2022

When importing a revoked key that specified key compromise as the revocation reason, Thunderbird did not update the exis

After a VR Process is destroyed, a reference to it may have been retained and used, leading to a use-after-free and pote

<code>NSSToken</code> objects were referenced via direct points, and could have been accessed in an unsafe way on differ

Mozilla developers Kershaw Chang, Ryan VanderMeulen, and Randell Jesup reported memory safety bugs present in Firefox 97

It may be possible for an attacker to craft an email message that causes Thunderbird to perform an out-of-bounds write o

Mozilla VPN can load an OpenSSL configuration file from an unsecured directory. A user or attacker with limited privileg

Mozilla developers and community members Gabriele Svelto, Sebastian Hengst, Randell Jesup, Luan Herrera, Lars T Hansen,

If a domain name contained a RTL character, it would cause the domain to be rendered to the right of the path. This coul

It was possible to construct specific XSLT markup that would be able to bypass an iframe sandbox. This vulnerability aff

Mozilla developers and community members Julian Hector, Randell Jesup, Gabriele Svelto, Tyson Smith, Christian Holler, a

When transitioning in and out of fullscreen mode, a graphics object was not correctly protected; resulting in memory cor

An out of date graphics library (Angle) likely contained vulnerabilities that could potentially be exploited. This vulne

When receiving an OpenPGP/MIME signed email message that contains an additional outer MIME message layer, for example a

During the plaintext phase of the STARTTLS connection setup, protocol commands could have been injected and evaluated wi

An OAuth session fixation vulnerability existed in the VPN login flow, where an attacker could craft a custom login URL,

CodeIgniter is a PHP full-stack web framework. When an application uses (1) multiple session cookies (e.g., one for user

CodeIgniter is a PHP full-stack web framework. This vulnerability may allow attackers to spoof their IP address when the

In versions `<=8.5.1` of `jsonwebtoken` library, lack of algorithm definition in the `jwt.verify()` function can lead to

AyaCMS 3.1.2 is vulnerable to file deletion via /aya/module/admin/fst_del.inc.php

AyaCMS 3.1.2 is vulnerable to Arbitrary file upload via /aya/module/admin/fst_down.inc.php

AyaCMS v3.1.2 was found to have a code flaw in the ust_sql.inc.php file, which allows attackers to cause command executi

jsonwebtoken is an implementation of JSON Web Tokens. Versions `<= 8.5.1` of `jsonwebtoken` library can be misconfigured

Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerabilit

here is an arbitrary file upload vulnerability in the file management function module of Classcms3.5.

In JetBrains IntelliJ IDEA before 2022.3.1 code Templates were vulnerable to SSTI attacks.

In JetBrains IntelliJ IDEA before 2022.3.1 the "Validate JSP File" action used the HTTP protocol to download required JA

Apache ShardingSphere-Proxy prior to 5.3.0 when using MySQL as database backend didn't cleanup the database session comp

A user enumeration vulnerability exists in the login functionality of Ghost Foundation Ghost 5.9.4. A specially-crafted

An authentication bypass vulnerability exists in the newsletter subscription functionality of Ghost Foundation Ghost 5.9

A vulnerability was found in destiny.gg chat. It has been rated as problematic. This issue affects the function websocke

A vulnerability was found in ahorner text-helpers up to 1.0.x. It has been declared as critical. This vulnerability affe

The package liquidjs before 10.0.0 are vulnerable to Information Exposure when ownPropertyOnly parameter is set to False

Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.3.2.

Cross-Site Request Forgery (CSRF) in GitHub repository ikus060/rdiffweb prior to 2.5.4.

Inhabit Systems Pty Ltd Move CRM version 4, build 260 was discovered to contain a cross-site scripting (XSS) vulnerabili

A Stored Cross-site scripting (XSS) vulnerability via MAster.php in Sourcecodetester Simple Client Management System (SC

Untrusted search path vulnerability in Baidunetdisk Version 7.4.3 and earlier allows an attacker to gain privileges via

Open Redirect in GitHub repository ikus060/rdiffweb prior to 2.5.4.

Dataprobe iBoot-PDU FW versions prior to 1.42.06162022 contain a vulnerability where a specially crafted PHP script coul

Dataprobe iBoot-PDU FW versions prior to 1.42.06162022 contain a vulnerability where unauthenticated users could open PH

Dataprobe iBoot-PDU FW versions prior to 1.42.06162022 contain a vulnerability where certain PHP pages only validate whe

Dataprobe iBoot-PDU FW versions prior to 1.42.06162022 contain a vulnerability where the affected product allows an atta

Dataprobe iBoot-PDU FW versions prior to 1.42.06162022 contain a vulnerability where the affected product exposes sensit

Dataprobe iBoot-PDU FW versions prior to 1.42.06162022 contain a vulnerability where the device’s existing firmware allo

Dataprobe iBoot-PDU FW versions prior to 1.42.06162022 contain a vulnerability where a specific function does not saniti

A vulnerability was found in docconv up to 1.2.0. It has been declared as critical. This vulnerability affects the funct

A vulnerability was found in tatoeba2. It has been classified as problematic. This affects an unknown part of the compon

A vulnerability was found in pig-vector and classified as problematic. Affected by this issue is the function LogisticRe

A vulnerability has been found in Mingsoft MCMS 5.2.9 and classified as problematic. Affected by this vulnerability is t

A vulnerability, which was classified as critical, has been found in sslh. This issue affects the function hexdump of th