2022

UNIT4 TETA Mobile Edition (ME) before 29.5.HF17 was discovered to contain a SQL injection vulnerability via the ProfileN

In QVIS NVR DVR before 2021-12-13, an attacker can escalate privileges from a qvisdvr user to the root user by abusing a

ShowMyPC 3606 on Windows suffers from a DLL hijack vulnerability. If an attacker overwrites the file %temp%\ShowMyPC\-Sh

QVIS NVR DVR before 2021-12-13 is vulnerable to Remote Code Execution via Java deserialization.

An issue was discovered in LemonLDAP::NG (aka lemonldap-ng) 2.0.13. When using the RESTServer plug-in to operate a REST

IrfanView 4.54 allows a user-mode write access violation starting at FORMATS!ShowPlugInSaveOptions_W+0x0000000000002cba.

IrfanView 4.54 allows a user-mode write access violation starting at FORMATS!ShowPlugInSaveOptions_W+0x000000000000aefe.

IrfanView 4.54 allows a user-mode write access violation starting at FORMATS!ShowPlugInSaveOptions_W+0x0000000000005722.

In LemonLDAP::NG (aka lemonldap-ng) through 2.0.8, validity of the X.509 certificate is not checked by default when conn

Tor 0.4.7.x before 0.4.7.8 allows a denial of service via the wedging of RTT estimation.

libnx_apl.so on Nexans FTTO GigaSwitch before 6.02N and 7.x before 7.02 implements a Backdoor Account for SSH logins on

An issue was discovered in dbus-broker before 31. Multiple NULL pointer dereferences can be found when supplying a malfo

An issue was discovered in dbus-broker before 31. It depends on c-uitl/c-shquote to parse the DBus service's Exec line.

An issue was discovered in Infiray IRAY-A8Z3 1.0.957. There is a blank root password for TELNET by default.

An issue was discovered in Infiray IRAY-A8Z3 1.0.957. The binary file /usr/local/sbin/webproject/set_param.cgi contains

An issue was discovered in Infiray IRAY-A8Z3 1.0.957. The firmware contains a potential buffer overflow by calling strcp

An issue was discovered in Infiray IRAY-A8Z3 1.0.957. The webserver contains an endpoint that can execute arbitrary comm

The export function in SoftGuard Web (SGW) before 5.1.5 allows directory traversal to read an arbitrary local file via e

SoftGuard Web (SGW) before 5.1.5 allows HTML injection.

An issue was discovered in Gentics CMS before 5.43.1. There is stored XSS in the profile description and in the username

An issue was discovered in Gentics CMS before 5.43.1. By uploading a malicious ZIP file, an attacker is able to deserial

An issue was discovered in Open Design Alliance Drawings SDK before 2023.3. An Out-of-Bounds Read vulnerability exists w

An issue was discovered in Open Design Alliance Drawings SDK before 2023.3. An Out-of-Bounds Read vulnerability exists w

An issue was discovered in Open Design Alliance Drawings SDK before 2023.2. An Out-of-Bounds Read vulnerability exists w

An issue was discovered in Poly EagleEye Director II before 2.2.2.1. os.system command injection can be achieved by an a

An issue was discovered in Poly Studio before 3.7.0. Command Injection can occur via the CN field of a Create Certificat

An issue was discovered in Poly EagleEye Director II before 2.2.2.1. Existence of a certain file (which can be created v

The web server of the E1 Zoom camera through 3.0.0.716 discloses its configuration via the /conf/ directory that is mapp

Pexip Infinity before 28.1 allows remote attackers to trigger a software abort via G.719.

Pexip Infinity 27 before 28.0 allows remote attackers to trigger excessive resource consumption and termination because

An issue was discovered in the ContentResource API in dotCMS 3.0 through 22.02. Attackers can craft a multipart form req

In Squid 3.x through 3.5.28, 4.x through 4.17, and 5.x before 5.6, due to improper buffer management, a Denial of Servic

The web server of the E1 Zoom camera through 3.0.0.716 discloses its SSL private key via the root web server directory.

Disclosure of information - the system allows you to view usernames and passwords without permissions, thus it will be p

Pexip Infinity before 27.3 allows remote attackers to trigger excessive resource consumption via H.264.

Pexip Infinity before 27.3 allows remote attackers to trigger a software abort via H.323.

Pexip Infinity before 27.3 allows remote attackers to trigger a software abort via Epic Telehealth.

Pexip Infinity before 27.3 allows remote attackers to trigger a software abort via HTTP.

Pexip Infinity before 27.3 allows remote attackers to trigger a software abort via One Touch Join.

Pexip Infinity before 27.3 allows remote attackers to trigger a software abort via One Touch Join.

Pexip Infinity before 27.3 allows remote attackers to trigger a software abort via the Session Initiation Protocol.

Pexip Infinity 27.x before 27.3 allows remote attackers to trigger a software abort via single-sign-on if a random Unive

Pexip Infinity 27.x before 27.3 allows remote attackers to trigger a software abort via HTTP.

Pexip Infinity 27.x before 27.3 allows remote attackers to trigger a software abort via the Session Initiation Protocol.

Pexip Infinity before 27.3 allows remote attackers to trigger a software abort via One Touch Join.

Pexip Infinity before 27.3 allows remote attackers to trigger a software abort, and possibly enumerate usernames, via On

Pexip Infinity 27.x before 27.3 has Improper Input Validation. The client API allows remote attackers to trigger a softw

Pexip Infinity before 27.3 allows remote attackers to force a software abort via HTTP.

Pexip Infinity 27.x before 27.2 has Improper Access Control. An attacker can sometimes join a conference (call join) if

In Montala ResourceSpace through 9.8 before r19636, csv_export_results_metadata.php allows attackers to export collectio