2022

In taocms 3.0.1 after logging in to the background, there is an Arbitrary file download vulnerability at the File Manage

An issue was discovered in taoCMS v3.0.2. There is an arbitrary file read vulnerability that can read any files via admi

Tensorflow is an Open Source Machine Learning Framework. ### Impact An attacker can craft a TFLite model that would trig

Tensorflow is an Open Source Machine Learning Framework. The implementation of `QuantizedMaxPool` has an undefined behav

Tensorflow is an Open Source Machine Learning Framework. The implementation of `SparseCountSparseOutput` can be made to

Tensorflow is an Open Source Machine Learning Framework. The implementation of `*Bincount` operations allows malicious u

Tensorflow is an Open Source Machine Learning Framework. Multiple operations in TensorFlow can be used to trigger a deni

Tensorflow is an Open Source Machine Learning Framework. The implementation of `FractionalMaxPool` can be made to crash

Tensorflow is an Open Source Machine Learning Framework. The implementation of `MapStage` is vulnerable a `CHECK`-fail i

Tensorflow is an Open Source Machine Learning Framework. The implementation of `UnravelIndex` is vulnerable to a divisio

Tensorflow is an Open Source Machine Learning Framework. The estimator for the cost of some convolution operations can b

Tensorflow is an Open Source Machine Learning Framework. The implementation of `AddManySparseToTensorsMap` is vulnerable

Tensorflow is an Open Source Machine Learning Framework. The implementations of `Sparse*Cwise*` ops are vulnerable to in

Tensorflow is an Open Source Machine Learning Framework. The implementation of `StringNGrams` can be used to trigger a d

Tensorflow is an Open Source Machine Learning Framework. The implementation of `ThreadPoolHandle` can be used to trigger

Tensorflow is an Open Source Machine Learning Framework. The implementation of shape inference for `ConcatV2` can be use

Multiple cross-site scripting (XSS) vulnerabilities in the component outcomes_addProcess.php of Gibbon CMS v22.0.01 allo

The {% debug %} template tag in Django 2.2 before 2.2.27, 3.2 before 3.2.12, and 4.0 before 4.0.2 does not properly enco

An issue was discovered in Insyde InsydeH2O Kernel 5.0 before 05.08.41, Kernel 5.1 before 05.16.41, Kernel 5.2 before 05

Prototype Pollution in GitHub repository mastodon/mastodon prior to 3.5.0.

IBM Guardium Data Encryption (GDE) 5.0.0.2 behaves differently or sends different responses under different circumstance

PrinterLogic Web Stack versions 19.1.1.13 SP9 and below are vulnerable to multiple reflected cross site scripting vulner

PrinterLogic Web Stack versions 19.1.1.13 SP9 and below are vulnerable to SQL Injection, which may allow an attacker to

Multiple stack-based buffer overflows in the command line interpreter of FortiWeb before 6.4.2 may allow an authenticate

JHEAD is a simple command line tool for displaying and some manipulation of EXIF header data embedded in Jpeg images fro

A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiMail version 7.0

An improper access control vulnerability [CWE-284] in FortiAuthenticator HA service 6.3.2 and below, 6.2.x, 6.1.x, 6.0.x

In Minetest before 5.4.0, players can add or subtract items from a different player's inventory.

iText v7.1.17 was discovered to contain an out-of-bounds exception via the component ARCFOUREncryption.encryptARCFOUR, w

iText v7.1.17 was discovered to contain a stack-based buffer overflow via the component ByteBuffer.append, which allows

iText v7.1.17, up to (exluding)": 7.1.18 and 7.2.2 was discovered to contain an out-of-memory error via the component re

Ivanti Service Manager 2021.1 allows reflected XSS via the appName parameter associated with ConfigDB calls, such as in

UNIVERGE DT 820 V3.2.7.0 and prior, UNIVERGE DT 830 V5.2.7.0 and prior, UNIVERGE DT 930 V2.4.0.0 and prior, IP Phone Man

Apache Superset up to and including 1.3.2 allowed for registered database connections password leak for authenticated us

The check_privacy_settings AJAX action of the WordPress GDPR WordPress plugin before 1.9.27, available to both unauthent

A cross-site scripting (XSS) vulnerability in the Create Post function of Anchor CMS v0.12.7 allows attackers to execute

Reflected Cross-site scripting (XSS) vulnerability in RosarioSIS 8.2.1 allows attackers to inject arbitrary HTML via the

In Apache Pulsar it is possible to access data from BookKeeper that does not belong to the topics accessible by the auth

The LabTools WordPress plugin through 1.0 does not have proper authorisation and CSRF check in place when deleting publi

The Link Library WordPress plugin before 7.2.8 does not have CSRF check when resetting library settings, allowing attack

The Link Library WordPress plugin before 7.2.9 does not sanitise and escape the settingscopy parameter before outputting

The UpdraftPlus WordPress Backup Plugin WordPress plugin before 1.16.69 does not sanitise and escape the updraft_restore

The WOOF WordPress plugin before 1.2.6.3 does not sanitise and escape the woof_redraw_elements before outputing back in

The NextScripts: Social Networks Auto-Poster WordPress plugin before 4.3.25 does not have CSRF check in place when delet

The Skins for Contact Form 7 WordPress plugin before 2.5.1 does not sanitise and escape the tab parameter before outputt

The Asset CleanUp: Page Speed Booster WordPress plugin before 1.3.8.5 does not sanitise and escape POSted parameters sen

The NextScripts: Social Networks Auto-Poster WordPress plugin before 4.3.24 does not sanitise and escape logged requests

The Custom Dashboard & Login Page WordPress plugin before 7.0 does not sanitise some of its settings, allowing high priv

The Asset CleanUp: Page Speed Booster WordPress plugin before 1.3.8.5 does not escape the wpacu_selected_sub_tab_area pa

The Visual CSS Style Editor WordPress plugin before 7.5.4 does not sanitise and escape the wyp_page_type parameter befor