2022

The Domain Check WordPress plugin before 1.0.17 does not sanitise and escape the domain parameter before outputting it b

The Ninja Tables WordPress plugin before 4.1.8 does not sanitise and escape some of its table fields, which could allow

The Document Embedder WordPress plugin before 1.7.9 contains a AJAX action endpoint, which could allow any authenticated

The Document Embedder WordPress plugin before 1.7.5 contains a REST endpoint, which could allow unauthenticated users to

The Perfect Survey WordPress plugin through 1.5.2 does not validate and escape the X-Forwarded-For header value before o

The Perfect Survey WordPress plugin before 1.5.2 does not sanitise and escape multiple parameters (id and filters[sessio

The Error Log Viewer WordPress plugin before 1.1.2 does not perform nonce check when deleting a log file and does not ha

The Learning Courses WordPress plugin before 5.0 does not sanitise and escape the Email PDT identity token settings, whi

The SVG Support WordPress plugin before 2.3.20 does not escape the "CSS Class to target" setting before outputting it in

The RegistrationMagic WordPress plugin before 5.0.1.9 does not sanitise and escape the rm_search_value parameter before

gh-ost is a triggerless online schema migration solution for MySQL. Versions prior to 1.1.3 are subject to an arbitrary

treq is an HTTP library inspired by requests but written on top of Twisted's Agents. Treq's request methods (`treq.get`,

NULL Pointer Dereference in GitHub repository radareorg/radare2 prior to 5.6.0.

Docker Desktop before 4.4.4 on Windows allows attackers to move arbitrary files.

MariaDB through 10.5.9 allows an application crash via certain long SELECT DISTINCT statements that improperly interact

MariaDB before 10.6.5 has a sql_lex.cc integer overflow, leading to an application crash.

MariaDB before 10.6.2 allows an application crash because of mishandling of a pushdown from a HAVING clause to a WHERE c

MariaDB through 10.5.9 allows a sql_parse.cc application crash because of incorrect used_tables expectations.

MariaDB through 10.5.9 allows an application crash in sub_select_postjoin_aggr for a NULL value of aggr.

MariaDB through 10.5.13 allows a ha_maria::extra application crash via certain SELECT statements.

MariaDB through 10.5.9 allows a set_var.cc application crash via certain uses of an UPDATE statement in conjunction with

MariaDB through 10.5.9 allows an application crash in find_field_in_tables and find_order_in_list via an unused common t

Emlog pro v1.1.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the component /admin/con

Flask-AppBuilder is an application development framework, built on top of the Flask web framework. In affected versions

Cross Site Scripting (XSS) vulnerability exists in Sourcecodester Stock Management System in PHP/OOP 1.0, which allows r

A flaw was found in the Linux kernel. A null pointer dereference in bond_ipsec_add_sa() may lead to local denial of serv

There is a release of invalid pointer vulnerability in some Huawei products, successful exploit may cause the process an

There is an information exposure vulnerability on several Huawei Products. The vulnerability is due to that the software

Beetel 777VR1-DI Hardware Version REV.1.01 Firmware Version V01.00.09_55 was discovered to contain a cross-site scriptin

Improper Validation of Specified Quantity in Input in Packagist dolibarr/dolibarr prior to 16.0.

This affects the package juce-framework/JUCE before 6.1.5. This vulnerability is triggered when a malicious archive is c

The package juce-framework/juce before 6.1.5 are vulnerable to Arbitrary File Write via Archive Extraction (Zip Slip) vi

The Logs plugin before 3.0.4 for Craft CMS allows remote attackers to read arbitrary files via input to actionStream in

xterm through Patch 370, when Sixel support is enabled, allows attackers to trigger a buffer overflow in set_sixel in gr

Improper Access Control in Pypi calibreweb prior to 0.6.16.

Adenza AxiomSL ControllerView through 10.8.1 allows redirection for SSO login URLs.

Adenza AxiomSL ControllerView through 10.8.1 is vulnerable to user enumeration. An attacker can identify valid usernames

MariaDB before 10.7.2 allows an application crash because it does not recognize that SELECT_LEX::nest_level is local to

save_window_function_values in MariaDB before 10.6.3 allows an application crash because of incorrect handling of with_w

get_sort_by_table in MariaDB before 10.6.2 allows an application crash via certain subquery uses of ORDER BY.

Products.ATContentTypes are the core content types for Plone 2.1 - 4.3. Versions of Plone that are dependent on Products

laminas-form is a package for validating and displaying simple and complex forms. When rendering validation error messag

Next.js is a React framework. Starting with version 12.0.0 and prior to version 12.0.9, vulnerable code could allow a ba

Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v.

Cross-site Scripting (XSS) - Reflected in Pypi calibreweb prior to 0.6.16.

There is a carry propagation bug in the MIPS32 and MIPS64 squaring procedure. Many EC algorithms are affected, including

A cross-site scripting (XSS) vulnerability in H.H.G Multistore v5.1.0 and below allows attackers to execute arbitrary we

The package keyget from 0.0.0 are vulnerable to Prototype Pollution via the methods set, push, and at which could allow

The comment function in YzmCMS v6.3 was discovered as being able to be operated concurrently, allowing attackers to crea

YzmCMS v6.3 was discovered to contain a Cross-Site Request Forgery (CSRF) which allows attackers to arbitrarily delete u