2022

IBM SiteProtector Appliance 3.1.1 allows web pages to be stored locally which can be read by another user on the system.

mailcow is a mailserver suite. Prior to mailcow-dockerized version 2022-06a, an extended privilege vulnerability can be

The WP Opt-in WordPress plugin through 1.4.1 is vulnerable to CSRF which allows changed plugin settings and can be used

The WP Duplicate Page WordPress plugin before 1.3 does not sanitize and escape some of its settings, which could allow h

The WooCommerce PDF Invoices & Packing Slips WordPress plugin before 2.16.0 doesn't escape a parameter on its setting pa

The Cache Images WordPress plugin before 3.2.1 does not implement nonce checks, which could allow attackers to make any

The Bold Page Builder WordPress plugin before 4.3.3 does not sanitise and escape some of its settings, which could allow

The WP-Paginate WordPress plugin before 2.1.9 does not escape one of its settings, which could allow high privilege user

The Comment License WordPress plugin before 1.4.0 does not have CSRF check in place when updating its settings, which co

The Shortcut Macros WordPress plugin through 1.3 does not have authorisation and CSRF checks in place when updating its

The Free Booking Plugin for Hotels, Restaurant and Car Rental WordPress plugin before 1.1.16 suffers from insufficient i

The core plugin for kitestudio WordPress plugin before 2.3.1 does not sanitise and escape some parameters before outputt

The Awin Data Feed WordPress plugin before 1.8 does not sanitise and escape a header when processing request to generate

The Awin Data Feed WordPress plugin before 1.8 does not sanitise and escape a parameter before outputting it back via an

The Shortcodes and extra features for Phlox WordPress plugin before 2.9.8 does not sanitise and escape a parameter befor

The Popup Builder WordPress plugin before 4.1.11 does not escape and sanitize some settings, which could allow high priv

The pagebar WordPress plugin before 2.70 does not have CSRF check in place when updating its settings, which could allow

The Rename wp-login.php WordPress plugin through 2.6.0 does not have CSRF check in place when updating the secret login

The Sharebar WordPress plugin through 1.4.1 does not have CSRF check in place when updating its settings, which could al

The Admin Management Xtended WordPress plugin before 2.4.5 does not have CSRF checks in some of its AJAX actions, allowi

The WP Maintenance Mode & Coming Soon WordPress plugin before 2.4.5 is lacking CSRF when emptying the subscribed users l

The WooCommerce - Product Importer WordPress plugin through 1.5.2 does not sanitise and escape the imported data before

The WP Event Manager WordPress plugin before 3.1.28 does not sanitise and escape its search before outputting it back in

The FoxyShop WordPress plugin before 4.8.2 does not sanitise and escape a parameter before outputting it back in an admi

The Pricing Deals for WooCommerce WordPress plugin through 2.0.2.02 does not properly sanitise and escape a parameter be

In CmpChannelServer of CODESYS V3 in multiple versions an uncontrolled ressource consumption allows an unauthorized atta

In CmpBlkDrvTcp of CODESYS V3 in multiple versions an uncontrolled ressource consumption allows an unauthorized attacker

Multiple Lenze products of the cabinet series skip the password verification upon second login. After a user has been lo

The CODESYS OPC DA Server prior V3.5.18.20 stores PLC passwords as plain text in its configuration file so that it is vi

Authentication Bypass by Spoofing in GitHub repository microweber/microweber prior to 1.2.20.

H3C SSL VPN through 2022-07-10 allows wnm/login/login.json svpnlang cookie XSS.

Zimbra Collaboration Open Source 8.8.15 does not encrypt the initial-login randomly created password (from the "zmprove

softmmu/physmem.c in QEMU through 7.0.0 can perform an uninitialized read on the translate_fail path, leading to an io_r

The zippies/testplatform repository through 2016-07-19 on GitHub allows absolute path traversal because the Flask send_f

The yuriyouzhou/KG-fashion-chatbot repository through 2018-05-22 on GitHub allows absolute path traversal because the Fl

The unizar-30226-2019-06/ChangePop-Back repository through 2019-06-04 on GitHub allows absolute path traversal because t

The umeshpatil-dev/Home__internet repository through 2020-08-28 on GitHub allows absolute path traversal because the Fla

The stonethree/s3label repository through 2019-08-14 on GitHub allows absolute path traversal because the Flask send_fil

The sravaniboinepelli/AutomatedQuizEval repository through 2020-04-27 on GitHub allows absolute path traversal because t

The shaolo1/VideoServer repository through 2019-09-21 on GitHub allows absolute path traversal because the Flask send_fi

The scorelab/OpenMF repository before 2022-05-03 on GitHub allows absolute path traversal because the Flask send_file fu

The sanojtharindu/caretakerr-api repository through 2021-05-17 on GitHub allows absolute path traversal because the Flas

The ralphjzhang/iasset repository through 2022-05-04 on GitHub allows absolute path traversal because the Flask send_fil

The piaoyunsoft/bt_lnmp repository through 2019-10-10 on GitHub allows absolute path traversal because the Flask send_fi

The longmaoteamtf/audio_aligner_app repository through 2020-01-10 on GitHub allows absolute path traversal because the F

The heidi-luong1109/shackerpanel repository through 2021-05-25 on GitHub allows absolute path traversal because the Flas

The duducosmos/livro_python repository through 2018-06-06 on GitHub allows absolute path traversal because the Flask sen

The deepaliupadhyay/RealEstate repository through 2018-11-30 on GitHub allows absolute path traversal because the Flask

The chainer/chainerrl-visualizer repository through 0.1.1 on GitHub allows absolute path traversal because the Flask sen

The ceee-vip/cockybook repository through 2015-04-16 on GitHub allows absolute path traversal because the Flask send_fil