2022

NULL Pointer Dereference in GitHub repository vim/vim prior to 8.2.4428.

A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library use

Cross-Site Request Forgery (CSRF) vulnerability leading to event deletion was discovered in Spiffy Calendar WordPress pl

Cross-Site Request Forgery (CSRF) vulnerability leading to plugin Settings Update discovered in WP Content Copy Protecti

Mattermost 6.3.0 and earlier fails to protect email addresses of the creator of the team via one of the APIs, which allo

A vulnerability in Qlik Sense Enterprise on Windows could allow an remote attacker to enumerate domain user accounts. An

Two heap-overflow vulnerabilities exist in openSUSE/libsolv libsolv through 13 Dec 2020 in the decisionmap variable via

All versions of Samba prior to 4.15.5 are vulnerable to a malicious client using a server symlink to determine if a file

A vulnerability in Brocade Fabric OS versions before Brocade Fabric OS v8.0.1b, v7.4.1d could allow an authenticated att

"Sametime Android potential path traversal vulnerability when using File class"

"Sametime Android PathTraversal Vulnerability"

Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability discovered in Survey Maker WordPress plugin (versions <=

Open Redirect on Rudloff/alltube in Packagist rudloff/alltube prior to 3.0.1.

The Float menu WordPress plugin before 4.3.1 does not have CSRF check in place when deleting menu, which could allow att

The Ad Inserter WordPress plugin before 2.7.10, Ad Inserter Pro WordPress plugin before 2.7.10 do not sanitise and escap

The GiveWP WordPress plugin before 2.17.3 does not escape the json parameter before outputting it back in an attribute i

The WOOCS WordPress plugin before 1.3.7.5 does not sanitise and escape the woocs_in_order_currency parameter of the wooc

The Shield Security WordPress plugin before 13.0.6 does not sanitise and escape admin notes, which could allow high priv

The Coming soon and Maintenance mode WordPress plugin before 3.6.8 does not have CSRF check in its coming_soon_send_mail

The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.5.3 does not sanitise and escape the Description fiel

The Coming soon and Maintenance mode WordPress plugin before 3.5.3 does not have authorisation and CSRF checks in its co

The Anti-Malware Security and Brute-Force Firewall WordPress plugin before 4.20.94 does not sanitise and escape the POST

The GiveWP WordPress plugin before 2.17.3 does not escape the s parameter before outputting it back in an attribute in t

The GiveWP WordPress plugin before 2.17.3 does not sanitise and escape the form_id parameter before outputting it back i

The Five Star Business Profile and Schema WordPress plugin before 2.1.7 does not have any authorisation and CSRF in its

The Buffer Button WordPress plugin through 1.0 was vulnerable to Authenticated Stored Cross Site Scripting (XSS) within

The Translation Exchange WordPress plugin through 1.0.14 was vulnerable to Authenticated Stored Cross-Site Scripting (XS

The FeedWordPress plugin before 2022.0123 is affected by a Reflected Cross-Site Scripting (XSS) within the "visibility"

The Advanced Database Cleaner WordPress plugin before 3.0.4 does not sanitise and escape $_GET keys and values before ou

An issue was discovered in drivers/usb/gadget/function/rndis.c in the Linux kernel before 5.16.10. The RNDIS USB gadget

Openmct versions 1.3.0 to 1.7.7 are vulnerable against stored XSS via the “Summary Widget” element, that allows the inje

Openmct versions 1.3.0 to 1.7.7 are vulnerable against stored XSS via the “Condition Widget” element, that allows the in

Openmct versions 1.3.0 to 1.7.7 are vulnerable against stored XSS via the “Web Page” element, that allows the injection

An issue was discovered in Cobbler through 3.3.1. Routines in several files use the HTTP protocol instead of the more se

Business Logic Errors in Packagist microweber/microweber prior to 1.2.11.

Plesk 18.0.37 is affected by a Cross Site Request Forgery (CSRF) vulnerability that allows an attacker to insert data on

In libsixel 1.8.6, sixel_encoder_output_without_macro (called from sixel_encoder_encode_frame in encoder.c) has a double

Cross-site Scripting (XSS) - Reflected in Packagist microweber/microweber prior to 1.2.11.

WikiDocs version 0.1.18 has multiple reflected XSS vulnerabilities on different pages.

Use multiple time the one-time coupon in Packagist microweber/microweber prior to 1.2.11.

NULL Pointer Dereference in Homebrew mruby prior to 3.2.

Cross-site Scripting (XSS) - Reflected in Packagist microweber/microweber prior to 1.2.11.

An issue was discovered in the Varnishcache extension before 2.0.1 for TYPO3. The Edge Site Includes (ESI) content eleme

SAS Web Report Studio 4.4 allows XSS. /SASWebReportStudio/logonAndRender.do has two parameters: saspfs_request_backlabel

A ..%2F path traversal vulnerability exists in the path handler of awful-salmonella-tar before 0.0.4. Attackers can only

swtpm is a libtpms-based TPM emulator with socket, character device, and Linux CUSE interface. Versions prior to 0.5.3,

A Path Traversal vulnerability for a log file in LiveConfig 2.12.2 allows authenticated attackers to read files on the u

A Stored XSS issue exists in the admin/users user administration form in LiveConfig 2.12.2.

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PDF Read

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PDF Read