting (XSS) vulnerabilities in GS Testimonial Slider plugin

Online Tours & Travels Management System v1.0 was discovered to contain a SQL injection vulnerability via the id paramet

Online Tours & Travels Management System v1.0 was discovered to contain a SQL injection vulnerability via the id paramet

Online Tours & Travels Management System v1.0 was discovered to contain a SQL injection vulnerability via the id paramet

The Wordfence Security – Firewall & Malware Scan plugin for WordPress is vulnerable to Stored Cross-Site Scripting in ve

Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Max Foundry Button Plugin MaxButtons plugin <=

Cross-Site Request Forgery (CSRF) vulnerability in AlgolPlus Advanced Dynamic Pricing for WooCommerce plugin <= 4.1.3 at

Authenticated (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Fullworks Meet My Team plugin <= 2.0.5 a

Multiple Authenticated (contributor+) Stored Cross-Site Scripting (XSS) vulnerabilities in Blossom Recipe Maker plugin <

Authenticated (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in WHA Crossword plugin <= 1.1.10 at WordPr

Cross-Site Request Forgery (CSRF) vulnerability in Topdigitaltrends Mega Addons For WPBakery Page Builder plugin <= 4.2.

A local privilege escalation vulnerability in UI Desktop for Windows (Version 0.55.1.2 and earlier) allows a malicious a

When curl is used to retrieve and parse cookies from a HTTP(S) server, itaccepts cookies using control codes that when l

The “LANDesk(R) Management Agent” service exposes a socket and once connected, it is possible to launch commands only fo

The Image Hover Effects Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Title & Descr

An integer underflow in WhatsApp could have caused remote code execution when receiving a crafted video file.

A code injection vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Sophos Firewa

There exists an unchecked length field in UBoot. The U-Boot DFU implementation does not bound the length field in USB DF

HashiCorp Consul and Consul Enterprise up to 1.11.8, 1.12.4, and 1.13.1 do not check for multiple SAN URI values in a CS

A heap out-of-bounds memory write exists in FFMPEG since version 5.1. The size calculation in `build_open_gop_key_points

In JetBrains TeamCity before 2022.04.4 environmental variables of "password" type could be logged when using custom Perf

An issue has been found in PBC through 2022-8-27. A SEGV issue detected in the function pbc_wmessage_integer in src/wmes

There exists an arbitrary memory read within the Linux Kernel BPF - Constants provided to fill pointers in structs passe

Session Fixation in GitHub repository ikus060/rdiffweb prior to 2.4.7.

Apache Pulsar Brokers and Proxies create an internal Pulsar Admin Client that does not verify peer TLS certificates, eve

TLS hostname verification cannot be enabled in the Pulsar Broker's Java Client, the Pulsar Broker's Java Admin Client, t

Delayed TLS hostname verification in the Pulsar Java Client and the Pulsar Proxy make each client vulnerable to a man in

Improper Input Validation vulnerability in Proxy component of Apache Pulsar allows an attacker to make TCP/IP connection

netlify-ipx is an on-Demand image optimization for Netlify using ipx. In versions prior to 1.2.3, an attacker can bypass

Arvados is an open source platform for managing and analyzing biomedical big data. In versions prior to 2.4.3, when usin

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. In versions prio

In 0.10.0 or older versions of Apache Pinot, Pinot query endpoint and realtime ingestion layer has a vulnerability in un

fhir-works-on-aws-authz-smart is an implementation of the authorization interface from the FHIR Works interface. Version

python-jwt is a module for generating and verifying JSON Web Tokens. Versions prior to 3.3.4 are subject to Authenticati

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. In versions prio

hoek before 8.5.1 and 9.x before 9.0.3 allows prototype poisoning in the clone function.

In Kitty before 0.26.2, insufficient validation in the desktop notification escape sequence can lead to arbitrary code e

Veritas System Recovery (VSR) versions 18 and 21 store a network destination password in the Windows registry during con

A Reflected Cross-Site Scripting (XSS) vulnerability affects the Veritas Desktop Laptop Option (DLO) application login p