2022

Use after free in Camera Capture in Google Chrome prior to 108.0.5359.71 allowed a remote attacker to potentially exploi

Type confusion in V8 in Google Chrome prior to 108.0.5359.71 allowed a remote attacker to potentially exploit heap corru

Airtable.js is the JavaScript client for Airtable. Prior to version 0.11.6, Airtable.js had a misconfigured build script

The Appointment Hour Booking plugin for WordPress is vulnerable to iFrame Injection via the ‘email’ or general field par

The Quiz and Survey Master plugin for WordPress is vulnerable to iFrame Injection via the 'question[id]' parameter in ve

The Simple:Press plugin for WordPress is vulnerable to Path Traversal in versions up to, and including, 6.8 via the 'fil

The Simple:Press plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'postitem' parameter manipula

The WP Affiliate Platform plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and includ

The Becustom plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.5.2.

The Ultimate Member plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 2.5.0

The Ultimate Member plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 2.5.0

SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversa

SolarWinds Platform was susceptible to Command Injection. This vulnerability allows a remote adversary with complete con

SolarWinds Platform was susceptible to Improper Input Validation. This vulnerability allows a remote adversary with vali

OP-TEE Trusted OS is the secure side implementation of OP-TEE project, a Trusted Execution Environment. Versions prior t

Discourse is an open-source messaging platform. In versions 2.8.10 and prior on the `stable` branch and versions 2.9.0.b

WAVLINK Quantum D4G (WL-WN531G3) running firmware versions M31G3.V5030.201204 and M31G3.V5030.200325 has an access contr

This affects all versions of package static-dev-server. This is because when paths from users to the root directory are

The package com.github.samtools:htsjdk before 3.0.1 are vulnerable to Creation of Temporary File in Directory with Insec

GPAC v2.1-DEV-rev478-g696e6f868-master was discovered to contain a heap use-after-free via the Q_IsTypeOn function at /g

Apache Fineract allowed an authenticated user to perform remote code execution due to a path traversal vulnerability in

AeroCMS v0.0.1 was discovered to contain a SQL Injection vulnerability via the Search parameter. This vulnerability allo

An Insecure Direct Object Reference (IDOR) vulnerability in the password reset function of Telos Alliance Omnia MPX Node

LINE client for iOS before 12.17.0 might be crashed by sharing an invalid shared key of e2ee in group chat.

Data Integrity Failure in 'Backup Config' in D-Link DNR-322L <= 2.60B15 allows an authenticated attacker to execute OS l

GPAC v2.1-DEV-rev428-gcb8ae46c8-master was discovered to contain a stack overflow via the function dimC_box_read at isom

An access control issue in APsystems ENERGY COMMUNICATION UNIT (ECU-C) Power Control Software V4.1NA, V3.11.4, W2.1NA, V

A remote attacker with general user privilege can inject malicious code in the form content of Raiden MAILD Mail Server

UC-8100A-ME-T System Image: Versions v1.0 to v1.6, UC-2100 System Image: Versions v1.0 to v1.12, UC-2100-W System Image:

The /device/acceptBind end-point for Ourphoto App version 1.4.1 does not require authentication or authorization. The us

The /device/signin end-point for the Ourphoto App version 1.4.1 discloses clear-text password information for functional

The user_id and device_id on the Ourphoto App version 1.4.1 /device/* end-points both suffer from insecure direct object

Drag and Drop XBlock v2 implements a drag-and-drop style problem, where a learner has to drag items to zones on a target

FusionAuth before 1.41.3 allows a file outside of the application root to be viewed or retrieved using an HTTP request.

Sinatra is a domain-specific language for creating web applications in Ruby. An issue was discovered in Sinatra 2.0 befo

Auth. (contributor+) Arbitrary File Upload in SEO Plugin by Squirrly SEO plugin <= 12.1.10 on WordPress.

Velneo vClient on its 28.1.3 version, could allow an attacker with knowledge of the victims's username and hashed passwo

Muhammara is a node module with c/cpp bindings to modify PDF with JavaScript for node or electron. The package muhammara

An issue in the component MSI.TerminalServer.exe of MSI Center v1.0.41.0 allows attackers to escalate privileges via a c

The WP User Merger WordPress plugin before 1.5.3 does not properly sanitise and escape a parameter before using it in a

The WP User Merger WordPress plugin before 1.5.3 does not properly sanitise and escape a parameter before using it in a

The WP User Merger WordPress plugin before 1.5.3 does not properly sanitise and escape a parameter before using it in a

The OWM Weather WordPress plugin before 5.6.9 does not properly sanitise and escape a parameter before using it in a SQL

The WPSmartContracts WordPress plugin before 1.3.12 does not properly sanitise and escape a parameter before using it in

The HTML Forms WordPress plugin before 1.3.25 does not properly properly escape a parameter before using it in a SQL sta

The Checkout Field Editor (Checkout Manager) for WooCommerce WordPress plugin before 1.8.0 unserializes user input provi

Vulnerability in the HQSwSmiDxe DXE driver on some consumer Acer Notebook devices may allow an attacker with elevated pr

decode-uri-component 0.2.0 is vulnerable to Improper Input Validation resulting in DoS.

GNU Emacs through 28.2 allows attackers to execute commands via shell metacharacters in the name of a source-code file,

An issue was discovered in the Linux kernel through 6.0.10. l2cap_config_req in net/bluetooth/l2cap_core.c has an intege