2022

In LibreHealth EHR 2.0.0, lack of sanitization of the GET parameters formseq and formid in interface\orders\find_order_p

In LibreHealth EHR 2.0.0, lack of sanitization of the GET parameters debug and InsId in interface\billing\sl_eob_process

Unrestructed file upload in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0. Attacker can send malicious

Bookeen Notea Firmware BK_R_1.0.5_20210608 is affected by a directory traversal vulnerability that allows an attacker to

The jquery.json-viewer library through 1.4.0 for Node.js does not properly escape characters such as < in a JSON object,

Talend Administration Center has a vulnerability that allows an authenticated user to use XML External Entity (XXE) proc

Talend Administration Center has a vulnerability that allows an authenticated user to use the Service Registry 'Add' fun

Unprotected Alternate Channel vulnerability in debug console of GateManager allows system administrator to obtain sensit

Reflected XSS in GitHub repository microweber/microweber prior to 1.2.16. Executing JavaScript as the victim

Use of static encryption key material allows forging an authentication token to other users within a tenant organization

Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV340 and RV345 Routers could all

Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV340 and RV345 Routers could all

On May 4, 2022, the following vulnerability in the ClamAV scanning library versions 0.103.5 and earlier and 0.104.2 and

Multiple vulnerabilities in the web engine of Cisco TelePresence Collaboration Endpoint (CE) Software and Cisco RoomOS S

Multiple vulnerabilities in the web engine of Cisco TelePresence Collaboration Endpoint (CE) Software and Cisco RoomOS S

A vulnerability in web-based management interface of Cisco Small Business RV340 and RV345 Routers could allow an authent

A vulnerability in Cisco SD-WAN vManage Software could allow an authenticated, local attacker to view sensitive informat

A server-generated error message containing sensitive information in Fortinet FortiOS 7.0.0 through 7.0.3, 6.4.0 through

An improper access control vulnerability [CWE-284] in FortiOS versions 6.4.8 and prior and 7.0.3 and prior may allow an

Experian Hunter 1.16 allows remote authenticated users to modify assumed-immutable elements via the (1) rule name parame

In nopCommerce 4.50.1, an open redirect vulnerability can be triggered by luring a user to authenticate to a nopCommerce

An XSS issue was discovered in browser_search_plugin.php in MantisBT before 2.25.2. Unescaped output of the return param

Jspxcms v10.2.0 allows attackers to execute a Server-Side Request Forgery (SSRF) via /cmscp/ext/collect/fetch_url.do?url

A reflected cross-site scripting (XSS) vulnerability in the component Query.php of arPHP v3.6.0 allows attackers to exec

Stack-based Buffer Overflow vulnerability in SiteManager allows logged-in or local user to cause arbitrary code executio

Insufficient Logging vulnerability in web server of Secomea GateManager allows logged in user to issue improper queries

Improper Handling of Insufficient Privileges vulnerability in Web UI of Secomea GateManager allows logged in user to acc

Cross-site Scripting (XSS) vulnerability in Web UI of Secomea GateManager allows phishing attacker to inject javascript

Information Exposure vulnerability in web UI of Secomea GateManager allows logged in user to query devices outside own s

Logging of Excessive Data vulnerability in audit log of Secomea GateManager allows logged in user to write text entries

Cross-Site Request Forgery (CSRF) vulnerability in Web UI of Secomea GateManager allows phishing attacker to issue get r

Inadequate Encryption Strength vulnerability in TLS stack of Secomea SiteManager, LinkManager, GateManager may facilitat

Cross-site scripting - Reflected in Create Subaccount in GitHub repository neorazorx/facturascripts prior to 2022.07. Th

DOM XSS in microweber ver 1.2.15 in GitHub repository microweber/microweber prior to 1.2.16. inject arbitrary js code, d

Permissions were not properly verified in the API on projects using version control in Git. This allowed projects to be

In voice service, there is a possible out of bounds write due to a stack-based buffer overflow. This could lead to local

In subtitle service, there is a possible application crash due to an integer overflow. This could lead to local denial o

In MM service, there is a possible out of bounds write due to a heap-based buffer overflow. This could lead to local esc

In MM service, there is a possible out of bounds write due to a stack-based buffer overflow. This could lead to local es

In aee daemon, there is a possible information disclosure due to improper access control. This could lead to local infor

In aee daemon, there is a possible information disclosure due to symbolic link following. This could lead to local infor

In aee daemon, there is a possible information disclosure due to a missing permission check. This could lead to local in

In aee daemon, there is a possible information disclosure due to a path traversal. This could lead to local information

eCosCentric eCosPro RTOS Versions 2.0.1 through 4.5.3 are vulnerable to integer wraparound in function calloc (an implem

Micrium OS Versions 5.10.1 and prior are vulnerable to integer wrap-around in functions Mem_DynPoolCreate, Mem_DynPoolCr

Given the TEE is compromised and controlled by the attacker, improper state maintenance in StrongBox allows attackers to

DLL hijacking vulnerability in Gear IconX PC Manager prior to version 2.1.220405.51 allows attacker to execute arbitrary

Improper input validation vulnerability in InstallAgent in Galaxy Store prior to version 4.5.41.8 allows attacker to ove

Improper authentication in Link to Windows Service prior to version 2.3.04.1 allows attacker to lock the device. The pat

Unprotected activities in Voice Note prior to version 21.3.51.11 allows attackers to record voice without user interacti