2022

Flower, a web UI for the Celery Python RPC framework, all versions as of 05-02-2022 is vulnerable to an OAuth authentica

libmobi before v0.10 contains a NULL pointer dereference via the component mobi_buffer_getpointer. This vulnerability al

Nginx NJS v0.7.2 was discovered to contain a segmentation violation in the function njs_array_prototype_sort at src/njs_

Nginx NJS v0.7.2 was discovered to contain a segmentation violation in the function njs_value_own_enumerate at src/njs_v

Onlyoffice Document Server v6.0.0 and below and Core 6.1.0.26 and below were discovered to contain a heap overflow via t

Onlyoffice Document Server v6.0.0 and below and Core 6.1.0.26 and below were discovered to contain a stack overflow via

Delta Controls enteliTOUCH 3.40.3935, 3.40.3706, and 3.33.4005 allows attackers to execute arbitrary commands via a craf

A cross-site scripting (XSS) vulnerability in ICT Protege GX/WX v2.08 allows authenticated attackers to execute arbitrar

Delta Controls enteliTOUCH 3.40.3935, 3.40.3706, and 3.33.4005 was discovered to transmit and store sensitive informatio

Delta Controls enteliTOUCH 3.40.3935, 3.40.3706, and 3.33.4005 was discovered to contain a cross-site scripting (XSS) vu

An access control issue in ICT Protege GX/WX 2.08 allows attackers to leak SHA1 password hashes of other users.

USR IOT 4G LTE Industrial Cellular VPN Router v1.0.36 was discovered to contain hard-coded credentials for its highest p

Verizon 4G LTE Network Extender GA4.38 - V0.4.038.2131 utilizes a weak default admin password generation algorithm which

An arbitrary file upload in the image upload component of wityCMS v0.6.2 allows attackers to execute arbitrary code via

LibreNMS v22.3.0 was discovered to contain multiple command injection vulnerabilities via the service_ip, hostname, and

LibreNMS v22.3.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /Table/GraylogCo

Unicorn Engine v2.0.0-rc7 contains memory leaks caused by an incomplete unicorn engine initialization.

Unicorn Engine v2.0.0-rc7 and below was discovered to contain a NULL pointer dereference via qemu_ram_free.

Unicorn Engine v2.0.0-rc7 and below was discovered to contain a memory leak via the function uc_close at /my/unicorn/uc.

Unicorn Engine v1.0.3 was discovered to contain a use-after-free vulnerability via the hook function.

Responsive Online Blog v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at single.php.

OFCMS v1.1.4 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /admin/comn/service/

A cross-site scripting (XSS) vulnerability in Jfinal CMS v5.1.0 allows attackers to execute arbitrary web scripts or HTM

An issue was discovered in MCMS 5.2.7. There is a CSRF vulnerability that can add an administrator account via ms/basic/

A cross-site scripting (XSS) vulnerability in /omps/seller of Online Market Place Site v1.0 allows attackers to execute

An insecure direct object reference (IDOR) in Online Market Place Site v1.0 allows attackers to modify products that are

An arbitrary file upload vulnerability in the Add File function of TPCMS v3.2 allows attackers to execute arbitrary code

Solutions Atlantic Regulatory Reporting System (RRS) v500 is vulnerable to an reflected Cross-Site Scripting (XSS) vulne

resi-calltrace in RESI Gemini-Net 4.2 is affected by Multiple XSS issues. Unauthenticated remote attackers can inject ar

The affected product is vulnerable to an out-of-bounds read via uninitialized pointer, which may allow an attacker to ex

Incorrect Default Permissions vulnerability in ABB e-Design allows attacker to install malicious software executing with

An issue in Webbank WeCube v3.2.2 allows attackers to execute a directory traversal via a crafted ZIP file.

The TikTok application before 23.7.3 for Android allows account takeover. A crafted URL (unvalidated deeplink) can force

Incorrect Default Permissions vulnerability in ABB e-Design allows attacker to install malicious software executing with

The affected product is vulnerable to an out-of-bounds write via uninitialized pointer, which may allow an attacker to e

Hardcoded admin token in SoundBar apps in Linkplay SDK 1.00 allows remote attackers to gain admin privilege access in li

libcurl would reuse a previously created connection even when a TLS or SSHrelated option had been changed that should ha

libcurl provides the `CURLOPT_CERTINFO` option to allow applications torequest details to be returned about a server's c

The curl URL parser wrongly accepts percent-encoded URL separators like '/'when decoding the host name part of a URL, ma

libcurl wrongly allows cookies to be set for Top Level Domains (TLDs) if thehost name is provided with a trailing dot.cu

A use of incorrectly resolved name vulnerability fixed in 7.83.1 might remove the wrong file when `--no-clobber` is used

A insufficiently protected credentials vulnerability in fixed in curl 7.83.0 might leak authentication or cookie header

An information disclosure vulnerability exists in curl 7.65.0 to 7.82.0 are vulnerable that by using an IPv6 address tha

An insufficiently protected credentials vulnerability exists in curl 4.9 to and include curl 7.82.0 are affected that co

The affected product is vulnerable to an out-of-bounds write, which may allow an attacker to execute arbitrary code.

Barco Control Room Management Suite web application, which is part of TransForm N before 3.14, is exposing a URL /checkl

Barco Control Room Management Suite web application, which is part of TransForm N before 3.14, is exposing a license fil

Barco Control Room Management Suite web application, which is part of TransForm N before 3.14, is exposing a license fil

Barco Control Room Management Suite web application, which is part of TransForm N before 3.14, is exposing log files wit

Barco Control Room Management Suite web application, which is part of TransForm N before 3.14, is exposing a file upload