2022

The Facebook Messenger app for iOS 227.0 and prior and Android 228.1.0.10.116 and prior user interface does not properly

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Argo CD starting with version 1.5.0 but before

A Denial of Service vulnerability exists in jhead 3.04 and 3.05 due to a wild address read in the Get16u function in exi

Stored Cross-Site Scripting (XSS) in Yoo Slider – Image Slider & Video Slider (WordPress plugin) allows attackers with c

Cross-Site Request Forgery (CSRF) in Yoo Slider – Image Slider & Video Slider (WordPress plugin) allows attackers to tri

Money Transfer Management System Version 1.0 allows an authenticated user to inject SQL queries in 'mtms/admin/?page=tra

Money Transfer Management System Version 1.0 allows an attacker to inject JavaScript code in the URL and then trick a us

A vulnerability was found in the 389 Directory Server that allows expired passwords to access the database to cause impr

A memory leak flaw was found in the Linux kernel’s DMA subsystem, in the way a user calls DMA_FROM_DEVICE. This flaw all

The Photoswipe Masonry Gallery WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and s

A flaw was found in ImageMagick. The vulnerability occurs due to improper use of open functions and leads to a denial of

An information exposure flaw in openstack-tripleo-heat-templates allows an external user to discover the internal IP or

A use-after-free flaw was found in the add_partition in block/partitions/core.c in the Linux kernel. A local attacker wi

A vulnerability was found in btrfs_alloc_tree_b in fs/btrfs/extent-tree.c in the Linux kernel due to an improper lock op

A vulnerability was found in the Linux kernel's block_invalidatepage in fs/buffer.c in the filesystem. A missing sanity

Rockwell Automation Connected Components Workbench v12.00.00 and prior does not sanitize paths specified within the .ccw

GE UR firmware versions prior to version 8.1x shares MODBUS memory map as part of the communications guide. GE was made

GE UR firmware versions prior to version 8.1x web server task does not properly handle receipt of unsupported HTTP verbs

GE UR firmware versions prior to version 8.1x supports web interface with read-only access. The device fails to properly

IBM MQ Appliance 9.2 CD and 9.2 LTS could allow an authenticated and authorized user to cause a denial of service due to

An issus was discovered in xiaohuanxiong CMS 5.0.17. There is a CSRF vulnerability that can modify administrator account

TeamViewer Linux versions before 15.28 do not properly execute a deletion command for the connection password in case of

McAfee Enterprise ePolicy Orchestrator (ePO) prior to 5.10 Update 13 allows a local attacker to point an ePO server to a

A cross-site scripting (XSS) vulnerability in McAfee Enterprise ePolicy Orchestrator (ePO) prior to 5.10 Update 13 allow

A reflected cross-site scripting (XSS) vulnerability in McAfee Enterprise ePolicy Orchestrator (ePO) prior to 5.10 Updat

A blind SQL injection vulnerability in McAfee Enterprise ePolicy Orchestrator (ePO) prior to 5.10 Update 13 allows a rem

BIND 9.11.0 -> 9.11.36 9.12.0 -> 9.16.26 9.17.0 -> 9.18.0 BIND Supported Preview Editions: 9.11.4-S1 -> 9.11.36-S1 9.16.

BIND 9.16.11 -> 9.16.26, 9.17.0 -> 9.18.0 and versions 9.16.11-S1 -> 9.16.26-S1 of the BIND Supported Preview Edition. S

In CMDBuild from version 3.0 to 3.3.2 payload requests are saved in a temporary log table, which allows attackers with d

A Cross Site Scripting (XSS) vulnerabililty exists in enhanced-github v5.0.11 via the file name parameter.

tcpprep v4.4.1 has a reachable assertion (assert(l2len > 0)) in packet2tree() at tree.c in tcpprep v4.4.1.

Cscms Music Portal System v4.2 was discovered to contain a redirection vulnerability via the backurl parameter.

Chamilo LMS v1.11.14 was discovered to contain a zero click code injection vulnerability which allows attackers to execu

BigAnt Software BigAnt Server v5.6.06 was discovered to contain a cross-site scripting (XSS) vulnerability.

BigAnt Software BigAnt Server v5.6.06 was discovered to utilize weak password hashes.

An access control issue in the authentication module of Lexar_F35 v1.0.34 allows attackers to access sensitive data and

The Simple Membership WordPress plugin before 4.1.0 does not have CSRF check in place when deleting Transactions, which

The Pricing Table Builder WordPress plugin before 1.1.5 does not sanitize and escape the postid parameter before outputt

The Mega Menu WordPress plugin before 3.0.8 does not sanitize and escape the _wpnonce parameter before outputting it bac

The Amelia WordPress plugin before 1.0.47 does not sanitize and escape the code parameter before outputting it back in a

The Amelia WordPress plugin before 1.0.47 does not have CSRF check in place when deleting customers, which could allow a

The BulletProof Security WordPress plugin before 5.8 does not sanitise and escape some of its settings, which could allo

Cross-Site Request Forgery (CSRF) in GitHub repository crater-invoice/crater prior to 6.0.4.

Business Logic Errors in GitHub repository crater-invoice/crater prior to 6.0.5.

The 3D FlipBook WordPress plugin before 1.12.1 does not have authorisation and CSRF checks when updating its settings, a

The Modern Events Calendar Lite WordPress plugin before 6.4.0 does not sanitize and escape some of the Hourly Schedule p

The SEO Plugin by Squirrly SEO WordPress plugin before 11.1.12 does not escape the type parameter before outputting it b

An XSS was identified in the Admin Web interface of PrimeKey SignServer before 5.8.1. JavaScript code must be used in a

The OPC autogenerated ANSI C stack stubs (in the NodeSets) do not handle all error cases. This can lead to a NULL pointe

In Click Studios (SA) Pty Ltd Passwordstate 9435, users with access to a passwordlist can gain access to additional pass