2022

Cross-Site Request Forgery (CSRF) vulnerability in Yooslider Yoo Slider <= 2.0.0 on WordPress allows attackers to create

Reflected cross site scripting (XSS)

Cross-site Scripting (XSS) vulnerability in Citrix StoreFront affects version 1912 before CU5 and version 3.12 before CU

VMware Workspace ONE Access, Identity Manager and vRealize Automation contain an information disclosure vulnerability du

VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a cross site request forgery vulnerability

The image proxy component in Mattermost version 6.4.1 and earlier allocates memory for multiple copies of a proxied imag

One of the API in Mattermost version 6.4.1 and earlier fails to properly protect the permissions, which allows the authe

A use-after-free vulnerability was found in drm_lease_held in drivers/gpu/drm/drm_lease.c in the Linux kernel due to a r

A CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could result in information d

A PHP Local File inclusion vulnerability in the Redbasic theme for Hubzilla before version 7.2 allows remote attackers t

An issue in EasyIO CPT Graphics v0.8 allows attackers to discover valid users in the application.

An XSS issue was discovered in MantisBT before 2.25.3. Improper escaping of a Plugin name allows execution of arbitrary

Automox Agent prior to version 37 on Windows and Linux and Version 36 on OSX could allow for a non privileged user to ob

CMSimple 5.4 is vulnerable to Cross Site Scripting (XSS) via the file upload feature.

Froxlor through 0.10.22 does not perform validation on user input passed in the customermail GET parameter. The value of

Cross site scripting (XSS) vulnerability in tramyardg hotel-mgmt-system, allows attackers to execute arbitrary code when

A post-authentication arbitrary file read vulnerability impacting end-of-life Secure Remote Access (SRA) products and ol

A Cross-Site Request Forgery (CSRF) in Pluck CMS v4.7.15 allows attackers to delete arbitrary pages.

stored xss due to unsantized anchor url in GitHub repository alvarotrigo/fullpage.js prior to 4.0.4. stored xss .

Path Traversal in GitHub repository gruntjs/grunt prior to 1.5.2.

Jenkins Google Compute Engine Plugin 4.3.8 and earlier stores private keys unencrypted in cloud agent config.xml files o

Missing permission checks in Jenkins Publish Over FTP Plugin 1.16 and earlier allow attackers with Overall/Read permissi

Jenkins promoted builds Plugin 873.v6149db_d64130 and earlier, except 3.10.1, does not validate the names of promotions

A cross-site request forgery (CSRF) vulnerability in Jenkins Subversion Plugin 2.15.3 and earlier allows attackers to co

Jenkins Pipeline: Shared Groovy Libraries Plugin 564.ve62a_4eb_b_e039 and earlier, except 2.21.3, allows attackers able

Jenkins Subversion Plugin 2.15.3 and earlier does not escape the name and description of List Subversion tags (and more)

Jenkins promoted builds Plugin 873.v6149db_d64130 and earlier, except 3.10.1, does not escape the name and description o

Jenkins Node and Label parameter Plugin 1.10.3 and earlier does not escape the name and description of Node and Label pa

Jenkins Mask Passwords Plugin 3.0 and earlier does not escape the name and description of Non-Stored Password parameters

Jenkins Job Generator Plugin 1.22 and earlier does not escape the name and description of Generator Parameter and Genera

Jenkins Jira Plugin 3.7 and earlier, except 3.6.1, does not escape the name and description of Jira Issue and Jira Relea

Jenkins Git Parameter Plugin 0.9.15 and earlier does not escape the name and description of Git parameters on views disp

Jenkins Gerrit Trigger Plugin 2.35.2 and earlier does not escape the name and description of Base64 Encoded String param

Jenkins Extended Choice Parameter Plugin 346.vd87693c5a_86c and earlier does not escape the name and description of Exte

Jenkins CVS Plugin 2.19 and earlier does not escape the name and description of CVS Symbolic Name parameters on views di

Jenkins Credentials Plugin 1111.v35a_307992395 and earlier, except 1087.1089.v2f1b_9a_b_040e4, 1074.1076.v39c30cecb_0e2,

rtl_433 21.12 was discovered to contain a stack overflow in the function acurite_00275rm_decode at /devices/acurite.c. T

There is a Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability in Logitech Sync for Windows prior to 2.4.574

Git for Windows is a fork of Git containing Windows-specific patches. This vulnerability affects users working on multi-

Dell PowerScale OneFS, versions 8.2.2-9.3.x, contain a time-of-check-to-time-of-use vulnerability. A local user with acc

Dell PowerScale OneFS, 8.2,x, 9.1.0.x, 9.2.1.x, and 9.3.0.x contain a denial of service vulnerability. A local malicious

Dell PowerScale OneFS, versions 8.2.0-9.3.0, contains an Improper Handling of Insufficient Permissions vulnerability. An

Dell PowerScale OneFS, 8.2.2 - 9.3.0.x, contain a missing release of memory after effective lifetime vulnerability. An a

Dell PowerScale OneFS, versions 9.0.0-9.3.0, contain an improper authorization of index containing sensitive information

Dell PowerScale OneFS, versions 8.2.2 and above, contain a password disclosure vulnerability. An unprivileged local atta

Apache Subversion SVN authz protected copyfrom paths regression Subversion servers reveal 'copyfrom' paths that should b

A vulnerability within the Avira Password Manager Browser Extensions provided a potential loophole where, if a user visi

Due to insufficient input validation, SAPUI5 library(vbm) - versions 750, 753, 754, 755, 75, allows an unauthenticated a

SAP BusinessObjects Business Intelligence Platform (BI Workspace) - version 420, is susceptible to a Cross-Site Scriptin

SAP NetWeaver ABAP Server and ABAP Platform - versions 740, 750, 787, allows an unauthenticated attacker to redirect use