2022

D-Link DSL-3782 v1.03 and below was discovered to contain a stack overflow via the function getAttrValue.

D-Link DSL-3782 v1.03 and below was discovered to contain a command injection vulnerability via the function byte_4C0160

A stack overflow was discovered in the _TIFFVGetField function of Tiffsplit v4.4.0. This vulnerability allows attackers

Hiby R3 PRO firmware v1.5 to v1.7 was discovered to contain a file upload vulnerability via the file upload feature.

An inflation issue was discovered in Chia Network CAT1 Standard 1.0.0. Previously minted tokens minted on the Chia block

Improperly Implemented Security Check vulnerability in the SonicWall Hosted Email Security leads to bypass of Capture AT

Improper Neutralization of Special Elements used in an SQL Command leading to Unauthenticated SQL Injection vulnerabilit

Improper neutralization of special elements used in a user input allows an authenticated malicious user to perform remot

A maliciously crafted TIFF file when consumed through DesignReview.exe application can be forced to read beyond allocate

A maliciously crafted TGA or PCX file may be used to write beyond the allocated buffer through DesignReview.exe applicat

A Double Free vulnerability allows remote attackers to execute arbitrary code through DesignReview.exe application on PD

Authenticated (author or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in PluginlySpeaking Floating

Access to external entities when parsing XML documents can lead to XML external entity (XXE) attacks. This flaw allows a

When computing a shared secret or point multiplication on the NIST P-256 curve using a public key with an X coordinate o

When computing a shared secret or point multiplication on the NIST P-256 curve that results in an X coordinate of zero,

When compressing or decompressing a point on the NIST P-256 elliptic curve with an X coordinate of zero, the resulting o

When compressing or decompressing elliptic curve points using the Sweet B library, an incorrect choice of sign bit is us

The Velociraptor GUI contains an editor suggestion feature that can display the description field of a VQL function, plu

On MacOS and Linux, it may be possible to perform a symlink attack by replacing this predictable file name with a symlin

A cross-site scripting (XSS) issue in generating a collection report made it possible for malicious clients to inject Ja

Due to a bug in the handling of the communication between the client and server, it was possible for one client, already

Parsing a maliciously crafted PRT file can force Autodesk AutoCAD 2023 to read beyond allocated boundaries. This vulnera

A vulnerability, which was classified as problematic, was found in SourceCodester Garage Management System 1.0. Affected

A vulnerability, which was classified as critical, has been found in SourceCodester Garage Management System 1.0. This i

A vulnerability classified as critical was found in SourceCodester Garage Management System 1.0. This vulnerability affe

An attacker can force the victim’s device to perform arbitrary HTTP requests in WAN through a malicious SVG file being p

The Linux kernel before 5.18.13 lacks a certain clear operation for the block starting symbol (.bss). This allows Xen PV

IBM PowerVM VIOS 3.1 could allow a remote attacker to tamper with system configuration or cause a denial of service. IBM

In Eclipse Californium version 2.0.0 to 2.7.2 and 3.0.0-3.5.0 a DTLS resumption handshake falls back to a DTLS full hand

Inavitas Solar Log product has an unauthenticated SQL Injection vulnerability.

The package github.com/runatlantis/atlantis/server/controllers/events before 0.19.7 are vulnerable to Timing Attack in t

Incorrect signature trust exists within Google Play services SDK play-services-basement. A debug version of Google Play

png2webp v1.0.4 was discovered to contain an out-of-bounds write via the function w2p. This vulnerability is exploitable

SimpleNetwork TCP Server commit 29bc615f0d9910eb2f59aa8dff1f54f0e3af4496 was discovered to contain a double free vulnera

WMAgent v1.3.3rc2 and 1.3.3rc1, reqmgr 2 1.4.1rc5 and 1.4.0rc2, reqmon 1.4.1rc5, and global-workqueue 1.4.1rc5 allows at

Barangay Management System v1.0 was discovered to contain a SQL injection vulnerability via the hidden_id parameter at /

PicoC v3.2.2 was discovered to contain a NULL pointer dereference at variable.c.

TP-LINK TL-R473G 2.0.1 Build 220529 Rel.65574n was discovered to contain a remote code execution vulnerability which is

IBM QRadar SIEM 7.3, 7.4, and 7.5 is vulnerable to local privilege escalation if this could be combined with other unkno

Advanced School Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the addr

SDL v1.2 was discovered to contain a use-after-free via the XFree function at /src/video/x11/SDL_x11yuv.c.

Horde Groupware Webmail Edition through 5.2.22 allows a reflection injection attack through which an attacker can instan

Use after free in WebGPU in Google Chrome prior to 100.0.4896.88 allowed a remote attacker to potentially exploit heap c

Realtek rtl819x-SDK before v3.6.1 allows command injection over the web interface.

The Email Viewer in RainLoop through 1.6.0 allows XSS via a crafted email message.

sqclass.cpp in Squirrel through 2.2.5 and 3.x through 3.1 allows an out-of-bounds read (in the core interpreter) that ca

DPTech VPN v8.1.28.0 was discovered to contain an arbitrary file read vulnerability.

Open Source Point of Sale v3.3.7 was discovered to contain an arbitrary file upload vulnerability via the Update Brandin

Prototype Pollution in GitHub repository automattic/mongoose prior to 6.4.6.

Input passed to the Pdf() function is shell escaped and passed to child_process.exec() during PDF rendering. However, th