2022

Out-of-bounds Read error in tiffcrop in libtiff 4.3.0 allows attackers to cause a denial-of-service via a crafted tiff f

Inaccurate display of Snippet files containing special characters in all versions of GitLab CE/EE allows an attacker to

An issue has been discovered in GitLab affecting all versions starting from 14.6 before 14.6.5, all versions starting fr

An issue has been discovered in GitLab CE/EE affecting all versions before 14.3.6, all versions starting from 14.4 befor

An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.4 before 14.5.4, all versions start

An issue has been discovered affecting GitLab versions prior to 13.5. An open redirect vulnerability was fixed in GitLab

A vulnerability was discovered in GitLab versions 10.5 to 14.5.4, 14.6 to 14.6.4, and 14.7 to 14.7.1. GitLab was vulnera

An issue has been discovered affecting GitLab versions prior to 14.4.5, between 14.5.0 and 14.5.3, and between 14.6.0 an

An issue has been discovered in GitLab CE/EE affecting versions 13.0 to 14.6.5, 14.7 to 14.7.4, and 14.8 to 14.8.2. Priv

In all versions of GitLab CE/EE since version 11.3, the endpoint for auto-completing Assignee discloses the members of p

The Church Admin WordPress plugin before 3.4.135 does not have authorisation and CSRF in some of its action as well as r

The WooCommerce Affiliate Plugin WordPress plugin before 4.16.4.5 does not have authorization and CSRF checks on a speci

The Amelia WordPress plugin before 1.0.47 does not have proper authorisation when managing appointments, allowing any cu

The Plezi WordPress plugin before 1.0.3 has a REST endpoint allowing unauthenticated users to update the plz_configurati

The Bulk Creator WordPress plugin through 1.0.1 does not sanitize and escape the post_type parameter before outputting i

The Bank Mellat WordPress plugin through 1.3.7 does not sanitize and escape the orderId parameter before outputting it b

The Popup Like box WordPress plugin before 3.6.1 does not sanitize and escape the ays_fb_tab parameter before outputting

The dTabs WordPress plugin through 1.4 does not sanitize and escape the tab parameter before outputting it back in an ad

The Delete Old Orders WordPress plugin through 0.2 does not sanitize and escape the date parameter before outputting it

The Database Peek WordPress plugin through 1.2 does not sanitize and escape the match parameter before outputting it bac

The Conference Scheduler WordPress plugin before 2.4.3 does not sanitize and escape the tab parameter before outputting

The Mapping Multiple URLs Redirect Same Page WordPress plugin through 5.8 does not sanitize and escape the mmursp_id par

The Drag and Drop Multiple File Upload WordPress plugin before 1.3.6.3 allows SVG files to be uploaded by default via th

The String locator WordPress plugin before 2.5.0 does not properly validate the path of the files to be searched, allowi

The Menu Image, Icons made easy WordPress plugin before 3.0.6 does not have authorisation and CSRF checks when saving me

The WPC Smart Wishlist for WooCommerce WordPress plugin before 2.9.4 does not sanitise and escape the key parameter befo

The Interactive Medical Drawing of Human Body WordPress plugin before 2.6 does not sanitise and escape the Link field, a

The WordPress plugin through 2.0.1 does not sanitise and escape the translation parameter before outputting it back in a

The Pz-LinkCard WordPress plugin through 2.4.4.4 does not sanitise and escape multiple parameters before outputting them

The OSMapper WordPress plugin through 2.1.5 contains an AJAX action to delete a plugin related post type named 'map' and

The Social Sharing Plugin WordPress plugin before 3.3.40 does not escape the viewed post URL before outputting it back i

A vulnerability classified as problematic has been found in Kiddoware Kids Place. This affects the Home Button Protectio

Leanote 2.7.0 is vulnerable to Cross Site Scripting (XSS) in the markdown type note. This leads to remote code execution

There is a Cross Site Scripting (XSS) vulnerability in SpotPage_login.php of Spotweb 1.5.1 and below, which allows remot

EMQ X Dashboard V3.0.0 is affected by username enumeration in the "/api /v3/auth" interface. When a user login, the appl

In drivers/hid/hid-elo.c in the Linux kernel before 5.16.11, a memory leak exists for a certain hid_parse error conditio

3CX System through 2022-03-17 stores cleartext passwords in a database.

OX App Suite through 7.10.5 allows XSS via uuencoding in a multipart/alternative message.

OX App Suite through 7.10.5 allows XSS via a trailing control character such as the SCRIPT\t substring.

OX App Suite through 7.10.5 allows XSS via the class attribute of an element in an HTML e-mail signature.

OX App Suite through 7.10.5 allows XSS via NIFF (Notation Interchange File Format) data.

OX App Suite through 7.10.5 allows XSS via an HTML 5 element such as AUDIO.

OX App Suite through 7.10.5 allows XSS via an unknown system message in Chat.

ImpressCMS before 1.4.3 has Incorrect Access Control because include/findusers.php allows access by unauthenticated atta

WoWonder The Ultimate PHP Social Network Platform v4.0.0 was discovered to contain an access control issue which allows

aaPanel v6.8.21 was discovered to be vulnerable to directory traversal. This vulnerability allows attackers to obtain th

libiberty/rust-demangle.c in GNU GCC 11.2 allows stack consumption in demangle_const, as demonstrated by nm-new.

tcprewrite in Tcpreplay 4.4.1 has a reachable assertion in get_layer4_v6 in common/get.c.

stb_image.h (aka the stb image loader) 2.19, as used in libsixel and other products, has a reachable assertion in stbi__

CheckMK Raw Edition software (versions 1.5.0 to 1.6.0) does not sanitise the input of a web service parameter that is in