2022

Usage of the CORS handler may apply improper CORS headers, allowing the requester to explicitly control the value of the

LZ4 bindings use a deprecated C API that is vulnerable to memory corruption, which could lead to arbitrary code executio

Improper Access Control in GitHub repository ikus060/rdiffweb prior to 2.5.5.

Business Logic Errors in GitHub repository ikus060/rdiffweb prior to 2.5.5.

A SQL injection issue in the web API in TrueConf Server 5.2.0.10225 (fixed in 5.2.6.10025) allows remote unauthenticated

Shilpi CAPExWeb 1.1 allows SQL injection via a servlet/capexweb.cap_sendMail GET request.

The ACENet service in Sierra Wireless ALEOS before 4.4.9, 4.5.x through 4.9.x before 4.9.5, and 4.10.x through 4.13.x be

Sierra Wireless AirLink Mobility Manager (AMM) before 2.17 mishandles sessions and thus an unauthenticated attacker can

The Stop Spammers Security | Block Spam Users, Comments, Forms WordPress plugin before 2022.6 passes base64 encoded user

The IWS WordPress plugin through 1.0 does not properly escape a parameter before using it in a SQL statement via an AJAX

The Return Refund and Exchange For WooCommerce WordPress plugin before 4.0.9 does not validate attachment files to be up

In Directus before 9.7.0, the default settings of CORS_ORIGIN and CORS_ENABLED are true.

Certain General Electric Renewable Energy products have a hidden feature for unauthenticated remote access to the device

Certain General Electric Renewable Energy products allow attackers to use a code to trigger a reboot into the factory de

Certain General Electric Renewable Energy products download firmware without an integrity check. This affects iNET and i

Certain General Electric Renewable Energy products have inadequate encryption strength. This affects iNET and iNET II be

In CWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1107, an unauthenticated attacker can use %00 bytes to c

In CWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1107, attackers can make a crafted request to api/?api=a

Planet eStream before 6.72.10.07 allows unauthenticated upload of arbitrary files: Choose a Video / Related Media or Upl

Heimdal before 7.7.1 allows remote attackers to execute arbitrary code because of an invalid free in the ASN.1 codec use

An issue was discovered in Simmeth Lieferantenmanager before 5.6. An attacker can inject raw SQL queries. By activating

An issue was discovered in Simmeth Lieferantenmanager before 5.6. An attacker can make various API calls without authent

Planet eStream before 6.72.10.07 allows attackers to call restricted functions, and perform unauthenticated uploads (Upl

The Nintendo NetworkBuffer class, as used in Animal Crossing: New Horizons before 2.0.6 and other products, allows remot

Out-of-bounds read was discovered in YDB server. An attacker could construct a query with insert statement that would al

ThinkPHP Framework before 6.0.14 allows local file inclusion via the lang parameter when the language pack feature is en

IP-COM M50 V15.11.0.33(10768) was discovered to contain a buffer overflow via the picName parameter in the formDelWewifi

IP-COM M50 V15.11.0.33(10768) was discovered to contain multiple buffer overflows via the ip, mac, and remark parameters

IP-COM M50 V15.11.0.33(10768) was discovered to contain a buffer overflow via the gotoUrl parameter in the formPortalAut

IP-COM M50 V15.11.0.33(10768) was discovered to contain a buffer overflow via the rules parameter in the formIPMacBindAd

IP-COM M50 V15.11.0.33(10768) was discovered to contain a command injection vulnerability via the usbPartitionName param

IP-COM M50 V15.11.0.33(10768) was discovered to contain a buffer overflow via the indexSet parameter in the formIPMacBin

IP-COM M50 V15.11.0.33(10768) was discovered to contain multiple buffer overflows via the pLanPortRange and pWanPortRang

IP-COM M50 V15.11.0.33(10768) was discovered to contain a buffer overflow via the indexSet parameter in the formQOSRuleD

IP-COM M50 V15.11.0.33(10768) was discovered to contain a buffer overflow via the rules parameter in the formAddDnsForwa

IP-COM M50 V15.11.0.33(10768) was discovered to contain a command injection vulnerability via the hostname parameter in

IP-COM M50 V15.11.0.33(10768) was discovered to contain multiple buffer overflows via the pEnable, pLevel, and pModule p

IP-COM M50 V15.11.0.33(10768) was discovered to contain multiple command injection vulnerabilities via the pEnable, pLev

IP-COM M50 V15.11.0.33(10768) was discovered to contain a buffer overflow via the sPortMapIndex parameter in the formDel

IP-COM M50 V15.11.0.33(10768) was discovered to contain a buffer overflow via the rules parameter in the formAddDnsHijac

IP-COM M50 V15.11.0.33(10768) was discovered to contain a buffer overflow via the hostname parameter in the formSetNetCh

An issue was discovered in ksmbd in the Linux kernel 5.15 through 5.19 before 5.19.2. fs/ksmbd/smb2pdu.c has a use-after

D-Link DIR-846 A1_FW100A43 was discovered to contain a command injection vulnerability via the auto_upgrade_hour paramet

D-Link DIR-846 A1_FW100A43 was discovered to contain a command injection vulnerability via the lan(0)_dhcps_staticlist p

A command injection vulnerability exists in Rocket.Chat-Desktop <3.8.14 that could allow an attacker to pass a malicious

Authorization Bypass Through User-Controlled Key in GitHub repository usememos/memos prior to 0.9.0.

Activity Watch is a free and open-source automated time tracker. Versions prior to 0.11.0 allow an attacker to execute a

IO FinNet tss-lib before 2.0.0 allows a collision of hash values.

Default version of nbnbk was discovered to contain an arbitrary file upload vulnerability via the component /api/User/do

A code execution vulnerability exists in the DDS scanline parsing functionality of OpenImageIO Project OpenImageIO v2.4.