2022

The Simple Payment Donations & Subscriptions WordPress plugin before 4.2.1 does not sanitise and escape user input given

The Visual Portfolio, Photo Gallery & Post Grid WordPress plugin before 2.18.0 does not have proper authorisation checks

The Directorist WordPress plugin before 7.3.1 discloses the email address of all users in an AJAX action available to bo

The WP Database Backup WordPress plugin before 5.9 does not escape some of its settings, which could allow high privileg

The Simple Single Sign On WordPress plugin through 4.1.0 leaks its OAuth client_secret, which could be used by attackers

Deserialization of Untrusted Data vulnerability in the message processing component of Bitdefender GravityZone Console a

Cross-site Scripting (XSS) - Reflected in GitHub repository splitbrain/dokuwiki prior to 2022-07-31a.

Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is run

Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is run

Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is run

Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is run

Apache IoTDB grafana-connector version 0.13.0 contains an interface without authorization, which may expose the internal

Apache IoTDB version 0.13.0 is vulnerable by session id attack. Users should upgrade to version 0.13.1 which addresses t

The tinygltf library uses the C library function wordexp() to perform file path expansion on untrusted paths that are pr

A vulnerability classified as critical was found in SourceCodester Clinics Patient Management System. Affected by this v

123elf Lotus 1-2-3 before 1.0.0rc3 for Linux, and Lotus 1-2-3 R3 for UNIX and other platforms through 9.8.2, allow attac

An issue was discovered in the Linux kernel before 5.19. In pxa3xx_gcu_write in drivers/video/fbdev/pxa3xx-gcu.c, the co

Attacker might be able to execute malicious Perl code in the Template toolkit, by having the admin installing an unverif

An attacker who is logged into OTRS as an admin user may manipulate customer URL field to store JavaScript code to be ru

An attacker who is logged into OTRS as an admin user may manipulate the URL to cause execution of JavaScript in the cont

Cotonti Siena 0.9.20 allows admins to conduct stored XSS attacks via a direct message (DM).

Cotonti Siena 0.9.20 allows admins to conduct stored XSS attacks via a forum post.

An issue was discovered in PSPP 1.6.2. There is a heap-based buffer overflow at the function read_string in utilities/ps

An issue was discovered in PSPP 1.6.2. There is a heap-based buffer overflow at the function read_bytes_internal in util

sign_pFwInfo in Samsung mTower through 0.3.0 has a missing check on the return value of EC_KEY_set_public_key_affine_coo

There is a NULL pointer dereference in aes256_encrypt in Samsung mTower through 0.3.0 due to a missing check on the retu

sign_pFwInfo in Samsung mTower through 0.3.0 has a missing check on the return value of EC_KEY_set_private_key, leading

Server-side JavaScript injection in Appsmith through 1.7.14 allows remote attackers to execute arbitrary JavaScript code

Blackboard Learn 1.10.1 allows remote authenticated users to read unintended files by entering student credentials and t

A vulnerability was found in Sourcecodehero ERP System Project. It has been rated as critical. This issue affects some u

Use After Free in GitHub repository vim/vim prior to 9.0.0360.

Expense Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /Home/deb

libvncclient v0.9.13 was discovered to contain a memory leak via the function rfbClientCleanup().

PKUVCL davs2 v1.6.205 was discovered to contain a global buffer overflow via the function parse_sequence_header() at sou

A local file disclosure vulnerability in /appConfig/userDB.json of Telos Alliance Omnia MPX Node through 1.0.0-1.4.9 all

influxData influxDB before v1.8.10 contains no authentication mechanism or controls, allowing unauthenticated attackers

A stored cross-site scripting (XSS) vulnerability in /client.php of Garage Management System v1.0 allows attackers to ex

An access control issue in the component print.php of Garage Management System v1.0 allows unauthenticated attackers to

Grafana Image Renderer is a Grafana backend plugin that handles rendering of panels & dashboards to PNGs using a headles

This package is a PrestaShop module that allows users to post reviews and rate products. There is a vulnerability where

Databasir is a database metadata management platform. Databasir <= 1.06 has Server-Side Request Forgery (SSRF) vulnerabi

Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. The Matrix specificatio

Improper Access Control in GitHub repository jgraph/drawio prior to 20.2.8.

SFTPGo is configurable SFTP server with optional HTTP/S, FTP/S and WebDAV support. SFTPGo WebAdmin and WebClient support

Dell Command Update, Dell Update and Alienware Update versions prior to 4.6.0 contains a Local Privilege Escalation Vuln

Dell PowerScale OneFS, versions 9.0.0 up to and including 9.1.0.20, 9.2.1.13, 9.3.0.6, and 9.4.0.3, contain a relative p

Dell PowerScale OneFS, versions 9.0.0 up to and including 9.1.0.19, 9.2.1.12, 9.3.0.6, and 9.4.0.3, contain an unprotect

Dell PowerScale OneFS, versions 9.0.0 up to and including 9.1.0.20, 9.2.1.13, 9.3.0.6, and 9.4.0.3 , contain an insertio

Server-side Request Forgery (SSRF) vulnerability in PublicCMS before 4.0.202011.b via /publiccms/admin/ueditor when the

Modsecurity owasp-modsecurity-crs 3.2.0 (Paranoia level at PL1) has a SQL injection bypass vulnerability. Attackers can