2022

app/models/user.rb in Mastodon before 3.5.0 allows a bypass of e-mail restrictions.

mysiteforme v2.2.1 was discovered to contain a Server-Side Request Forgery.

imgurl v2.31 was discovered to contain a Blind SQL injection vulnerability via /upload/localhost.

A downgrade from two-factor authentication to one-factor authentication vulnerability in the CGI program of Zyxel USG/Zy

A cross-site scripting vulnerability was identified in the CGI program of Zyxel USG/ZyWALL series firmware versions 4.35

Totolink A3600R V4.1.2cu.5182_B20201102 was discovered to contain a stacker overflow in the fread function at infostat.c

In Simple Food Website 1.0, a moderation can put the Cross Site Scripting Payload in any of the fields on http://127.0.0

Xampp for Windows v8.1.4 and below was discovered to contain insecure permissions for its install directory, allowing at

A Cross-Site Request Forgery (CSRF) in XXL-Job v2.3.0 allows attackers to arbitrarily create administrator accounts via

Insecure permissions in the install directories and binaries of Dev-CPP v4.9.9.2 allows attackers to execute arbitrary c

Inout Blockchain AltExchanger 1.2.1 allows index.php/home/about inoutio_language cookie SQL injection.

Inout Blockchain AltExchanger 1.2.1 allows index.php/coins/update_marketboxslider marketcurrency SQL injection.

Inout Blockchain AltExchanger 1.2.1 and Inout Blockchain FiatExchanger 2.2.1 allow Chart/TradingView/chart_content/maste

Windows OS can be configured to overlay a “language bar” on top of any application. When this OS functionality is enable

Successful exploitation of this vulnerability on Claroty Secure Remote Access (SRA) Site versions 3.0 through 3.2 allows

A DLL hijacking vulnerability in the installed for Quick Heal Total Security prior to 12.1.1.27 allows a local attacker

Time of Check - Time of Use (TOCTOU) vulnerability in Quick Heal Total Security prior to 12.1.1.27 allows a local attack

The Simple Blog plugin in Wondercms 3.4.1 is vulnerable to stored cross-site scripting (XSS) vulnerability. When any use

Annke N48PBB (Network Video Recorder) products of version 3.4.106 build 200422 and prior are vulnerable to a stack-based

The affected Cognex product, the In-Sight OPC Server versions v5.7.4 (96) and prior, deserializes untrusted data, which

Certain EMCO Software products are affected by: CWE-494: Download of Code Without Integrity Check. This affects MSI Pack

Rescue Dispatch Management System 1.0 suffers from Stored XSS, leading to admin account takeover via cookie stealing.

Rescue Dispatch Management System 1.0 is vulnerable to Incorrect Access Control via http://localhost/rdms/admin/?page=sy

Lumidek Associates Simple Food Website 1.0 is vulnerable to Cross Site Request Forgery (CSRF) which allows anyone to tak

Multiple cross-site scripting (XSS) vulnerabilities in the component /obcs/user/profile.php of Online Birth Certificate

Diary Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Name parameter

D-Link DSL-G2452DG HW:T1\\tFW:ME_2.00 was discovered to contain insecure permissions.

Unrestricted Upload of File with Dangerous Type in GitHub repository publify/publify prior to 9.2.9.

In Tipask < 3.5.9, path parameters entered by the user are not validated when downloading attachments, a registered user

Xlight FTP v3.9.3.2 was discovered to contain a stack-based buffer overflow which allows attackers to leak sensitive inf

CSZCMS v1.3.0 allows attackers to execute a Server-Side Request Forgery (SSRF) which can be leveraged to leak sensitive

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NetDataSoft DivvyD

A vulnerability, which was classified as problematic, was found in Badminton Center Management System. This affects the

A vulnerability, which was classified as problematic, has been found in Zoo Management System 1.0. Affected by this issu

Authorization Bypass Through User-Controlled Key in GitHub repository publify/publify prior to 9.2.9.

In Apache Maven maven-shared-utils prior to version 3.3.3, the Commandline class can emit double-quoted strings without

Multiple Denial-of-Service vulnerabilities was discovered in the F-Secure Atlant and in certain WithSecure products whil

Cross-site Scripting (XSS) - Reflected in GitHub repository collectiveaccess/providence prior to 1.8.

A heap buffer overflow was discovered in copy_bytes in decode_r2007.c in dwgread before 0.12.4 via a crafted dwg file.

A heap buffer overflow was discovered in copy_compressed_bytes in decode_r2007.c in dwgread before 0.12.4 via a crafted

The Curtain WordPress plugin through 1.0.2 does not sanitise and escape some of its settings, which could allow high pri

The Check & Log Email WordPress plugin before 1.0.6 does not sanitise and escape a parameter before outputting it back i

The Sliderby10Web WordPress plugin before 1.2.52 does not properly sanitize and escape some of its settings, which could

The Tabs WordPress plugin before 2.2.8 does not sanitise and escape Tab descriptions, which could allow high privileged

The Donate Extra WordPress plugin through 2.02 does not sanitise and escape a parameter before outputting it back in the

The Gwyn's Imagemap Selector WordPress plugin through 0.3.3 does not sanitise and escape some parameters before outputti

The Domain Replace WordPress plugin through 1.3.8 does not sanitise and escape a parameter before outputting it back in

The Turn off all comments WordPress plugin through 1.0 does not sanitise and escape the rows parameter before outputting

The WP Meta SEO WordPress plugin before 4.4.7 does not sanitise or escape the breadcrumb separator before outputting it

The WP Contacts Manager WordPress plugin through 2.2.4 fails to properly sanitize user supplied POST data before it is b