2022

A cross-site scripting (XSS) vulnerability in Known v1.2.2+2020061101 allows authenticated attackers to execute arbitrar

Known v1.3.1 was discovered to contain an Insecure Direct Object Reference (IDOR).

In Eclipse p2, installable units are able to alter the Eclipse Platform installation and the local machine via touchpoin

A privilege escalation flaw was found in the token exchange feature of keycloak. Missing authorization allows a client a

An arbitrary file upload vulnerability in the Select User function under the People Menu component of Snipe-IT v6.0.2 al

An arbitrary file upload vulnerability in the Update Branding Settings component of Snipe-IT v6.0.2 allows attackers to

Cloud Mobility for Dell EMC Storage, 1.3.0.XXX contains a RCE vulnerability. A non-privileged user could potentially exp

Dell PowerProtect Cyber Recovery, versions prior to 19.11, contain a privilege escalation vulnerability on virtual appli

AdminLTE is a Pi-hole Dashboard for stats and configuration. In affected versions inserting code like `<script>alert("XS

In Eclipse Jetty versions 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, SslConnection does not release ByteBuffer

In Eclipse Jetty HTTP/2 server implementation, when encountering an invalid HTTP/2 request, the error handling has a bug

In Eclipse Jetty versions 9.4.0 thru 9.4.46, and 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, the parsing of the

In Eclipse Lyo versions 1.0.0 to 4.1.0, a TransformerFactory is initialized with the defaults that do not restrict DTD l

SQL Injection vulnerability in product_admin.php in atoms183 CMS 1.0, allows attackers to execute arbitrary commands via

File upload vulnerability in GFI Mail Archiver versions up to and including 15.1 via insecure implementation of Telerik

Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability

Wavlink WL-WN575A3 RPT75A3.V4300.201217 was discovered to contain a command injection vulnerability via the function obt

Magnolia CMS v6.2.19 was discovered to contain a cross-site scripting (XSS) vulnerability via the Edit Contact function.

TOTOLINK EX300_V2 V4.0.3c.7484 was discovered to contain a command injection vulnerability via the langType parameter in

An infinite loop in the function httpRpmPass of TP-Link TL-WR741N/TL-WR742N V1/V2/V3_130415 allows attackers to cause a

Online Accreditation Management v1.0 was discovered to contain a SQL injection vulnerability via the USERNAME parameter

Inout Homestay v2.2 was discovered to contain a SQL injection vulnerability via the guests parameter at /index.php?page=

Tenda AC10 US_AC10V1.0RTL_V15.03.06.26_multi_TD01 was discovered to contain a remote code execution (RCE) vulnerability

In Apache Druid 0.22.1 and earlier, the server did not set appropriate headers to prevent clickjacking. Druid 0.23.0 and

In Apache Druid 0.22.1 and earlier, certain specially-crafted links result in unescaped URL parameters being sent back i

An issue was discovered in glFTPd 2.11a that allows remote attackers to cause a denial of service via exceeding the conn

The Google Login Plugin (versions 1.0 and 1.1) allows malicious anonymous users to authenticate successfully against Jen

Bookwyrm is an open source social reading and reviewing program. Versions of Bookwyrm prior to 0.4.1 did not properly sa

Akashi is an open source server implementation of the Attorney Online video game based on the Ace Attorney universe. Aff

HumHub is an Open Source Enterprise Social Network. Affected versions of HumHub are vulnerable to a stored Cross-Site Sc

Hyperledger Fabric is a permissioned distributed ledger framework. In affected versions if a consensus client sends a ma

Check Point Endpoint before version E86.50 failed to protect against specific registry change which allowed to disable e

Symantec Advanced Secure Gateway (ASG) and ProxySG are susceptible to an HTTP desync vulnerability. When a remote unauth

It was discovered that the IcedTea-Web used codebase attribute of the <applet> tag on the HTML page that hosts Java appl

A memory corruption in Hex Rays Ida Pro v6.6 allows attackers to cause a Denial of Service (DoS) via a crafted file. Rel

When curl < 7.84.0 does FTP transfers secured by krb5, it handles message verification failures wrongly. This flaw makes

When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the

curl < 7.84.0 supports "chained" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple t

A malicious server can serve excessive amounts of `Set-Cookie:` headers in a HTTP response to curl and curl < 7.84.0 sto

Codoforum v5.1 was discovered to contain an arbitrary file upload vulnerability via the logo change option in the admin

In Openshift Origin 3 the cookies being set in console have no 'secure', 'HttpOnly' attributes.

In nextgen-galery wordpress plugin before 2.0.77.3 there are two vulnerabilities which can allow an attacker to gain ful

In nextgen-galery wordpress plugin before 2.0.77.3 there are two vulnerabilities which can allow an attacker to gain ful

EQS Integrity Line Professional through 2022-07-01 allows a stored XSS via a crafted whistleblower entry.

Incorrect permission management in Devolutions Server before 2022.2 allows a new user with a preexisting username to inh

Command injection vulnerability in CWP v0.9.8.1126 that allows normal users to run commands as the root user.

The password reset token in CWP v0.9.8.1126 is generated using known or predictable values.

A path traversal vulnerability in loader.php of CWP v0.9.8.1122 allows attackers to execute arbitrary code via a crafted

The Appfire Jira Misc Custom Fields (JMCF) app 2.4.6 for Atlassian Jira allows XSS via a crafted project name to the Add

Cross-site Scripting (XSS) - Stored in GitHub repository outline/outline prior to v0.64.4.