2022

A malicious crafted dwf or .pct file when consumed through DesignReview.exe application could lead to memory corruption

An Information Disclosure vulnerability for JT files in Autodesk Inventor 2022, 2021, 2020, 2019 in conjunction with oth

A maliciously crafted JT file in Autodesk Inventor 2022, 2021, 2020, 2019 and AutoCAD 2022 may be forced to read beyond

Access of Memory Location Before Start of Buffer in GitHub repository vim/vim prior to 8.2.

IBM WebSphere Application Server - Liberty 17.0.0.3 through 22.0.0.1 could allow a remote authenticated attacker to cond

xzs-mysql >= t3.4.0 is vulnerable to Insecure Permissions. The front end of this open source system is an online examina

The Nextcloud Android app is the Android client for Nextcloud, a self-hosted productivity platform. The Nextcloud Androi

This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.1.3-4

This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.1.3-4

This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.1.3-4

This vulnerability allows local attackers to escalate privileges on affected installations of Linux Kernel 5.14-rc3. An

This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of multiple NETG

arm: guest_physmap_remove_page not removing the p2m mappings The functions to remove one or more entries from a guest p2

Missing authentication on ShenYu Admin when register by HTTP. This issue affected Apache ShenYu 2.4.0 and 2.4.1.

On Apache ShenYu versions 2.4.0 and 2.4.1, and endpoint existed that disclosed the passwords of all users. Users are rec

In MartDevelopers KEA-Hotel-ERP open source as of 12-31-2021, a remote code execution vulnerability can be exploited by

The Path Sanity Check script of FreeCAD 0.19 is vulnerable to OS command injection, allowing an attacker to execute arbi

Improper sanitization in the invocation of ODA File Converter from FreeCAD 0.19 allows an attacker to inject OS commands

MartDevelopers iResturant 1.0 is vulnerable to SQL Injection. SQL Injection occurs because this view parameter value is

A buffer overflow vulnerability in CDataList of the jwwlib component of LibreCAD 2.2.0-rc3 and older allows an attacker

A buffer overflow vulnerability in CDataMoji of the jwwlib component of LibreCAD 2.2.0-rc3 and older allows an attacker

lib/Image/ExifTool.pm in ExifTool before 12.38 mishandles a $file =~ /\|$/ check, leading to command injection.

Jsish v3.5.0 was discovered to contain a heap buffer overflow via BooleanConstructor at src/jsiBool.c.

Jsish v3.5.0 was discovered to contain a heap buffer overflow via NumberConstructor at src/jsiNumber.c.

Jerryscript v3.0.0 and below was discovered to contain a stack overflow via ecma_find_named_property in ecma-helpers.c.

Dell EMC System Update, version 1.9.2 and prior, contain an Unprotected Storage of Credentials vulnerability. A local at

elfspirit is an ELF static analysis and injection framework that parses, manipulates, and camouflages ELF files. When an

An issue was discovered in COINS Construction Cloud 11.12. Due to logical flaws in the human ressources interface, it is

Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially expl

Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially expl

SQL injection vulnerability in Data Loss Protection (DLP) ePO extension 11.8.x prior to 11.8.100, 11.7.x prior to 11.7.1

In QuickBox Pro v2.5.8 and below, the config.php file has a variable which takes a GET parameter value and parses it int

Cross-Site Request Forgery (CSRF) in Packagist yetiforce/yetiforce-crm prior to 6.3.0.

The WP User Frontend WordPress plugin before 3.5.26 does not validate and escape the status parameter before using it in

The WP125 WordPress plugin before 1.5.5 does not have CSRF checks in various action, for example when deleting an ad, al

The Asgaros Forum WordPress plugin before 1.15.15 does not validate or escape the forum_id parameter before using it in

The WP Extra File Types WordPress plugin before 0.5.1 does not have CSRF check when saving its settings, nor sanitise an

The Protect WP Admin WordPress plugin before 3.6.2 does not check for authorisation in the lib/pwa-deactivate.php file,

The Advanced Custom Fields: Extended WordPress plugin before 0.8.8.7 does not validate the order and orderby parameters

The Cookie Notification Plugin for WordPress plugin before 1.0.9 does not sanitise or escape the id GET parameter before

The Simple Download Monitor WordPress plugin before 3.9.9 does not enforce nonce checks, which could allow attackers to

A flaw was found in the REST API. An improperly handled REST API call could allow any logged user to elevate privileges

In archive/zip in Go before 1.16.8 and 1.17.x before 1.17.1, a crafted archive header (falsely designating that many fil

xhtml_translate_entity in xhtml.c in epub2txt (aka epub2txt2) through 2.02 allows a stack-based buffer overflow via a cr

Bingrep v0.8.5 was discovered to contain a memory allocation failure which can cause a Denial of Service (DoS).

In api.rb in Sidekiq before 5.2.10 and 6.4.0, there is no limit on the number of days when requesting stats for the grap

Dell EMC AppSync versions 3.9 to 4.3 contain an Improper Restriction of Excessive Authentication Attempts Vulnerability

DELL EMC AppSync versions 3.9 to 4.3 use GET request method with sensitive query strings. An Adjacent, unauthenticated a

HDF5 v1.13.1-1 was discovered to contain a heap-use-after free via the component H5AC_unpin_entry.

The Dell EMC Virtual Appliances before 9.2.2.2 contain undocumented user accounts. A local malicious user may potentiall