2022

An improper access control vulnerability [CWE-284] in FortiOS versions 6.2.0 through 6.2.11, 6.4.0 through 6.4.8 and 7.0

An issue was discovered in OpenStack Nova before 23.2.2, 24.x before 24.1.2, and 25.x before 25.0.2. By creating a neutr

SQLite 1.0.12 through 3.39.x before 3.39.2 sometimes allows an array-bounds overflow if billions of bytes are used in a

Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Syno

Affected versions of Atlassian Jira Service Management Server and Data Center allow remote attackers without the "Browse

Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Syno

Cleartext transmission of sensitive information vulnerability in authentication management in Synology Note Station Clie

Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Syno

Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Syno

PingCAP TiDB v6.1.0 was discovered to contain a NULL pointer dereference.

An issue in the fetch_step function in Percona Server for MySQL v8.0.28-19 allows attackers to cause a Denial of Service

The assertion `stmt->Dbc->FirstStmt' failed in MonetDB Database Server v11.43.13.

Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in webapi compo

BigTree CMS 4.4.16 was discovered to contain an arbitrary file upload vulnerability which allows attackers to execute ar

Yuba u5cms v8.3.5 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component savepage.php. This vul

JFinal CMS v5.1.0 was discovered to contain a SQL injection vulnerability via /system/user.

MilkyTracker v1.03.00 was discovered to contain a stack overflow via the component LoaderXM::load. This vulnerability is

An issue was discovered in bgpd in FRRouting (FRR) 8.3. In bgp_notify_send_with_data() and bgp_process_packet() in bgp_p

An issue was discovered in the Arm Mali GPU Kernel Driver (Valhall r29p0 through r38p0). A non-privileged user can make

In Progress WS_FTP Server prior to version 8.7.3, forms within the administrative interface did not include a nonce to m

In Progress WS_FTP Server prior to version 8.7.3, multiple reflected cross-site scripting (XSS) vulnerabilities exist in

A stored cross-site scripting (XSS) vulnerability in Mealie v0.5.5 allows attackers to execute arbitrary web scripts or

In Quest KACE Systems Management Appliance (SMA) through 12.0, a hash collision is possible during authentication. This

In Quest KACE Systems Management Appliance (SMA) through 12.0, predictable token generation occurs when appliance linkin

A SQL injection vulnerability exists within Quest KACE Systems Management Appliance (SMA) through 12.0 that can allow fo

BookWyrm is a social network for tracking reading. Versions prior to 0.4.5 were found to lack rate limiting on authentic

v8n is a javascript validation library. Versions of v8n prior to 1.5.1 were found to have an inefficient regular express

Lanling OA Landray Office Automation (OA) internal patch number #133383/#137780 contains an arbitrary file read vulnerab

NextAuth.js is a complete open source authentication solution for Next.js applications. `next-auth` users who are using

The iWay Service Manager Console component of TIBCO Software Inc.'s TIBCO iWay Service Manager contains an easily exploi

The iWay Service Manager Console component of TIBCO Software Inc.'s TIBCO iWay Service Manager contains easily exploitab

Improper Access Control in GitHub repository tooljet/tooljet prior to v1.19.0.

EasyUse MailHunter Ultimate’s cookie deserialization function has an inadequate validation vulnerability. Deserializing

HiCOS Citizen verification component has a stack-based buffer overflow vulnerability due to insufficient parameter lengt

Teamplus Pro community discussion has an ‘allocation of resource without limits or throttling’ vulnerability on thread s

Teamplus Pro community discussion function has an ‘allocation of resource without limits or throttling’ vulnerability. A

The NHI card’s web service component has a stack-based buffer overflow vulnerability due to insufficient validation for

The NHI card’s web service component has a heap-based buffer overflow vulnerability due to insufficient validation for p

The NHI card’s web service component has a stack-based buffer overflow vulnerability due to insufficient validation for

Mealie1.0.0beta3 was discovered to contain a Server-Side Template Injection vulnerability, which allows attackers to exe

A stored XSS vulnerability was identified in GitHub Enterprise Server that allowed the injection of arbitrary attributes

The embedded neutralization of Script-Related HTML Tag, was by-passed in the case of some extra conditions.

A stored cross-site scripting (XSS) vulnerability in Mealie 1.0.0beta3 allows attackers to execute arbitrary web scripts

Mealie 1.0.0beta3 contains an arbitrary file upload vulnerability which allows attackers to execute arbitrary code via a

An issue was discovered in rsync before 3.2.5 that allows malicious remote servers to write arbitrary files inside the d

The package io.socket:socket.io-client before 2.0.1 are vulnerable to NULL Pointer Dereference when parsing a packet wit

This affects all versions of package Flask-Security. When using the get_post_logout_redirect and get_post_login_redirect

The package get-npm-package-version before 1.0.7 are vulnerable to Command Injection via main function in index.js.

This affects all versions of package npos-tesseract. The injection point is located in line 55 in lib/ocr.js.

This affects the package image-tiler before 2.0.2.