2022

libtiff's tiffcrop utility has a uint32_t underflow that can lead to out of bounds read and write. An attacker who suppl

Zoom Rooms for Conference Rooms for Windows versions before 5.11.0 are susceptible to a Local Privilege Escalation vulne

The Zoom Client for Meetings for MacOS (Standard and for IT Admin) before version 5.11.3 contains a vulnerability in the

maccms10 v2021.1000.1081 to v2022.1000.3031 was discovered to contain a SQL injection vulnerability via the table parame

DoraCMS v2.18 and earlier allows attackers to bypass login authentication via a crafted HTTP request.

A cross-site scripting (XSS) vulnerability in CherryTree v0.99.30 allows attackers to execute arbitrary web scripts or H

An access control issue in Ecowitt GW1100 Series Weather Stations <=GW1100B_v2.1.5 allows unauthenticated attackers to a

A crafted HTTP packet without a content-type header can create a denial-of-service condition in Softing Secure Integrati

Softing Secure Integration Server V1.22 is vulnerable to authentication bypass via a machine-in-the-middle attack. The d

A crafted HTTP packet with a missing HTTP URI can create a denial-of-service condition in Softing Secure Integration Ser

Softing Secure Integration Server, edgeConnector, and edgeAggregator software ships with the default administrator crede

A crafted HTTP packet with a -1 content-length header can create a denial-of-service condition in Softing Secure Integra

The application searches for a library dll that is not found. If an attacker can place a dll with this name, then the at

This vulnerability occured by sending a malicious POST request to a specific page while logged in random user from some

The vulnerability causing from insufficient verification procedures for downloaded files during WebCube update. Remote a

In Sony Xperia series 1, 5, and Pro, an out of bound memory access can occur due to lack of validation of the number of

Softing OPC UA C++ Server SDK, Secure Integration Server, edgeConnector, edgeAggregator, OPC Suite, and uaGate are affec

The “restore configuration” feature of Softing Secure Integration Server V1.22 is vulnerable to a directory traversal vu

A crafted HTTP packet with a large content-length header can create a denial-of-service condition in Softing Secure Inte

This vulnerability is caused by the lack of validation of input values for specific functions if WISA Smart Wing CMS. Re

An infinite loop flaw was found in the USB xHCI controller emulation of QEMU while computing the length of the Transfer

DedeCMS v5.7.94 - v5.7.97 was discovered to contain a remote code execution vulnerability in member_toadmin.php.

DedeBIZ v6 was discovered to contain a remote code execution vulnerability in sys_info.php.

DedeCMS v5.7.93 - v5.7.96 was discovered to contain a remote code execution vulnerability in login.php.

Novel-Plus v3.6.1 was discovered to contain a SQL injection vulnerability via the keyword parameter at /service/impl/Boo

Use After Free in GitHub repository vim/vim prior to 9.0.0221.

A vulnerability was found in laravel 5.1 and classified as problematic. This issue affects some unknown processing. The

Certain 5400 RPM hard drives, for laptops and other PCs in approximately 2005 and later, allow physically proximate atta

Clinic's Patient Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via update_

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0220.

A heap-buffer-overflow had occurred in function gf_isom_dovi_config_get of isomedia/avc_ext.c:2490, as demonstrated by M

IBM Security Verify Governance Identity Manager 10.0 virtual appliance component performs an operation at a privilege le

HashiCorp Consul Template up to 0.27.2, 0.28.2, and 0.29.1 may expose the contents of Vault secrets in the error returne

GPAC mp4box 2.1-DEV-revUNKNOWN-master has a use-after-free vulnerability in function gf_isom_dovi_config_get. This vulne

A Null Pointer dereference vulnerability exists in GPAC 2.1-DEV-revUNKNOWN-master via the function gf_filter_pid_set_pro

An exploitable local privilege escalation vulnerability exists in GOG Galaxy 2.0.46. Due to insufficient folder permissi

The Emerson ControlWave 'Next Generation' RTUs through 2022-05-02 mishandle firmware integrity. They utilize the BSAP-IP

Improper Validation of Specified Quantity in Input in GitHub repository vim/vim prior to 9.0.0218.

Ampere Altra devices before 1.08g and Ampere Altra Max devices before 2.05a allow attackers to control the predictions f

Ampere Altra before SRP 1.08b and Altra Max​ before SRP 2.05 allow information disclosure of power telemetry via HWmon.

Cross-site Scripting (XSS) - Stored in GitHub repository notrinos/notrinoserp prior to 0.7.

OS Command Injection vulnerability in the db_optimize component of Device42 Asset Management Appliance allows an authent

Improper Access Control vulnerability in the /Exago/WrImageResource.adx route as used in Device42 Asset Management Appli

Use of Hard-coded Cryptographic Key vulnerability in the WebReportsApi.dll of Exago Web Reports, as used in the Device42

An Argument Injection or Modification vulnerability in the "Change Secret" username field as used in the Discovery compo

IPESA e-Flow 3.3.6 allows path traversal for reading any file within the web root directory via the lib/js/build/STEReso

An open redirect vulnerability exists in CERT/CC VINCE software prior to 1.50.0. An attacker could send a link that has

XPDF commit ffaf11c was discovered to contain a heap-buffer overflow via DCTStream::lookChar() at /xpdf/Stream.cc.

XPDF commit ffaf11c was discovered to contain a heap-buffer overflow via DCTStream::readScan() at /xpdf/Stream.cc.

XPDF commit ffaf11c was discovered to contain a global-buffer overflow via Lexer::getObj(Object*) at /xpdf/Lexer.cc.