2022

Abusing Backup/Restore feature to achieve Remote Code Execution in GitHub repository microweber/microweber prior to 1.2.

Divide By Zero error in tiffcrop in libtiff 4.3.0 allows attackers to cause a denial-of-service via a crafted tiff file.

Unchecked Return Value to NULL Pointer Dereference in tiffcrop in libtiff 4.3.0 allows attackers to cause a denial-of-se

Non-transparent sharing of branch predictor within a context in some Intel(R) Processors may allow an authorized user to

Non-transparent sharing of branch predictor selectors between contexts in some Intel(R) Processors may allow an authoriz

Hardware allows activation of test or debug logic at runtime for some Intel(R) Trace Hub instances which may allow an un

The redirect URI in the LTI authorization endpoint required extra sanitizing to prevent reflected XSS and open redirect

The last time a user accessed the mobile app is displayed on their profile page, but should be restricted to users with

ID numbers displayed in the quiz grading report required additional sanitizing to prevent a stored XSS risk. Moodle 3.10

It was possible for a student to view their quiz grade before it had been released, using a quiz web service. Moodle 3.1

Teachers exporting a forum in CSV format could receive a CSV of forums from all courses in some circumstances. Moodle ve

Cross-site Scripting (XSS) vulnerability in firmware section of Secomea GateManager allows logged in user to inject java

An attacker could exploit this vulnerability in Hitachi ABB Power Grids Ellipse Enterprise Asset Management (EAM) versio

An attacker could trick a user of Hitachi ABB Power Grids Ellipse Enterprise Asset Management (EAM) versions prior to an

LFENCE/JMP (mitigation V2-2) may not sufficiently mitigate CVE-2017-5715 on some AMD CPUs.

Some AMD CPUs may transiently execute beyond unconditional direct branches, which may potentially result in data leakage

Missing Authorization in GitHub repository saleor/saleor prior to 3.1.2.

Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.2.12.

Server-Side Request Forgery (SSRF) in GitHub repository gogs/gogs prior to 0.12.5.

Unrestricted Upload of File with Dangerous Type in GitHub repository microweber/microweber prior to 1.2.11.

drivers/bluetooth/virtio_bt.c in the Linux kernel before 5.16.3 has a memory leak (socket buffers have memory allocated

lib/Horde/Mime/Viewer/Ooo.php in Horde Mime_Viewer before 2.2.4 allows XSS via an OpenOffice document, leading to accoun

The swagger-ui-dist package before 4.1.3 for Node.js could allow a remote attacker to hijack the clicking action of the

Swagger UI 4.1.2 and earlier could allow a remote attacker to conduct spoofing attacks. By persuading a victim to open a

Cross-site Scripting (XSS) - Reflected in GitHub repository orchardcms/orchardcore prior to 1.3.0.

An issue in the ?filename= argument of the route /DataPackageTable in FreeTAKServer-UI v1.9.8 allows attackers to place

FreeTAKServer-UI v1.9.8 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Callsign par

FreeTAKServer-UI v1.9.8 was discovered to contain a SQL injection vulnerability via the API endpoint /AuthenticateUser.

Improper Authorization in GitHub repository orchardcms/orchardcore prior to 1.3.0.

Cross-site Scripting (XSS) - Stored in GitHub repository orchardcms/orchardcore prior to 1.3.0.

Improper access control vulnerability in McAfee WebAdvisor Chrome and Edge browser extensions up to 8.1.0.1895 allows a

A Cross Site Scripting (XSS) vulnerabilitiy exits in jeecg-boot 3.0 in /jeecg-boot/jmreport/view with a mouseover event.

Nextcloud text is a collaborative document editing using Markdown built for the nextcloud server. Due to an issue with t

IBM Guardium Data Encryption (GDE) 4.0.0.0 and 5.0.0.0 could disclose internal IP address information when the web backe

IBM DataPower Gateway V10CD, 10.0.1, and 2108.4.1 could allow a remote attacker to bypass security restrictions, caused

SPIP before 3.2.14 and 4.x before 4.0.5 allows unauthenticated access to information about editorial objects.

Veritas System Recovery (VSR) 18 and 21 stores a network destination password in the Windows registry during configurati

An XXE issue was discovered in Tryton Application Platform (Server) 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.x an

NATS nats-server before 2.7.4 allows Directory Traversal (with write access) via an element in a ZIP archive for JetStre

Citrix Federated Authentication Service (FAS) 7.17 - 10.6 causes deployments that have been configured to store a regist

SAP Financial Consolidation - version 10.1, does not perform necessary authorization checks for updating homepage messag

Under certain conditions, SAP NetWeaver (Real Time Messaging Framework) - version 7.50, allows an attacker to access inf

Due to missing authorization check, SAP NetWeaver Application Server for ABAP - versions 700, 701, 702, 731, allows an a

Fiori launchpad - versions 754, 755, 756, does not sufficiently encode user-controlled inputs, resulting in Cross-Site S

Power Line Communications PLC4TRUCKS J2497 trailer brake controllers implement diagnostic functions which can be invoked

Improper access control vulnerability in Samsung Account prior to version 13.1.0.1 allows attackers to access to the aut

Improper access control vulnerability in BixbyTouch prior to version 2.2.00.6 in China models allows untrusted applicati

An use after free vulnerability in sdp driver prior to SMR Mar-2022 Release 1 allows kernel crash.

A vulnerable design in fingerprint matching algorithm prior to SMR Mar-2022 Release 1 allows physical attackers to perfo

OOB read vulnerability in hdcp2 device node prior to SMR Mar-2022 Release 1 allow an attacker to view Kernel stack memor