2022

IBM Jazz Team Server 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 is vulnerable to server-side request forgery (SSRF). This may

IBM Jazz Team Server 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 could allow a remote attacker to obtain sensitive information

IBM Robotic Process Automation 21.0.1 and 21.0.2 could allow a user with psychical access to the system to obtain sensit

IBM CICS TX Standard and Advanced 11.1 could allow a remote attacker to execute arbitrary commands on the system by send

Missing access control in the backup system of Telesoft VitalPBX before 3.2.1 allows attackers to access the PJSIP and S

BigBlueButton version 2.4.7 (or earlier) is vulnerable to stored Cross-Site Scripting (XSS) in the private chat function

IBM Robotic Process Automation 21.0.1 and 21.0.2 is vulnerable to cross-site scripting. This vulnerability allows users

A vulnerability in the packaging of Cisco Adaptive Security Device Manager (ASDM) images and the validation of those ima

A vulnerability in the CLI parser of Cisco FirePOWER Software for Adaptive Security Appliance (ASA) FirePOWER module cou

IBM Planning Analytics 2.0 and IBM Cognos Analytics 11.2.1, 11.2.0, and 11.1.7 are vulnerable to cross-site scripting. T

IBM Cognos Analytics 11.2.1, 11.2.0, and 11.1.7 could allow a remote attacker to upload arbitrary files, caused by impro

IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 could allow a low level user to obtain sensitive information from the de

A local privilege escalation vulnerability was identified within the "luminati_net_updater_win_eagleget_com" service in

# Possible XSS Vulnerability in Rails::Html::SanitizerThere is a possible XSS vulnerability with certain configurations

XSS in /dashboard/blocks/stacks/view_details/ - old browsers only. When using an older browser with built-in XSS protect

XSS in /dashboard/reports/logs/view - old browsers only. When using Internet Explorer with the XSS protection disabled,

Title for CVE: XSS in /dashboard/system/express/entities/forms/save_control/[GUID]: old browsers only.Description: When

Concrete 8.5.7 and below as well as Concrete 9.0 through 9.0.2 allow traversal in /index.php/ccm/system/file/upload whic

OFFIS DCMTK's (All versions prior to 3.6.7) has a NULL pointer dereference vulnerability while processing DICOM files, w

OFFIS DCMTK's (All versions prior to 3.6.7) service class user (SCU) is vulnerable to relative path traversal, allowing

OFFIS DCMTK's (All versions prior to 3.6.7) service class provider (SCP) is vulnerable to path traversal, allowing an at

Client-side JavaScript controls may be bypassed to change user credentials and permissions without authentication, inclu

The www-data (Apache web server) account is configured to run sudo with no password for many commands (including /bin/sh

An attacker with weak credentials could access the TCP port via an open FTP port, allowing an attacker to read sensitive

Controls limiting uploads to certain file extensions may be bypassed. This could allow an attacker to intercept the init

A remote authentication bypass vulnerability was discovered in HPE Cray Legacy Shasta System Solutions; HPE Slingshot; a

A potential security vulnerability has been identified in the installer of HPE Version Control Repository Manager. The v

SysAid - Okta SSO integration - was found vulnerable to XML External Entity Injection vulnerability. Any SysAid environm

Concrete CMS Versions 9.0.0 through 9.0.2 and 8.5.7 and below can download zip files over HTTP and execute code from tho

The authentication mechanism used by voters to activate a voting session on the tested version of Dominion Voting System

The authentication mechanism used by poll workers to administer voting using the tested version of Dominion Voting Syste

The authentication mechanism used by technicians on the tested version of Dominion Voting Systems ImageCast X is suscept

Applications on the tested version of Dominion Voting Systems ImageCast X can execute code with elevated privileges by e

The tested version of Dominion Voting System ImageCast X can be manipulated to cause arbitrary code execution by special

The tested version of Dominion Voting Systems ImageCast X allows for rebooting into Android Safe Mode, which allows an a

The tested version of Dominion Voting Systems ImageCast X has a Terminal Emulator application which could be leveraged b

The tested version of Dominion Voting Systems ImageCast X’s on-screen application hash display feature, audit log export

The tested version of Dominion Voting Systems ImageCast X does not validate application signatures to a trusted root cer

Weak default root user credentials allow remote attackers to easily obtain OS superuser privileges over the open TCP por

Client-side JavaScript controls may be bypassed by directly running a JS function to reboot the PLC (e.g., from the brow

The default password for the web application’s root user (the vendor’s private account) was weak and the MD5 hash was us

LRM version 2.4 and lower does not implement TLS encryption. A malicious actor can MITM attack sensitive data in-transit

LRM does not implement authentication or authorization by default. A malicious actor can inject, replay, modify, and/or

LRM does not restrict the types of files that can be uploaded to the affected product. A malicious actor can upload any

LRM contains a directory traversal vulnerability that can allow a malicious actor to upload outside the intended directo

LRM utilizes elevated privileges. An unauthenticated malicious actor can upload and execute code remotely at the operati

A malicious authenticated SMG administrator user can obtain passwords for external LDAP/Active Directory servers that th

In WordPress Plugin User Photo 0.9.4, when a photo is uploaded, it is only partially validated and it is possible to upl

In OpenCart 1.4.7 to 1.5.5.1, implemented anti-traversal code in filemanager.php is ineffective and can be bypassed.

An issue in gimp_layer_invalidate_boundary of GNOME GIMP 2.10.30 allows attackers to trigger an unhandled exception via