2022

Automated Logic's WebCtrl Server Version 6.1 'Help' index pages are vulnerable to open redirection. The vulnerability al

Eaton Intelligent Power Protector (IPP) prior to version 1.69 is vulnerable to stored Cross Site Scripting. The vulnerab

Smokescreen is a simple HTTP proxy that fogs over naughty URLs. The primary use case for Smokescreen is to prevent serve

IBM Security Guardium 10.5 stores user credentials in plain clear text which can be read by a local privileged user. IBM

IBM Security Guardium 11.3 could allow a remote attacker to obtain sensitive information, caused by the failure to prope

IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.5 and 6.1.0.0 through 6.1.1.0 could allow a remote at

Liferay Portal 7.3.7, 7.4.0, and 7.4.1, and Liferay DXP 7.2 fix pack 13, and 7.3 fix pack 2 does not properly check user

Cross-site scripting (XSS) vulnerability in the Asset module's asset categories selector in Liferay Portal 7.3.3 through

A bypass exists for Desire2Learn/D2L Brightspace’s “Disable Right Click” option in the quizzing feature, which allows a

Veritas NetBackup OpsCenter Analytics 9.1 allows XSS via the NetBackup Master Server Name, Display Name, NetBackup User

Open redirect vulnerability via endpoint authorize_and_redirect/?redirect= in GitHub repository posthog/posthog prior to

fleetdm/fleet is an open source device management, built on osquery. All versions of fleet making use of the teams featu

PyPDF2 is an open source python PDF library capable of splitting, merging, cropping, and transforming the pages of PDF f

The Autolinks WordPress plugin through 1.0.1 does not have CSRF check in place when updating its settings, and does not

The sanitisation step of the Safe SVG WordPress plugin before 1.9.10 can be bypassed by spoofing the content-type in the

The Good & Bad Comments WordPress plugin through 1.0.0 does not sanitise and escape its settings, which could allow high

The Page Security & Membership WordPress plugin through 1.5.15 does not sanitise and escape some of its settings, which

The Thank Me Later WordPress plugin through 3.3.4 does not sanitise and escape the Message Subject field before outputti

The RSVP and Event Management Plugin WordPress plugin before 2.7.8 does not have any authorisation checks when exporting

The WP Downgrade WordPress plugin before 1.2.3 only perform client side validation of its "WordPress Target Version" set

The Hummingbird WordPress plugin before 3.3.2 does not sanitise and escape the Config Name, which could allow high privi

The Caldera Forms WordPress plugin before 1.9.7 does not validate and escape the cf-api parameter before outputting it b

The SearchIQ WordPress plugin before 3.9 contains a flag to disable the verification of CSRF nonces, granting unauthenti

The Loco Translate WordPress plugin before 2.6.1 does not properly remove inline events from elements in the source tran

The Text Hover WordPress plugin before 4.2 does not sanitize and escape the text to hover, which could allow high privil

The Easy Digital Downloads WordPress plugin before 2.11.6 does not have CSRF check in place when inserting payment notes

The Easy Digital Downloads WordPress plugin before 2.11.6 does not sanitise and escape the Downloadable File Name in the

The Easy Social Feed Free and Pro WordPress plugins before 6.2.7 do not sanitise some of their parameters used via AJAX

Authenticated (author or higher role) Stored Cross-Site Scripting (XSS) in Contest Gallery (WordPress plugin) <= 13.1.0.

A flaw was found in cri-o, where containers were incorrectly started with non-empty default permissions. A vulnerability

Cross-Site Request Forgery (CSRF) in Access Demo Importer <= 1.0.7 on WordPress allows an attacker to activate any insta

Stack buffer overflow issues were found in Opensc before version 0.22.0 in various places that could potentially crash p

Heap buffer overflow issues were found in Opensc before version 0.22.0 in pkcs15-oberthur.c that could potentially crash

A use after return issue was found in Opensc before version 0.22.0 in insert_pin function that could potentially crash p

A heap use after free issue was found in Opensc before version 0.22.0 in sc_file_valid.

A heap double free issue was found in Opensc before version 0.22.0 in sc_pkcs15_free_tokeninfo.

A flaw was found in Ansible Galaxy Collections. When collections are built manually, any files in the repository directo

A flaw was found in 389-ds-base. If an asterisk is imported as password hashes, either accidentally or maliciously, then

A flaw was found in Wildfly where insufficient RBAC restrictions may lead to expose metrics data. The highest threat fro

Eaton Intelligent Power Manager Infrastructure (IPM Infrastructure) version 1.5.0plus205 and all prior versions are vuln

Eaton Intelligent Power Manager Infrastructure (IPM Infrastructure) version 1.5.0plus205 and all prior versions are vuln

OSIsoft PI Vision 2020 versions prior to 3.5.0 could disclose information to a user with insufficient privileges for an

An exploitable vulnerability exists in the way Pixar OpenUSD 20.05 handles file offsets in binary USD files. A specially

In the Linux kernel through 3.1 there is an information disclosure issue via /proc/stat.

A flaw exists in Wordpress related to the 'wp-admin/press-this.php 'script improperly checking user permissions when pub

Zoho ManageEngine ADSelfService Plus before build 6122 allows a remote authenticated administrator to execute arbitrary

Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.6.8. The bug causes the program reads data

NULL Pointer Dereference in GitHub repository radareorg/radare2 prior to 5.6.8. This vulnerability is capable of making

Wasm3 0.5.0 has a heap-based buffer overflow in NewCodePage in m3_code.c (called indirectly from Compile_BranchTable in

Zoho ManageEngine Remote Access Plus before 10.1.2137.15 allows guest users to view license details.