2022

A vulnerability has been identified in SIMATIC Drive Controller family (All versions >= V2.9.2 < V2.9.4), SIMATIC ET 200

A vulnerability has been identified in SIMATIC Drive Controller family (All versions < V2.9.2), SIMATIC Drive Controller

A vulnerability has been identified in COMOS V10.2 (All versions only if web components are used), COMOS V10.3 (All vers

A vulnerability has been identified in SIMATIC Drive Controller family (All versions >= V2.9.2 < V2.9.4), SIMATIC ET 200

Jenkins 2.333 and earlier, LTS 2.319.2 and earlier defines custom XStream converters that have not been updated to apply

Authenticated remote code execution (RCE) in Composr-CMS 10.0.39 and earlier allows remote attackers to execute arbitrar

Thinfinity VirtualUI 2.1.28.0, 2.1.32.1 and 2.5.26.2, fixed in version 3.0 is affected by an information disclosure vuln

ESET products for Windows allows untrusted process to impersonate the client of a pipe, which can be leveraged by attack

update_code in Admin.php in HYBBS2 through 2.3.2 allows arbitrary file upload via a crafted ZIP archive.

m1k1o/blog is a lightweight self-hosted facebook-styled PHP blog. Errors from functions `imagecreatefrom*` and `image*`

Business Logic Errors in GitHub repository publify/publify prior to 9.2.7.

Use After Free in GitHub repository radareorg/radare2 prior to 5.6.2.

Access of Memory Location Before Start of Buffer in NPM radare2.js prior to 5.6.2.

Access of Memory Location After End of Buffer in GitHub repository radareorg/radare2 prior to 5.6.2.

Use After Free in NPM radare2.js prior to 5.6.2.

Buffer Access with Incorrect Length Value in GitHub repository radareorg/radare2 prior to 5.6.2.

Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.6.2.

Cross Site Request Forgery (CSRF) vulnerability exists in Gitea before 1.5.2 via API routes.This can be dangerous especi

Server Side Request Forgery (SSRF) vulneraility exists in Gitea before 1.7.0 using the OpenID URL.

In DataEase v1.6.1, an authenticated user can gain unauthorized access to all user information and can change the admini

Directory traversal vulnerability in TransmitMail 2.5.0 to 2.6.1 allows a remote unauthenticated attacker to obtain an a

Hidden functionality vulnerability in ELECOM LAN routers (WRH-300BK3 firmware v1.05 and earlier, WRH-300WH3 firmware v1.

NATS nats-server before 2.7.2 has Incorrect Access Control. Any authenticated user can obtain the privileges of the Syst

Frourio-express is a minimal full stack framework, for TypeScript. Frourio-express users who uses frourio-express versio

Frourio is a full stack framework, for TypeScript. Frourio users who uses frourio version prior to v0.26.0 and integrati

xrdp is an open source remote desktop protocol (RDP) server. In affected versions an integer underflow leading to a heap

twisted is an event-driven networking engine written in Python. In affected versions twisted exposes cookies and authori

The RNDIS USB device class includes a buffer overflow vulnerability. Zephyr versions >= v2.6.0 contain Heap-based Buffer

Buffer overflow in usb device class. Zephyr versions >= v2.6.0 contain Heap-based Buffer Overflow (CWE-122). For more in

Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability

The IP2Location Country Blocker WordPress plugin before 2.26.6 does not have CSRF check in the ip2location_country_block

The IP2Location Country Blocker WordPress plugin before 2.26.5 does not have authorisation and CSRF checks in the ip2loc

The SupportCandy WordPress plugin before 2.2.7 does not have CSRF check in the wpsc_tickets AJAX action, nor has any san

The SupportCandy WordPress plugin before 2.2.5 does not have authorisation and CSRF checks in its wpsc_tickets AJAX acti

IIPImage High Resolution Streaming Image Server prior to commit 882925b295a80ec992063deffc2a3b0d803c3195 is affected by

FISCO-BCOS release-3.0.0-rc2 contains a denial of service vulnerability. Some transactions may not be committed successf

XMPie uStore 12.3.7244.0 allows for administrators to generate reports based on raw SQL queries. Since the application s

An issue was discovered in Servisnet Tessa 0.0.2. An attacker can obtain sensitive information via a /js/app.js request.

A flaw was found in StarWind Stack. The endpoint for setting a new password doesn’t check the current username and old p

Certain Korenix JetWave devices allow authenticated users to execute arbitrary code as root via /syscmd.asp. This affect

A flaw was found in StarWind iSCSI target. An attacker could script standard iSCSI Initiator operation(s) to exhaust the

In Apache Traffic Control Traffic Ops prior to 6.1.0 or 5.1.6, an unprivileged user who can reach Traffic Ops over HTTPS

Local privilege escalation due to unrestricted loading of unsigned libraries. The following products are affected: Acron

Local privilege escalation due to race condition on application startup. The following products are affected: Acronis Cy

Local privilege escalation due to excessive permissions assigned to child processes. The following products are affected

A stack-based buffer overflow vulnerability exists in the Gerber Viewer gerber and excellon DCodeNumber parsing function

A stack-based buffer overflow vulnerability exists in the Gerber Viewer gerber and excellon GCodeNumber parsing function

In Apache ActiveMQ Artemis prior to 2.20.0 or 2.19.1, an attacker could partially disrupt availability (DoS) through unc

A security out-of-bounds read information disclosure vulnerability in Trend Micro Worry-Free Business Security Server co

Twig is an open source template language for PHP. When in a sandbox mode, the `arrow` parameter of the `sort` filter mus