2022

SQL injection exists in LaiKetui v3.5.0 the background administrator list.

Laiketui 3.5.0 is affected by an arbitrary file upload vulnerability that can allow an attacker to execute arbitrary cod

Cross Site Scripting (XSS) vulnerability in sourcecodester School File Management System 1.0 via the Firtstname paramete

Improper Authentication vulnerability in S&D smarthome(smartcare) application can cause authentication bypass and inform

There is no account authentication and permission check logic in the firmware and existing apps of SiHAS's SGW-300, ACM-

Stored XSS and SQL injection vulnerability in MaxBoard could lead to occur Remote Code Execution, which could lead to in

Buffer Over-read in GitHub repository vim/vim prior to 8.2.

In Apache Tomcat 10.1.0-M1 to 10.1.0-M16, 10.0.0-M1 to 10.0.22, 9.0.30 to 9.0.64 and 8.5.50 to 8.5.81 the Form authentic

wire-ios is an iOS client for the Wire secure messaging application. Invalid accent colors of Wire communication partner

A vulnerability was found in File Manager Plugin 3.0.1. It has been classified as problematic. This affects an unknown p

A vulnerability was found in Global Content Blocks Plugin 2.1.5. It has been declared as problematic. This vulnerability

A vulnerability was found in Gwolle Guestbook Plugin 1.7.4. It has been rated as problematic. This issue affects some un

A vulnerability classified as problematic has been found in Atahualpa Theme. Affected is an unknown function. The manipu

A vulnerability, which was classified as problematic, has been found in Alpine PhotoTile for Instagram Plugin 1.2.7.7. A

A vulnerability, which was classified as critical, was found in VaultPress Plugin 1.8.4. This affects an unknown part. T

A vulnerability has been found in Atahualpa Theme and classified as problematic. Affected by this vulnerability is an un

In openlibrary versions deploy-2016-07-0 through deploy-2021-12-22 are vulnerable to Stored XSS.

In openlibrary versions deploy-2016-07-0 through deploy-2021-12-22 are vulnerable to Reflected XSS.

In directus versions v9.0.0-beta.2 through 9.6.0 are vulnerable to server-side request forgery (SSRF) in the media uploa

Apache Sling Commons Log <= 5.4.0 and Apache Sling API <= 2.25.0 are vulnerable to log injection. The ability to forge l

A vulnerability in the logging component of Cisco Adaptive Security Device Manager (ASDM) could allow an authenticated,

In motor-admin versions 0.0.1 through 0.2.56 are vulnerable to host header injection in the password reset functionality

Cross-site Scripting (XSS) - Reflected in GitHub repository microweber/microweber prior to 1.2.18.

In habitica versions v4.119.0 through v4.232.2 are vulnerable to open redirect via the login page.

In habitica versions v4.119.0 through v4.232.2 are vulnerable to DOM XSS via the login page.

A Observable Response Discrepancy vulnerability in spacewalk-java of SUSE Manager Server 4.1, SUSE Manager Server 4.2 al

A Missing Authentication for Critical Function vulnerability in spacewalk-java of SUSE Manager Server 4.1, SUSE Manager

In ERPNext, versions v11.0.0-beta through v13.0.2 are vulnerable to Missing Authorization, in the chat rooms functionali

ERPNext in versions v12.0.9-v13.0.3 are affected by a stored XSS vulnerability that allows low privileged users to store

In ERPNext, versions v12.0.9--v13.0.3 are vulnerable to Stored Cross-Site-Scripting (XSS), due to user input not being v

In ERPNext, versions v13.0.0-beta.13 through v13.30.0 are vulnerable to Stored XSS at the Patient History page which all

A vulnerability has been found in JUNG Smart Visu Server 1.0.804/1.0.830/1.0.832 and classified as critical. Affected by

A vulnerability, which was classified as critical, was found in JUNG Smart Visu Server 1.0.804/1.0.830/1.0.832. Affected

A vulnerability, which was classified as problematic, has been found in JUNG Smart Visu Server 1.0.804/1.0.830/1.0.832.

discourse-chat is a chat plugin for the Discourse application. Versions prior to 0.4 are vulnerable to an exposure of se

OBDA systems’ Mastro 1.0 is vulnerable to XML Entity Expansion (aka “billion laughs”) attack allowing denial of service.

XML eXternal Entity (XXE) in OBDA systems’ Mastro 1.0 allows remote attackers to read system files via custom DTDs.

The GeoAnalytics feature in Qlik Sense April 2020 patch 4 allows SSRF.

IBM QRadar WinCollect Agent 10.0 and 10.0.1 could allow an attacker to obtain sensitive information due to missing best

Comodo Antivirus 12.2.2.8012 has a quarantine flaw that allows privilege escalation. To escalate privilege, a low-privil

A path traversal issue in entry attachments in Devolutions Remote Desktop Manager before 2022.2 allows attackers to crea

An authenticated attacker could read arbitrary files from the underlying operating system of the scanner using a custom

An authenticated attacker could create an audit file that bypasses PowerShell cmdlet checks and executes commands with a

IdeaLMS 2022 allows reflected Cross Site Scripting (XSS) via the IdeaLMS/Class/Assessment/ PATH_INFO.

There is a Cross Site Scripting Stored (XSS) vulnerability in NukeViet CMS before 4.5.02.

In addition to the c_rehash shell command injection identified in CVE-2022-1292, further circumstances where the c_rehas

A maliciously crafted PDF file may be used to dereference a pointer for read or write operation while parsing PDF files

Autodesk AutoCAD product suite, Revit, Design Review and Navisworks releases using PDFTron prior to 9.1.17 version may b

A maliciously crafted TGA file in Autodesk AutoCAD 2023 may be used to write beyond the allocated buffer while parsing T

A maliciously crafted TIFF file in Autodesk AutoCAD 2023 can be forced to read and write beyond allocated boundaries whe