2022

A stored cross-site scripting (XSS) vulnerability in the Add Classification function of Zoo Management System v1.0 allow

UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. In versions prior to 5.4.0

UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Affected versions were fou

Nextcloud server is an open source personal cloud server. Affected versions were found to be vulnerable to SMTP command

Taocms 3.0.2 was discovered to contain a blind SQL injection vulnerability via the function Edit category.

Reflected Cross Site Scripting (XSS) vulnerabilities in AST Agent Time Sheet interface (/vicidial/AST_agent_time_sheet.p

SQL Injection vulnerability in User Stats interface (/vicidial/user_stats.php) of VICIdial via the file_download paramet

SQL Injection vulnerability in AST Agent Time Sheet interface ((/vicidial/AST_agent_time_sheet.php) of VICIdial via the

SQL Injection vulnerability in admin interface (/vicidial/admin.php) of VICIdial via modify_email_accounts, access_recor

IBM App Connect Enterprise Certified Container 4.2 could allow a user from the administration console to cause a denial

The leafInfo.match() function in Beego v2.0.3 and below uses path.join() to deal with wildcardvalues which can lead to c

An Access Control vulnerability exists in Nacos 2.0.3 in the access prompt page; enter username and password, click on l

Arm guests can cause Dom0 DoS via PV devices When mapping pages of guests on Arm, dom0 is using an rbtree to keep track

network backend may cause Linux netfront to use freed SKBs While adding logic to support XDP (eXpress Data Path), a code

Linux disk/nic frontends data leaks T[his CNA information record relates to multiple CVEs; the text explains which aspec

Linux disk/nic frontends data leaks T[his CNA information record relates to multiple CVEs; the text explains which aspec

Linux disk/nic frontends data leaks T[his CNA information record relates to multiple CVEs; the text explains which aspec

In OpenCTI through 5.2.4, a broken access control vulnerability has been identified in the profile endpoint. An attacker

Stack-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.

Linux disk/nic frontends data leaks T[his CNA information record relates to multiple CVEs; the text explains which aspec

A stored Cross-site Scripting (XSS) vulnerability was identified in the Data Import functionality of OpenCTI through 5.2

ASUS RT-A88U 3.0.0.4.386_45898 is vulnerable to Cross Site Scripting (XSS). The ASUS router admin panel does not sanitiz

AES OCB mode for 32-bit x86 platforms using the AES-NI assembly optimised implementation will not encrypt the entirety o

NULL Pointer Dereference allows attackers to cause a denial of service (or application crash). This only applies when lx

Old session tokens can be used to authenticate to the application and send authenticated requests.

An issue was discovered in the Linux kernel through 5.18.9. A type confusion bug in nft_set_elem_init (leading to a buff

Zoho ManageEngine ADSelfService Plus before 6203 allows a denial of service (application restart) via a crafted payload

NVIDIA DGX A100 contains a vulnerability in SBIOS in the IpSecDxe, where a user with high privileges and preconditioned

NVIDIA DGX A100 contains a vulnerability in SBIOS in the IpSecDxe, where a user with elevated privileges and a precondit

NVIDIA DGX A100 contains a vulnerability in SBIOS in the SmbiosPei, which may allow a highly privileged local attacker t

NVIDIA DGX A100 contains a vulnerability in SBIOS in the SmmCore, where a user with high privileges can chain another vu

NVIDIA DGX A100 contains a vulnerability in SBIOS in the Ofbd, where a local user with elevated privileges can cause acc

An issue was discovered in Django 3.2 before 3.2.14 and 4.0 before 4.0.6. The Trunc() and Extract() database functions a

The findOne function in TypeORM before 0.3.0 can either be supplied with a string or a FindOneOptions object. When input

The Import any XML or CSV File to WordPress plugin before 3.6.8 accepts all zip files and automatically extracts the zip

The WP Championship WordPress plugin before 9.3 is lacking CSRF checks in various places, allowing attackers to make a l

The Gallery WordPress plugin before 2.0.0 does not sanitise and escape a parameter before outputting it back in the resp

The WP Contact Slider WordPress plugin before 2.4.7 does not sanitize and escape the Text to Display settings of sliders

The Redirection for Contact Form 7 WordPress plugin before 2.5.0 does not escape a link generated before outputting it i

The Ninja Forms Contact Form WordPress plugin before 3.6.10 does not sanitize and escape some imported data, allowing hi

The Ninja Forms Contact Form WordPress plugin before 3.6.10 does not sanitise and escape field labels, allowing high pri

Buffer Over-read in GitHub repository hpjansson/chafa prior to 1.10.3.

Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.2.19.

Improper input validation vulnerability in Space of Cybozu Garoon 4.0.0 to 5.5.1 allows a remote authenticated attacker

Cross-site scripting vulnerability in Scheduler of Cybozu Garoon 4.10.0 to 5.5.1 allows a remote authenticated attacker

Operation restriction bypass vulnerability in Space of Cybozu Garoon 4.0.0 to 5.9.0 allows a remote authenticated attack

Browse restriction bypass vulnerability in Bulletin of Cybozu Garoon allows a remote authenticated attacker to obtain th

Address information disclosure vulnerability in Cybozu Garoon 4.2.0 to 5.5.1 allows a remote authenticated attacker to o

Operation restriction bypass vulnerability in Bulletin of Cybozu Garoon 4.0.0 to 5.5.1 allow a remote authenticated atta

Improper authentication vulnerability in Scheduler of Cybozu Garoon 4.10.0 to 5.5.1 allows a remote attacker to obtain s