2022

In Real Player 20.0.8.310, there is a DCP:// URI Remote Arbitrary Code Execution Vulnerability. This is an internal URL

In Real Player 20.0.7.309 and 20.0.8.310, external::Import() allows download of arbitrary file types and Directory Trave

In Real Player 20.0.8.310, the G2 Control allows injection of unsafe javascript: URIs in local HTTP error pages (display

StarWind SAN and NAS v0.2 build 1914 allow remote code execution. A flaw was found in REST API in StarWind Stack. REST c

qDecoder before 12.1.0 does not ensure that the percent character is followed by two hex digits for URL decoding.

adbyby v2.7 allows external users to make connections via port 8118. This can cause a program logic error and lead to a

A CWE-287: Improper Authentication vulnerability exists that could allow an attacker to take over the admin account when

A CWE-311: Missing Encryption of Sensitive Data vulnerability exists that could allow authentication credentials to be r

A CWE-669: Incorrect Resource Transfer Between Spheres vulnerability exists that could allow unauthorized access when an

A CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that could allow unauthorized

A CWE-798: Use of Hard-coded Credentials vulnerability exists that could allow arbitrary code to be executed when root l

A CWE-20: Improper Input Validation vulnerability exists that could allow the product to be maliciously manipulated when

A CWE-20: Improper Input Validation vulnerability exists that could cause potential remote code execution when an attack

eG Agent before 7.2 has weak file permissions that enable escalation of privileges to SYSTEM.

Owl Labs Meeting Owl 5.2.0.15 does not require a password for Bluetooth commands, because only client-side authenticatio

Owl Labs Meeting Owl 5.2.0.15 allows attackers to control the device via a backdoor password (derived from the serial nu

Owl Labs Meeting Owl 5.2.0.15 allows attackers to deactivate the passcode protection mechanism via a certain c 11 messag

Owl Labs Meeting Owl 5.2.0.15 allows attackers to activate Tethering Mode with hard-coded hoothoot credentials via a cer

Owl Labs Meeting Owl 5.2.0.15 allows attackers to retrieve the passcode hash via a certain c 10 value over Bluetooth.

net/netfilter/nf_tables_api.c in the Linux kernel through 5.18.1 allows a local user (able to create user/net namespaces

Caddy v2.4 was discovered to contain an open redirect vulnerability. A remote unauthenticated attacker may exploit this

Dell Unity, Dell UnityVSA, and Dell Unity XT versions prior to 5.2.0.0.5.173 contain a plain-text password storage vulne

Dell Unity, Dell UnityVSA, and Dell Unity XT versions before 5.2.0.0.5.173 do not restrict excessive authentication atte

Dell PowerStore versions 2.0.0.x, 2.0.1.x and 2.1.0.x contains an open port vulnerability. A remote unauthenticated atta

Dell EMC PowerStore versions 2.0.0.x, 2.0.1.x, and 2.1.0.x are vulnerable to a command injection flaw. An authenticated

PowerStore SW v2.1.1.0 supports the option to export data to either a CSV or an XLSX file. The data is taken as is, with

Dell PowerStore Versions before v2.1.1.0. contains a Stored Cross-Site Scripting vulnerability. A high privileged networ

PowerStore contains Plain-Text Password Storage Vulnerability in PowerStore X & T environments running versions 2.0.0.x

Dell PowerStore contains an Uncontrolled Resource Consumption Vulnerability in PowerStore User Interface. A remote unaut

TOTOLINK EX1200T V4.1.2cu.5215 contains a denial of service vulnerability in function RebootSystem of the file lib/cste_

An argument injection vulnerability in Dragonfly Ruby Gem v1.3.0 allows attackers to read and write arbitrary files when

richdocuments is the repository for NextCloud Collabra, the app for Nextcloud Office collaboration. Prior to versions 6.

TOTOLINK EX1200T V4.1.2cu.5215 contains a remote command injection vulnerability in the function setDiagnosisCfg of the

Car Rental Management System v1.0 is vulnerable to Arbitrary code execution via car-rental-management-system/admin/ajax.

Play Framework is a web framework for Java and Scala. Verions prior to 2.8.16 are vulnerable to generation of error mess

Multiple cross-site scripting (XSS) vulnerabilities in Neos CMS allow attackers with the editor role or higher to inject

BrowsBox CMS v4.0 was discovered to contain a SQL injection vulnerability.

Solutions Atlantic Regulatory Reporting System (RRS) v500 is vulnerable to Local File Inclusion (LFI). Any authenticated

Percona XtraBackup 2.4.20 unintentionally writes the command line to any resulting backup file output. This may include

BigBlueButton Greenlight 2.11.1 allows XSS. A threat actor could have a username containing a JavaScript payload. The pa

Improper Input Validation vulnerability in Mitsubishi Electric MELSEC-Q Series QJ71E71-100 first 5 digits of serial numb

Uncontrolled resource consumption in Mattermost version 6.6.0 and earlier allows an authenticated attacker to crash the

A vulnerability was found in SourceCodester Product Show Room Site 1.0. It has been rated as problematic. This issue aff

A vulnerability was found in SourceCodester Product Show Room Site 1.0. It has been declared as problematic. This vulner

Keep My Notes v1.80.147 allows an attacker with physical access to the victim's device to bypass the application's passw

NetScout nGeniusONE 6.3.2 allows Java RMI Code Execution.

NetScout nGeniusONE 6.3.2 allows Arbitrary File Upload by a privileged user.

NetScout nGeniusONE 6.3.2 allows an XML External Entity (XXE) attack.

bbs-go <= 3.3.0 including Custom Edition is vulnerable to stored XSS.

Play Framework is a web framework for Java and Scala. A denial of service vulnerability has been discovered in verions 2