2022

Realtek Linux/Android Bluetooth Mesh SDK has a buffer overflow vulnerability due to insufficient validation for segmente

Realtek Linux/Android Bluetooth Mesh SDK has a buffer overflow vulnerability due to insufficient validation for the leng

Realtek Linux/Android Bluetooth Mesh SDK has a buffer overflow vulnerability due to insufficient validation for the size

The package sanitize-html before 2.7.1 are vulnerable to Regular Expression Denial of Service (ReDoS) due to insecure gl

The package org.yaml:snakeyaml from 0 and before 1.31 are vulnerable to Denial of Service (DoS) due missing to nested de

All versions of package x-data-spreadsheet are vulnerable to Cross-site Scripting (XSS) due to missing sanitization of v

Realtek Linux/Android Bluetooth Mesh SDK has a buffer overflow vulnerability due to insufficient validation for broadcas

Xpdf prior to 4.04 lacked an integer overflow check in JPXStream.cc.

In Xpdf prior to 4.04, the DCT (JPEG) decoder was incorrectly allowing the 'interleaved' flag to be changed after the fi

Poppler prior to and including 22.08.0 contains an integer overflow in the JBIG2 decoder (JBIG2Stream::readTextRegionSeg

Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the Section parameter at /sta

Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the Section parameter at /lib

Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /staff/st

Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /staff/bo

Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /staff/ed

Patlite NH-FB v1.46 and below was discovered to contain insufficient firmware validation during the upgrade firmware fil

Hitachi Kokusai Electric Newtork products for monitoring system (Camera, Decoder and Encoder) and below allows attckers

An improper authentication for critical function issue in Hitachi Kokusai Electric Network products for monitoring syste

Seiko SkyBridge MB-A200 v01.00.04 and below was discovered to contain multiple hard-coded passcodes for root. Attackers

Seiko SkyBridge MB-A200 v01.00.04 and below was discovered to contain a command injection vulnerability via the Ping par

Seiko SkyBridge MB-A100/A110 v4.2.0 and below implements a hard-coded passcode for the root account. Attackers are able

Seiko SkyBridge MB-A100/A110 v4.2.0 and below was discovered to contain an arbitrary file upload vulnerability via the r

Seiko SkyBridge MB-A100/A110 v4.2.0 and below was discovered to contain a command injection vulnerability via the ipAddr

Hytec Inter HWL-2511-SS v1.05 and below implements a SHA512crypt hash for the root account which can be easily cracked v

A command injection vulnerability in the CLI (Command Line Interface) implementation of Hytec Inter HWL-2511-SS v1.05 an

Hytec Inter HWL-2511-SS v1.05 and below was discovered to contain a command injection vulnerability via the component /w

Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, and OpUtils

HireVue Hiring Platform V1.0 suffers from Use of a Broken or Risky Cryptographic Algorithm. NOTE: this is disputed by th

TOTOLINK A7000R V4.1cu.4134 was discovered to contain an access control issue via /cgi-bin/ExportSettings.sh.

A flaw in net_rds_alloc_sgs() in Oracle Linux kernels allows unprivileged local users to crash the machine. CVSS 3.1 Bas

IBM Engineering Test Management 7.0, 7.0.1, and 7.0.2 is vulnerable to cross-site scripting. This vulnerability allows u

In oauth2-server (aka node-oauth2-server) through 3.1.1, the value of the redirect_uri parameter received during the aut

Cross-site Scripting (XSS) - Stored in GitHub repository snipe/snipe-it prior to v6.0.11.

kirby is a content management system (CMS) that adapts to many different projects and helps you build your own ideal int

mdx-mermaid provides plug and play access to Mermaid in MDX. There is a potential for an arbitrary javascript injection

The Export All URLs WordPress plugin before 4.4 does not validate the path of the file to be removed on the system which

The Anti-Malware Security and Brute-Force Firewall WordPress plugin before 4.21.83 does not sanitise and escape some par

The Fluent Support WordPress plugin before 1.5.8 does not properly sanitise, validate and escape various parameters befo

The Mailchimp for WooCommerce WordPress plugin before 2.7.2 has an AJAX action that allows high privilege users to perfo

The WP Hide & Security Enhancer WordPress plugin before 1.8 does not escape a parameter before outputting it back in an

The WooCommerce PDF Invoices & Packing Slips WordPress plugin before 3.0.1 does not sanitise and escape some parameters

The Simply Schedule Appointments WordPress plugin before 1.5.7.7 does not sanitise and escape some of its settings, whic

The Simply Schedule Appointments WordPress plugin before 1.5.7.7 is missing authorisation in a REST endpoint, allowing u

The Mailchimp for WooCommerce WordPress plugin before 2.7.1 has an AJAX action that allows any logged in users (such as

The WPIDE WordPress plugin before 3.0 does not sanitize and validate the filename parameter before using it in a require

The Sensei LMS WordPress plugin before 4.5.2 does not ensure that the sender of a private message is either the teacher

The Sensei LMS WordPress plugin before 4.5.0 does not have proper permissions set in one of its REST endpoint, allowing

The Stop Spam Comments WordPress plugin through 0.2.1.2 does not properly generate the Javascript access token for preve

The Leaflet Maps Marker (Google Maps, OpenStreetMap, Bing Maps) WordPress plugin before 3.12.5 does not properly sanitiz

nitrado.js is a type safe wrapper for the Nitrado API. Possible ReDoS with lib input of `{{` and with many repetitions o