2022

In versions prior to 0.8.1, the linux-loader crate uses the offsets and sizes provided in the ELF headers to determine t

Passport-wsfed-saml2 is a ws-federation protocol and SAML2 tokens authentication provider for Passport. In versions prio

Tuleap is an Open Source Suite to improve management of software developments and collaboration. In versions prior to 14

Netty project is an event-driven asynchronous network application framework. Starting in version 4.1.83.Final and prior

Tuleap is an Open Source Suite to improve management of software developments and collaboration. In versions prior to 14

In SAP Solution Manager (Enterprise Search) - versions 740, and 750, an unauthenticated attacker can generate a link tha

SAP Disclosure Management - version 10.1, allows an authenticated attacker to exploit certain misconfigured application

Due to improper input sanitization in SAP Sourcing and SAP Contract Lifecycle Management - version 1100, an attacker can

Logrhythm Web Console 7.4.9 allows for HTML tag injection through Contextualize Action -> Create a new Contextualize Act

Due to a missing authentication check, SAP Business Objects Business Intelligence Platform (Web Intelligence) - versions

Due to insufficient input validation, SAP NetWeaver AS Java (HTTP Provider Service) - version 7.50, allows an unauthenti

SAP Solution Manager (Diagnostic Agent) - version 7.20, allows an authenticated attacker on Windows system to access a f

Insufficient processing of user input in WebSoft HCM 2021.2.3.327 allows an authenticated attacker to inject arbitrary H

Insufficient processing of user input in WebSoft HCM 2021.2.3.327 allows an unauthenticated attacker to inject arbitrary

Insufficient processing of user input in WebSoft HCM 2021.2.3.327 allows an authenticated attacker to inject arbitrary H

Insufficient processing of user input in WebSoft HCM 2021.2.3.327 allows an authenticated attacker to inject arbitrary H

A cleartext storage of sensitive information vulnerability exists in PcVue versions 8.10 through 15.2.3. This could all

An insertion of sensitive information into log file vulnerability exists in PcVue versions 15 through 15.2.2. This coul

The All-In-One Security (AIOS) WordPress plugin before 5.0.8 is susceptible to IP Spoofing attacks, which can lead to by

The Booster for WooCommerce WordPress plugin before 5.6.7, Booster Plus for WooCommerce WordPress plugin before 5.6.6, B

The Image Hover Effects WordPress plugin before 5.5 does not sanitise and escape some of its settings, which could allow

The Donation Button WordPress plugin through 4.0.0 does not sanitize and escapes some parameters, which could allow user

The Donation Button WordPress plugin through 4.0.0 does not properly check for privileges and nonce tokens in its "donat

The WooCommerce Shipping WordPress plugin through 1.2.11 does not sanitise and escape some of its settings, which could

Netty project is an event-driven asynchronous network application framework. In versions prior to 4.1.86.Final, a StackO

The Welcart e-Commerce WordPress plugin before 2.8.4 does not have authorisation and CSRF in an AJAX action, allowing an

The Welcart e-Commerce WordPress plugin before 2.8.4 does not sanitise and escape some parameters, which could allow any

The FlatPM WordPress plugin before 3.0.13 does not sanitise and escape some parameters before outputting them back in pa

The Essential Real Estate WordPress plugin before 3.9.6 does not sanitize and escapes some parameters, which could allow

The Directorist WordPress plugin before 7.4.2.2 suffers from an IDOR vulnerability which an attacker can exploit to chan

The Jetpack CRM WordPress plugin before 5.4.3 does not sanitise and escape its settings, allowing high privilege users s

The Helloprint WordPress plugin before 1.4.7 does not sanitise and escape a parameter before outputting it back in the p

The Easy Form Builder WordPress plugin before 3.4.0 does not sanitise and escape some of its settings, which could allow

The Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection WordPress plugin before 7.24 does not

The Memory Usage, Memory Limit, PHP and Server Memory Health Check and Fix Plugin WordPress plugin before 2.46 does not

The WP Tools Increase Maximum Limits, Repair, Server PHP Info, Javascript errors, File Permissions, Transients, Error Lo

The Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan WordPress plugin before 4

The Car Dealer (Dealership) and Vehicle sales WordPress Plugin WordPress plugin before 3.05 does not have proper authori

The Livemesh Addons for Elementor WordPress plugin before 7.2.4 does not sanitise and escape some of its settings, which

Cross-site Scripting (XSS) is a client-side code injection attack. The attacker aims to execute malicious scripts in a w

The GetYourGuide Ticketing WordPress plugin before 1.0.4 does not sanitise and escape some parameters, which could allow

Boa Web Server versions 0.94.13 through 0.94.14 fail to validate the correct security constraint on the HEAD HTTP method

Alist v3.5.1 is vulnerable to Cross Site Scripting (XSS) via the bulletin board.

An Out-of-bounds read vulnerability in Trend Micro Apex One and Apex One as a Service could allow a local attacker to di

An Out-of-bounds read vulnerability in Trend Micro Apex One and Apex One as a Service could allow a local attacker to di

An authenticated path traversal vulnerability exists in the Aruba EdgeConnect Enterprise command line interface. Success

An authenticated path traversal vulnerability exists in the Aruba EdgeConnect Enterprise web interface. Successful explo

Starting with Sametime 12, anonymous users are enabled by default. After logging in as an anonymous user, one has the ab

HCL Launch could allow a user with administrative privileges, including "Manage Security" permissions, the ability to re

HCL Workload Automation could allow a local user to overwrite key system files which would cause the system to crash.