2022

Cross-site Scripting (XSS) - Reflected in GitHub repository beancount/fava prior to 1.22.2.

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0061.

The time and filter parameters in Fava prior to v1.22 are vulnerable to reflected XSS due to the lack of escaping of err

The package grapesjs before 0.19.5 are vulnerable to Cross-site Scripting (XSS) due to an improper sanitization of the c

Type confusion in V8 in Google Chrome prior to 100.0.4896.88 allowed a remote attacker to potentially exploit heap corru

Use after free in tab groups in Google Chrome prior to 100.0.4896.88 allowed a remote attacker to potentially exploit he

Use after free in storage in Google Chrome prior to 100.0.4896.88 allowed an attacker who convinced a user to install a

Use after free in shell in Google Chrome on ChromeOS prior to 100.0.4896.88 allowed a remote attacker to potentially exp

Use after free in regular expressions in Google Chrome prior to 100.0.4896.88 allowed a remote attacker to potentially e

Insufficient policy enforcement in developer tools in Google Chrome prior to 100.0.4896.88 allowed a remote attacker to

Use after free in BFCache in Google Chrome prior to 100.0.4896.88 allowed a remote attacker to potentially exploit heap

Inappropriate implementation in full screen in Google Chrome on Android prior to 100.0.4896.88 allowed a remote attacker

Inappropriate implementation in compositing in Google Chrome prior to 100.0.4896.88 allowed a remote attacker to spoof t

Use after free in storage in Google Chrome prior to 100.0.4896.88 allowed a remote attacker to potentially exploit heap

Type confusion in V8 in Google Chrome prior to 100.0.4896.75 allowed a remote attacker to potentially exploit heap corru

A flaw was found in Openstack manilla owning a Ceph File system "share", which enables the owner to read/write any manil

The package otp-generator before 3.0.0 are vulnerable to Insecure Randomness due to insecure generation of random one-ti

All versions of package @ianwalter/merge are vulnerable to Prototype Pollution via the main (merge) function. Maintainer

All versions of package set-deep-prop are vulnerable to Prototype Pollution via the main functionality.

This affects all versions of package node-import. The "params" argument of module function can be controlled by users wi

This affects the package thenify before 3.3.1. The name argument provided to the package can be controlled by users with

This affects the package snyk-broker before 4.73.0. It allows arbitrary file reads for users with access to Snyk's inter

This affects the package properties-reader before 2.2.0.

This affects all versions of package ion-parser. If an attacker submits a malicious INI file to an application that pars

This affects the package js-ini before 1.3.0. If an attacker submits a malicious INI file to an application that parses

This affects all versions of package markdown-it-decorate. An attacker can add an event handler or use javascript:xxx fo

This affects all versions of package markdown-it-toc. The title of the generated toc and the contents of the header are

This affects all versions of package xopen. The injection point is located in line 14 in index.js in the exported functi

The package ntesseract before 0.2.9 are vulnerable to Command Injection via lib/tesseract.js.

This affects all versions of package npm-help. The injection point is located in line 13 in index.js file in export.late

This affects all versions of package sonar-wrapper. The injection point is located in lib/sonarRunner.js.

This affects the package conf-cfg-ini before 1.2.2. If an attacker submits a malicious INI file to an application that p

This affects all versions of package deferred-exec. The injection point is located in line 42 in lib/deferred-exec.js

This affects all versions of package google-cloudstorage-commands.

This affects all versions of package ffmpeg-sdk. The injection point is located in line 9 in index.js.

All versions of package git-archive are vulnerable to Command Injection via the exports function.

The Simple Page Transition WordPress plugin through 1.4.1 does not sanitise and escape some of its settings, which could

The W-DALIL WordPress plugin through 2.0 does not sanitise and escape some of its fields, which could allow high privile

The Allow SVG Files WordPress plugin through 1.1 does not sanitise uploaded SVG files, which could allow users with a ro

The Request a Quote WordPress plugin through 2.3.7 does not validate uploaded CSV files, allowing unauthenticated users

The Request a Quote WordPress plugin before 2.3.9 does not sanitise and escape some of its settings, allowing high privi

The Unyson WordPress plugin before 2.7.27 does not sanitise and escape a parameter before outputting it back in the page

The WP Video Lightbox WordPress plugin before 1.9.5 does not escape the $_SERVER['REQUEST_URI'] parameter before outputt

The Popup Anything WordPress plugin before 2.1.7 does not sanitise and escape a parameter before outputting it back in a

The Name Directory WordPress plugin before 1.25.3 does not sanitise and escape a parameter before outputting it back in

The Name Directory WordPress plugin before 1.25.4 does not have CSRF check when importing names, and is also lacking san

The SP Project & Document Manager WordPress plugin before 4.58 uses an easily guessable path to store user files, bad ac

The Exports and Reports WordPress plugin before 0.9.2 does not sanitize and validate data when generating the CSV to exp

The Header Footer Code Manager WordPress plugin before 1.1.24 does not escape generated URLs before outputting them back

The Professional Social Sharing Buttons, Icons & Related Posts WordPress plugin before 9.7.6 does not have proper author