2022

In JetBrains YouTrack before 2021.4.31698, a custom logo could be set by a user who has read-only permissions.

JetBrains TeamCity before 2021.2.1 was vulnerable to stored XSS.

JetBrains TeamCity before 2021.2.1 was vulnerable to reflected XSS.

In JetBrains TeamCity before 2021.2, health items of pull requests were shown to users who lacked appropriate permission

In JetBrains TeamCity before 2021.2.1, an unauthenticated attacker can cancel running builds via an XML-RPC request to t

In JetBrains TeamCity before 2021.2.1, the Agent Push feature allowed selection of any private key on the server.

In JetBrains TeamCity before 2021.2, blind SSRF via an XML-RPC call was possible.

In JetBrains TeamCity before 2021.2, a logout action didn't remove a Remember Me cookie.

In JetBrains TeamCity before 2021.2.1, a redirection to an external site was possible.

In JetBrains Kotlin before 1.6.0, it was not possible to lock dependencies for Multiplatform Gradle Projects.

In JetBrains Hub before 2021.1.13956, an unprivileged user could perform DoS.

An authenticated user can upload an XML file containing an XSS via the ITSM module of EyesOfNetwork 5.3.11, resulting in

In waline 1.6.1, an attacker can submit messages using X-Forwarded-For to forge any IP address.

The bash_completion script for fscrypt allows injection of commands via crafted mountpoint paths, allowing privilege esc

The PAM module for fscrypt doesn't adequately validate fscrypt metadata files, allowing users to create malicious metada

fscrypt through v0.3.2 creates a world-writable directory by default when setting up a filesystem, allowing unprivileged

A carefully crafted user preferences for submission could trigger an XSS vulnerability on Apache JSPWiki, related to the

Business Logic Errors in GitHub repository dolibarr/dolibarr prior to 16.0.

It was discovered that the "Trigger DAG with config" screen was susceptible to XSS attacks via the `origin` query argume

A cross-site scripting (XSS) vulnerability has been reported to affect QNAP device running Proxy Server. If exploited, t

A cross-site scripting (XSS) vulnerability has been reported to affect QNAP device running Proxy Server. If exploited, t

A potential remote host header injection security vulnerability has been identified in HPE Integrated Lights-Out 4 (iLO

A Denial of Service vulnerabilty exists in Trilium Notes 0.48.6 in the setupPage function

A remote URL redirection vulnerability was discovered in HPE OneView Global Dashboard version(s): Prior to 2.5. HPE has

A remote cross-site scripting vulnerability was discovered in HPE OneView Global Dashboard version(s): Prior to 2.5. HPE

A Directory Traversal vulnerability exists in the Xerte Project Xerte through 3.10.3 when downloading a project file via

WIN-911 2021 R1 and R2 are vulnerable to a permissions misconfiguration that may allow an attacker to locally write file

There is a directory traversal vulnerability in some home gateway products of ZTE. Due to the lack of verification of us

WIN-911 2021 R1 and R2 are vulnerable to a permissions misconfiguration that may allow an attacker to locally write file

The Header Footer Code Manager plugin <= 1.1.16 for WordPress is vulnerable to Reflected Cross-Site Scripting (XSS) via

The Essential Addons for Elementor Lite WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escap

The Profile Builder – User Profile & User Registration Forms WordPress plugin is vulnerable to Cross-Site Scripting due

An integer underflow in the DDS loader of Blender leads to an out-of-bounds read, possibly allowing an attacker to read

A Site Scripting (XSS) vulnerability exists in the Xerte Project Xerte through 3.8.4 via the link parameter in print.php

Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 did not handle multi-value Relative Distinguished Names correctly.

Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 converts SANs (Subject Alternative Names) to a string format. It u

A use-after-free vulnerability was found in usbredir in versions prior to 0.11.0 in the usbredirparser_serialize() in us

A flaw was found in the QEMU implementation of VMWare's paravirtual RDMA device in versions prior to 6.1.0. The issue oc

An integer overflow was found in the QEMU implementation of VMWare's paravirtual RDMA device in versions prior to 6.1.0.

A NULL pointer dereference flaw was found in ImageMagick in versions prior to 7.0.10-31 in ReadSVGImage() in coders/svg.

The web interface of the 1734-AENTR communication module mishandles authentication for HTTP POST requests. A remote, una

The web interface of the 1734-AENTR communication module is vulnerable to stored XSS. A remote, unauthenticated attacker

Due to usernames/passwords being stored in plaintext in Random Access Memory (RAM), a local, authenticated attacker coul

Inadequate encryption may allow the passwords for Emerson OpenEnterprise versions through 3.3.4 user accounts to be obta

Simulation models for KUKA.Sim Pro version 3.1 are hosted by a server maintained by KUKA. When these devices request a m

Cybonet - PineApp Mail Relay Unauthenticated Sql Injection. Attacker can send a request to: /manage/emailrichment/userli

Cybonet - PineApp Mail Relay Local File Inclusion. Attacker can send a request to : /manage/mailpolicymtm/log/eml_viewer

IBM Sterling External Authentication Server 3.4.3.2, 6.0.2.0, and 6.0.3.0 is vulnerable to path traversals, due to not p

IBM WebSphere Application Server 9.0 and IBM WebSphere Application Server Liberty 17.0.0.3 through 22.0.0.2 could allow

IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the AIX kernel