2022

A memory leak was discovered in matio 1.5.21 and earlier in Mat_VarReadNextInfo5() in mat5.c via a crafted file. This is

An integer overflow vulnerability was found in FFmpeg versions before 4.4.2 and before 5.0.1 in g729_parse() in llibavco

IBM ICP4A - User Management System Component (IBM Cloud Pak for Business Automation V21.0.3 through V21.0.3-IF008, V21.0

The Photo Gallery by 10Web WordPress plugin before 1.6.3 does not properly sanitize the $_GET['image_url'] variable, whi

The Fast Flow WordPress plugin before 1.2.12 does not sanitise and escape the page parameter before outputting back in a

The Import and export users and customers WordPress plugin before 1.19.2.1 does not sanitise and escaped imported CSV da

The LifterLMS PayPal WordPress plugin before 1.4.0 does not sanitise and escape some parameters from the payment confirm

The Visual Form Builder WordPress plugin before 3.0.7 does not sanitise and escape the form's 'Email to' field , which c

The AdRotate WordPress plugin before 5.8.23 does not sanitise and escape Advert Names which could allow high privilege u

The AdRotate WordPress plugin before 5.8.23 does not escape Group Names, which could allow high privilege users to perfo

The Content Egg WordPress plugin before 5.3.0 does not sanitise and escape the page parameter before outputting back in

The Event List WordPress plugin before 0.8.8 does not sanitise and escape some of its settings, allowing high privilege

The Ad Invalid Click Protector (AICP) WordPress plugin before 1.2.7 does not have CSRF check deleting banned users, whic

The All In One WP Security & Firewall WordPress plugin before 4.4.11 does not validate, sanitise and escape the redirect

The Advanced Page Visit Counter WordPress plugin before 6.1.2 does not sanitise and escape some input before outputting

In Vendure versions 0.1.0-alpha.2 to 1.5.1 are affected by Stored XSS vulnerability, where an attacker having catalog pe

relan exFAT 1.3.0 allows local users to obtain sensitive information (data from deleted files in the filesystem) in cert

A Improper Privilege Management vulnerability in SUSE Rancher allows write access to the Catalog for any user when restr

The RSS extension before 2022-04-29 for MediaWiki allows XSS via an rss element (if the feed is in $wgRSSUrlWhitelist an

Cyclos 4 PRO 4.14.7 and before does not validate user input at error inform, which allows remote unauthenticated attacke

A Dom-based Cross-site scripting (XSS) vulnerability at registration account in Cyclos 4 PRO.14.7 and before allows remo

This affects the package pistacheio/pistache before 0.0.3.20220425. It is possible to traverse directories to fetch arbi

The package angular after 1.7.0 are vulnerable to Regular Expression Denial of Service (ReDoS) by providing a custom loc

All versions of package com.alibaba.oneagent:one-java-agent-plugin are vulnerable to Arbitrary File Write via Archive Ex

All versions of package dset are vulnerable to Prototype Pollution via 'dset/merge' mode, as the dset function checks fo

All versions of package materialize-css are vulnerable to Cross-site Scripting (XSS) due to improper escape of user inpu

This affects all versions of package org.nanohttpd:nanohttpd. Whenever an HTTP Session is parsing the body of an HTTP re

The package s-cart/s-cart before 6.9; the package s-cart/core before 6.9 are vulnerable to Cross-site Scripting (XSS) wh

In Shopizer versions 2.0 to 2.17.0 a regular admin can permanently delete a superadmin (although this cannot happen acco

A Stored Cross Site Scripting (XSS) vulnerability exists in Shopizer versions 2.0 through 2.17.0, where a privileged use

A misconfiguration of RSA in PingID iOS app prior to 1.19 is vulnerable to pre-computed dictionary attacks, leading to a

A misconfiguration of RSA in PingID Android app prior to 1.19 is vulnerable to pre-computed dictionary attacks, leading

Woodpecker before 0.15.1 allows XSS via build logs because web/src/components/repo/build/BuildLog.vue lacks escaping.

NVIDIA Omniverse Nucleus and Cache contain a vulnerability in its configuration of OpenSSL, where an attacker with physi

DJI drone devices sold in 2017 through 2022 broadcast unencrypted information about the drone operator's physical locati

This affects the package @yaireo/tagify before 4.9.8. The package is used for rendering UI components inside the input o

Multiple (13x) Cross-Site Request Forgery (CSRF) vulnerabilities in WPKube's Subscribe To Comments Reloaded plugin <= 21

Users with the capability to configure badge criteria (teachers and managers by default) were able to configure course b

Linux distributions using CAP_SYS_NICE for gnome-shell may be exposed to a privilege escalation issue. An attacker, with

A use-after-free vulnerability was found in the Linux kernel in drivers/net/hamradio. This flaw allows a local attacker

A flaw was found in the Linux kernel in linux/net/netfilter/nf_tables_api.c of the netfilter subsystem. This flaw allows

Insufficient capability checks could allow users with the moodle/site:uploadusers capability to delete users, without ha

A cross-site scripting (XSS) vulnerability exists in the "contact us" plugin for Subrion CMS <= 4.2.1 version via "List

Cross-site Scripting (XSS) in GitHub repository livehelperchat/livehelperchat prior to 3.99v. The attacker can execute m

The Nimbus skin for MediaWiki through 1.37.2 (before 6f9c8fb868345701d9544a54d9752515aace39df) allows XSS in Advertise l

The FanBoxes extension for MediaWiki through 1.37.2 (before 027ffb0b9d6fe0d823810cf03f5b562a212162d4) allows Special:Use

The Private Domains extension for MediaWiki through 1.37.2 (before 1ad65d4c1c199b375ea80988d99ab51ae068f766) allows CSRF

WBCE CMS 1.5.2 is vulnerable to Cross Site Scripting (XSS).

Limbas 4.3.36.1319 is vulnerable to Cross Site Scripting (XSS).

org.xwiki.commons:xwiki-commons-xml is a common module used by other XWiki top level projects. Starting in version 2.7 a