2022

CSRF tokens are generated using math/rand, which is not a cryptographically secure random number generator, allowing an

Token validation methods are susceptible to a timing side-channel during HMAC comparison. With a large enough number of

The RemoteAddr and LocalAddr methods on the returned net.Conn may call themselves, leading to an infinite loop which wil

Unsanitized input in the default logger in github.com/gin-gonic/gin before v1.6.0 allows remote attackers to inject arbi

A remote code execution vulnerability exists in Rockwell Automation Studio 5000 Logix Emulate software.  Users are grant

Some Dahua software products have a vulnerability of unauthenticated restart of remote DSS Server. After bypassing the f

Some Dahua software products have a vulnerability of server-side request forgery (SSRF). An Attacker can access internal

Some Dahua software products have a vulnerability of unrestricted upload of file. After obtaining the permissions of adm

Some Dahua software products have a vulnerability of using of hard-coded cryptographic key. An attacker can obtain the A

Some Dahua software products have a vulnerability of unauthenticated request of MQTT credentials. An attacker can obtain

Denial of Service in GitHub repository usememos/memos prior to 0.9.1.

Improper Removal of Sensitive Information Before Storage or Transfer in GitHub repository usememos/memos prior to 0.9.1.

Unrestricted Upload of File with Dangerous Type in GitHub repository microweber/microweber prior to 1.3.2.

Authentication Bypass by Primary Weakness in GitHub repository ikus060/rdiffweb prior to 2.5.5.

A SQL injection issue in a database stored function in TrueConf Server 5.2.0.10225 (fixed in 5.2.6.10025) allows a low-p

The console in Togglz before 2.9.4 allows CSRF.

Realtek Audio Drivers for Windows, as used on the Lenovo ThinkPad X1 Carbon 20A7, 20A8, 20BS, and 20BT before 6.0.8882.1

A deserialization flaw was discovered in jackson-databind through 2.9.10.4. It could allow an unauthenticated user to pe

An issue was discovered in Illumos in Nexenta NexentaStor 4.0.5 and 5.1.2, and other products. The SMB server allows an

In CODESYS V3 products in all versions prior V3.5.16.0 containing the CmpUserMgr, the CODESYS Control runtime system sto

In Pilz PMC programming tool 3.x before 3.5.17 (based on CODESYS Development System), a user's password may be changed b

The Plugin Logic WordPress plugin before 1.0.8 does not sanitise and escape a parameter before using it in a SQL stateme

The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape

The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape

The Menu Item Visibility Control WordPress plugin through 0.5 doesn't sanitize and validate the "Visibility logic" optio

The glob-parent package before 6.0.1 for Node.js allows ReDoS (regular expression denial of service) attacks against the

Emerson DeltaV Distributed Control System (DCS) has insufficient verification of firmware integrity (an inadequate check

Weak password derivation for export in Devolutions Remote Desktop Manager before 2022.1 allows information disclosure vi

golang.org/x/text/language in golang.org/x/text before 0.3.7 can panic with an out-of-bounds read during BCP 47 language

fastrack Reflex 2.0 W307S_REFLEX_v90.89 Activity Tracker allows physically proximate attackers to dump the firmware, fla

fastrack Reflex 2.0 W307S_REFLEX_v90.89 Activity Tracker allows a Remote attacker to cause a Denial of Service (device o

fastrack Reflex 2.0 W307S_REFLEX_v90.89 Activity Tracker allows an Unauthenticated Remote attacker to send a malicious f

Heimdal before 7.7.1 allows attackers to cause a NULL pointer dereference in a SPNEGO acceptor via a preferred_mech_type

A vulnerability classified as critical was found in SourceCodester School Dormitory Management System 1.0. Affected by t

A vulnerability was found in SourceCodester Blood Bank Management System 1.0. It has been rated as critical. This issue

A buffer over-read was discovered in libntlmauth in Squid 2.5 through 5.6. Due to incorrect integer-overflow protection,

Intelbras WiFiber 120AC inMesh before 1-1-220826 allows command injection by authenticated users, as demonstrated by the

enlightenment_sys in Enlightenment before 0.25.4 allows local users to gain privileges because it is setuid root, and th

PAC parsing in MIT Kerberos 5 (aka krb5) before 1.19.4 and 1.20.x before 1.20.1 has integer overflows that may lead to r

Planet eStream before 6.72.10.07 allows a low-privileged user to gain access to administrative and high-privileged user

Slixmpp before 1.8.3 lacks SSL Certificate hostname validation in XMLStream, allowing an attacker to pose as any server

An issue was discovered in Simmeth Lieferantenmanager before 5.6. Due to errors in session management, an attacker can l

An issue was discovered in Simmeth Lieferantenmanager before 5.6. An attacker can download arbitrary files from the web

Certain ZKTeco products (ZEM500-510-560-760, ZEM600-800, ZEM720, ZMM) allow access to sensitive information via direct r

Planet eStream before 6.72.10.07 allows a remote attacker (who is a publisher or admin) to obtain access to all records

JSON5 is an extension to the popular JSON file format that aims to be easier to write and maintain by hand (e.g. for con

A link following vulnerability in the Damage Cleanup Engine component of Trend Micro Apex One and Trend Micro Apex One a

BigFix deployments that have installed the Notification Service on Windows are susceptible to disclosing SMTP BigFix ope

An image signature validation bypass vulnerability in Kyverno 1.8.3 and 1.8.4 allows a malicious image registry (or a ma

The hash functionality in userver before 42059b6319661583b3080cab9b595d4f8ac48128 allows attackers to cause a denial of