2022

The Ultimate Member plugin for WordPress is vulnerable to arbitrary redirects due to insufficient validation on supplied

In the policies of adbd.te, there was a logic error which caused the CTS Listening Ports Test to report invalid results.

In setStream of WallpaperManager.java, there is a possible way to cause a permanent DoS due to improper input validation

A malicious or compromised UApp or ABL may coerce the bootloader into corrupting arbitrary memory potentially leading to

Insufficient bound checks in System Management Unit (SMU) PCIe Hot Plug table may result in access/updates from/to inval

Null pointer dereference in libr/bin/format/mach0/mach0.c in radareorg/radare2 in GitHub repository radareorg/radare2 pr

IBM Guardium Data Encryption (GDE) 4.0.0.0 and 5.0.0.0 is vulnerable to cross-site scripting. This vulnerability allows

A vulnerability has been identified in Desigo DXR2 (All versions < V01.21.142.5-22), Desigo PXC3 (All versions < V01.21.

A vulnerability has been identified in Desigo DXR2 (All versions < V01.21.142.5-22), Desigo PXC3 (All versions < V01.21.

Stored XSS in Add New Employee Form in Sourcecodester Employee Daily Task Management System 1.0 Allows Remote Attacker t

1Password for Mac 7.2.4 through 7.9.x before 7.9.3 is vulnerable to a process validation bypass. Malicious software runn

A stored cross-site scripting (XSS) vulnerability in PHProjekt PhpSimplyGest v1.3.0 allows attackers to execute arbitrar

An information exposure through log file vulnerability in Brocade SANNav versions before Brocade SANnav 2.2.0 could allo

There is a vulnerability in htmldoc 1.9.16. In image_load_jpeg function image.cxx when it calls malloc,'img->width' and

IBM Navigator for i 7.2, 7.3, and 7.4 (heritage version) could allow a remote attacker to obtain access to the web inter

IBM Robotic Process Automation 21.0.1 could allow a register user on the system to physically delete a queue that could

The Easily Generate Rest API Url WordPress plugin through 1.0.0 does not escape some of its settings, allowing high priv

The Slide Anything WordPress plugin before 2.3.44 does not sanitize and escape sliders' description, which could allow h

The Vertical scroll recent post WordPress plugin before 14.0 does not sanitise and escape a parameter before outputting

The Popup Maker WordPress plugin before 1.16.5 does not sanitise and escape some of its Popup settings, which could allo

The Themify Post Type Builder Search Addon WordPress plugin before 1.4.0 does not properly escape the current page URL b

The IgniteUp WordPress plugin through 3.4.1 does not sanitise and escape some fields when high privilege users don't hav

The WP Social Buttons WordPress plugin through 2.1 does not sanitise and escape its settings, allowing high privilege us

The Admin Menu Editor WordPress plugin through 1.0.4 does not sanitize and escape a parameter before outputting it back

The Popup by Supsystic WordPress plugin before 1.10.9 does not have any authentication and authorisation in an AJAX acti

The WPGraphQL WordPress plugin before 0.3.5 doesn't properly restrict access to information about other users' roles on

Brave before 1.34, when a Private Window with Tor Connectivity is used, leaks .onion URLs in Referer and Origin headers.

In the KeepKey firmware before 7.3.2,Flaws in the supervisor interface can be exploited to bypass important security res

A vulnerability in which attackers could forge HTTP requests to manipulate the `charm` data directory to access or delet

Multiple Authenticated (admin+) Persistent Cross-Site Scripting (XSS) vulnerabilities in Adam Skaat's Countdown & Clock

In Joomla component 'jDownloads 3.9.8.2 Stable' the remote user can change some parameters in the address bar and see th

The BigFix Console installer is created with InstallShield, which was affected by CVE-2021-41526, a vulnerability that c

The BigFix Client installer is created with InstallShield, which was affected by CVE-2021-41526, a vulnerability that co

The BigFix Server API installer is created with InstallShield, which was affected by CVE-2021-41526, a vulnerability tha

Misconfigured security-related HTTP headers: Several security-related headers were missing or mis-configured on the web

Weak web transport security (Weak TLS): An attacker may be able to decrypt the data using attacks

An issue was discovered in the Sametime chat feature in the Notes 11.0 - 11.0.1 FP4 clients. An authenticated Sametime c

There is a security vulnerability in login form related to Cross-site Request Forgery which prevents user to login after

HCL Commerce is affected by an Insufficient Session Expiration vulnerability. After the session expires, in some circums

Reflected Cross-Site Scripting (XSS) vulnerability in Adam Skaat's Countdown & Clock plugin on WordPress via &ycd_type v

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Adam Skaat

FUDforum 3.1.1 is vulnerable to Stored XSS.

Dragon Path Technologies Bharti Airtel Routers Hardware BDT-121 version 1.0 is vulnerable to Cross Site Scripting (XSS)

When handling a mismatched pre-authentication cookie, the application leaks the internal error message in the response,

Stored Cross-Site Scripting (XSS) vulnerability in Andrea Pernici News Sitemap for Google plugin <= 1.0.16 on WordPress,

The Splunk Enterprise REST API allows enumeration of usernames via the lockout error message. The potential vulnerabilit

Brocade SANnav before SANnav 2.2.0 application uses the Blowfish symmetric encryption algorithm for the storage of passw

IBM Guardium Data Encryption (GDE) 4.0.0 and 5.0.0 prepares a structured message for communication with another componen

SQL Injection vulnerability in admin/group_list.php in piwigo v2.9.5, via the group parameter to delete.

Netty is an open-source, asynchronous event-driven network application framework. The package `io.netty:netty-codec-http