2022

Airspan AirVelocity 1500 web management UI displays SNMP credentials in plaintext on software versions older than 15.18.

The AirVelocity 1500 prints SNMP credentials on its physically accessible serial port during boot. This was fixed in Air

An authenticated attacker can enumerate and download sensitive files, including the eNodeB's web management UI's TLS pri

Several denial of service vulnerabilities exist in Eternal Terminal prior to version 6.2.0, including a DoS triggered re

A race condition exists in Eternal Terminal prior to version 6.2.0 which allows a local attacker to hijack Eternal Termi

A race condition exists in Eternal Terminal prior to version 6.2.0 that allows an authenticated attacker to hijack other

A privilege escalation to root exists in Eternal Terminal prior to version 6.2.0. This is due to the combination of a ra

Cross-site request forgery attacks can be carried out against the Eyes of Network web application, due to an absence of

Improper neutralization of input during web page generation leaves the Eyes of Network web application vulnerable to cro

Improper neutralization of special elements leaves the Eyes of Network Web application vulnerable to an iFrame injection

Use After Free in GitHub repository vim/vim prior to 9.0.0213.

The Zoom Client for Meetings for macOS (Standard and for IT Admin) starting with version 5.7.3 and before 5.11.5 contain

An issue was discovered in Aviatrix Gateway before 6.6.5712 and 6.7.x before 6.7.1376. Because Gateway API functions mis

Out-of-bounds Read in GitHub repository vim/vim prior to 9.0.0212.

There is an HTML injection issue in Esri Portal for ArcGIS versions 10.9.0 and below which may allow a remote, authentic

A stored Cross Site Scripting (XSS) vulnerability in Esri Portal for ArcGIS configurable apps may allow a remote, unauth

There is a reflected XSS vulnerability in Esri Portal for ArcGIS versions 10.9.1 which may allow a remote attacker able

Prior to version 10.9.0, the sharing/rest/content/features/analyze endpoint is always accessible to anonymous users, whi

There is a reflected XSS vulnerability in Esri Portal for ArcGIS versions 10.8.1 and below which may allow a remote atta

Windows Defender Credential Guard Security Feature Bypass Vulnerability

Windows Defender Credential Guard Elevation of Privilege Vulnerability

An issue in the UPnP protocol in 4thline cling 2.0.0 through 2.1.2 allows remote attackers to cause a denial of service

Directory Traversal vulnerability ZDBQAREFSUBDIR parameter in /zropusermgmt API in Zoho ManageEngine Analytics Plus befo

Out-of-Band XML External Entity (OOB-XXE) vulnerability in Zoho ManageEngine Analytics Plus before 4.3.5 allows remote a

Directory traversal vulnerability in wkhtmltopdf through 0.12.5 allows remote attackers to read local files and disclose

This library allows strings to be parsed as functions and stored as a specialized component, [`JsonFunctionValue`](https

Minetest is a free open-source voxel game engine with easy modding and game creation. In **single player**, a mod can se

Authenticated stored cross-site scripting (XSS) vulnerability in "Field Server Address" field in INTELBRAS ATA 200 Firmw

D-Link GO-RT-AC750 GORTAC750_revA_v101b03 & GO-RT-AC750_revB_FWv200b02 is vulnerable to Authentication Bypass via functi

D-Link Go-RT-AC750 GORTAC750_revA_v101b03 & GO-RT-AC750_revB_FWv200b02 is vulnerable to Buffer Overflow via authenticati

D-Link GO-RT-AC750 GORTAC750_revA_v101b03 & GO-RT-AC750_revB_FWv200b02 is vulnerable to Static Default Credentials via /

D-Link Go-RT-AC750 GORTAC750_revA_v101b03 & GO-RT-AC750_revB_FWv200b02 is vulnerable to command injection via /htdocs/up

In Nordic nRF5 SDK for Mesh 5.0, a heap overflow vulnerability can be triggered by sending a series of segmented packets

In Nordic nRF5 SDK for Mesh 5.0, a heap overflow vulnerability can be triggered by sending a series of segmented control

Authorization Bypass Through User-Controlled Key in GitHub repository openemr/openemr prior to 7.0.0.1.

dproxy-nexgen (aka dproxy nexgen) forwards and caches DNS queries with the CD (aka checking disabled) bit set to 1. This

Misinterpretation of special domain name characters in dproxy-nexgen (aka dproxy nexgen) leads to cache poisoning becaus

dproxy-nexgen (aka dproxy nexgen) uses a static UDP source port (selected randomly only at boot time) in upstream querie

dproxy-nexgen (aka dproxy nexgen) re-uses the DNS transaction id (TXID) value from client queries, which allows attacker

An issue was discovered in taocms 3.0.2. in the website settings that allows arbitrary php code to be injected by modify

totd 1.5.3 uses a fixed UDP source port in upstream queries sent to DNS resolvers. This allows DNS cache poisoning becau

Misinterpretation of special domain name characters in DNRD (aka Domain Name Relay Daemon) 2.20.3 leads to cache poisoni

DNRD (aka Domain Name Relay Daemon) 2.20.3 forwards and caches DNS queries with the CD (aka checking disabled) bit set t

There is an out-of-bounds write in checkType located in etc.c in w3m 0.5.3. It can be triggered by sending a crafted HTM

A buffer overflow in the FTcpListener thread in The Isle Evrima (the dedicated server on Windows and Linux) 0.9.88.07 be

Apache OpenOffice supports the storage of passwords for web connections in the user's configuration database. The stored

Apache OpenOffice supports the storage of passwords for web connections in the user's configuration database. The stored

Venice is a Clojure inspired sandboxed Lisp dialect with excellent Java interoperability. A partial path traversal issue

Arvados is an open source platform for managing, processing, and sharing genomic and other large scientific and biomedic

OpenZeppelin Contracts is a library for secure smart contract development. The functions `ECDSA.recover` and `ECDSA.tryR