2022

Red Lion Controls Crimson 3.0 versions 707.000 and prior, Crimson 3.1 versions 3126.001 and prior, and Crimson 3.2 versi

Lightning Network Daemon (lnd) is an implementation of a lightning bitcoin overlay network node. All lnd nodes before ve

XXL-Job before v2.3.1 contains a Server-Side Request Forgery (SSRF) via the component /admin/controller/JobLogController

Online Leave Management System v1.0 was discovered to contain a SQL injection vulnerability via the component /admin/?pa

Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the id paramete

Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the id paramete

Automotive Shop Management System v1.0 is vulnerable to SQL Injection via /asms/admin/?page=user/manage_user&id=.

Automotive Shop Management System v1.0 is vulnerable to SQL Injection via /asms/classes/Master.php?f=delete_transaction.

An arbitrary file upload vulnerability in rconfig v3.9.6 allows attackers to execute arbitrary code via a crafted PHP fi

kkFileView v4.1.0 was discovered to contain a Server-Side Request Forgery (SSRF) via the component cn.keking.web.control

A vulnerability has been identified in syngo Dynamics (All versions < VA40G HF01). An unauthenticated Server-Side Reques

A vulnerability has been identified in syngo Dynamics (All versions < VA40G HF01). syngo Dynamics application server hos

A vulnerability has been identified in syngo Dynamics (All versions < VA40G HF01). syngo Dynamics application server hos

A vulnerability has been identified in syngo Dynamics (All versions < VA40G HF01). syngo Dynamics application server hos

A vulnerability has been identified in syngo Dynamics (All versions < VA40G HF01). syngo Dynamics application server hos

A vulnerability has been identified in syngo Dynamics (All versions < VA40G HF01). syngo Dynamics application server hos

The Java Admin Console in Veritas NetBackup through 10.1 and related Veritas products on Linux and UNIX allows authentic

BKG Professional NtripCaster 2.0.39 allows querying information over the UDP protocol without authentication. The NTRIP

Doufox 0.0.4 contains a CSRF vulnerability that can add system administrator account.

A SQL injection vulnerability exits on the Simple Image Gallery System 1.0 application through "id" parameter on the alb

An issue was discovered in BACKCLICK Professional 5.9.63. Due to an unsafe implementation of session tracking, it is pos

Arobas Music Guitar Pro for iPad and iPhone before v1.10.2 allows attackers to perform directory traversal and download

The Permalink Manager Lite plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and inclu

Karmasis Informatics Infraskope SIEM+ has an unauthenticated access vulnerability which could allow an unauthenticated a

Use of a untrusted pointer allows tampering with SMRAM and OS memory in SdHostDriver and SdMmcDevice Use of a untrusted

Incorrect pointer checks within the NvmExpressDxe driver can allow tampering with SMRAM and OS memory Incorrect pointer

Incorrect pointer checks within the the FwBlockServiceSmm driver can allow arbitrary RAM modifications During review of

SMI functions in AhciBusDxe use untrusted inputs leading to corruption of SMRAM. SMI functions in AhciBusDxe use untrust

LimeSurvey before v5.0.4 was discovered to contain a SQL injection vulnerability via the component /application/views/th

Horner Automation's Cscape version 9.90 SP 6 and prior does not properly validate user-supplied data. If a user opens a

IBM Cloud Pak for Security (CP4S) 1.10.0.0 through 1.10.2.0 could allow an authenticated user to obtain highly sensitiv

Manipulation of the input address in PnpSmm function 0x52 could be used by malware to overwrite SMRAM or OS kernel memor

Initialization function in PnpSmm could lead to SMRAM corruption when using subsequent PNP SMI functions Initialization

In UsbCoreDxe, tampering with the contents of the USB working buffer using DMA while certain USB transactions are in pro

In UsbCoreDxe, untrusted input may allow SMRAM or OS memory tampering Use of untrusted pointers could allow OS or SMRAM

A vulnerability in dynamic access policies (DAP) functionality of Cisco Adaptive Security Appliance (ASA) Software and F

A vulnerability in the generic routing encapsulation (GRE) tunnel decapsulation feature of Cisco Firepower Threat Defens

A vulnerability in the SSL/TLS client of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Def

A vulnerability in the Simple Network Management Protocol (SNMP) feature of Cisco Adaptive Security Appliance (ASA) Soft

A vulnerability in the Simple Network Management Protocol (SNMP) access controls for Cisco FirePOWER Software for Adapti

A vulnerability in the processing of SSH connections of Cisco Firepower Management Center (FMC) and Cisco Firepower Thre

In s::can moni::tools in versions below 4.2 an unauthenticated attacker could get any file from the device by path trave

In s::can moni::tools before version 4.2 an authenticated attacker could get full access to the database through SQL inj

Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.143 and earlier globally and unconditionally disables SSL/T

Jenkins Config Rotator Plugin 2.0.1 and earlier does not restrict a file name query parameter in an HTTP endpoint, allow

A missing permission check in Jenkins CloudBees Docker Hub/Registry Notification Plugin 2.6.2 and earlier allows unauthe

Jenkins Pipeline Utility Steps Plugin 2.13.1 and earlier does not restrict the set of enabled prefix interpolators and b

Jenkins Script Security Plugin 1189.vb_a_b_7c8fd5fde and earlier stores whole-script approvals as the SHA-1 hash of the

Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.146 and earlier unconditionally disables SSL/TLS certificat

The "Follow Me Plugin" plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including