2022

OMICARD EDM has a hard-coded machine key. An unauthenticated remote attacker can use the machine key to send serialized

OMICARD EDM’s API function has insufficient validation for user input. An unauthenticated remote attacker can inject arb

Authentication Bypass by Primary Weakness in GitHub repository bookwyrm-social/bookwyrm prior to 0.4.5.

GVRET Stable Release as of Aug 15, 2015 was discovered to contain a buffer overflow via the handleConfigCmd function at

This vulnerability allows remote attackers to bypass authentication on affected installations of Vinchin Backup and Reco

This vulnerability allows remote attackers to execute arbitrary code on affected installations of BMC Track-It! 20.21.2.

This vulnerability allows remote attackers to bypass authentication on affected installations of Sante PACS Server 3.0.4

D-LINK DIR-818LW A1:DIR818L_FW105b01 was discovered to contain a remote code execution (RCE) vulnerability via the funct

D-LINK DIR-818LW A1:DIR818L_FW105b01 was discovered to contain a remote code execution (RCE) vulnerability via the funct

D-Link DIR810LA1_FW102B22 was discovered to contain a command injection vulnerability via the Ping_addr function.

In ConnMan through 1.41, remote attackers able to send HTTP requests to the gweb component are able to exploit a heap-ba

In Quest KACE Systems Management Appliance (SMA) through 12.0, a hash collision is possible during authentication. This

A SQL injection vulnerability exists within Quest KACE Systems Management Appliance (SMA) through 12.0 that can allow fo

NextAuth.js is a complete open source authentication solution for Next.js applications. `next-auth` users who are using

EasyUse MailHunter Ultimate’s cookie deserialization function has an inadequate validation vulnerability. Deserializing

Mealie 1.0.0beta3 contains an arbitrary file upload vulnerability which allows attackers to execute arbitrary code via a

This affects all versions of package npos-tesseract. The injection point is located in line 55 in lib/ocr.js.

This affects the package image-tiler before 2.0.2.

This affects all versions of package heroku-env. The injection point is located in lib/get.js which is required by index

This affects all versions of package gitblame. The injection point is located in line 15 in lib/gitblame.js.

This affects all versions of package monorepo-build.

Web Based Quiz System v1.0 was discovered to contain a SQL injection vulnerability via the qid parameter at update.php.

Pligg CMS v2.0.2 was discovered to contain a time-based SQL injection vulnerability via the page_size parameter at load_

Pligg CMS v2.0.2 was discovered to contain a time-based SQL injection vulnerability via the page_size parameter at load_

Pharmacy Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at invoicep

Pharmacy Management System v1.0 was discovered to contain a SQL injection vulnerability via the startDate parameter at g

Pharmacy Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at edituser

Pharmacy Management System v1.0 was discovered to contain a SQL injection vulnerability via the startDate parameter at g

Pharmacy Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at editprod

Pharmacy Management System v1.0 was discovered to contain multiple SQL injection vulnerabilities via the email or passwo

Pharmacy Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at editbran

Pharmacy Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at editcate

Pharmacy Management System v1.0 was discovered to contain a SQL injection vulnerability via the startDate parameter at g

Pharmacy Management System v1.0 was discovered to contain a SQL injection vulnerability via the startDate parameter at g

The foldername parameter in Bolt 5.1.7 was discovered to have incorrect input validation, allowing attackers to perform

fs2 is a compositional, streaming I/O library for Scala. When establishing a server-mode `TLSSocket` using `fs2-io` on N

PrestaShop is an Open Source e-commerce platform. In versions from 1.6.0.10 and before 1.7.8.7 PrestaShop is subject to

Shescape is a simple shell escape package for JavaScript. Affected versions were found to have insufficient escaping of

Improper Authorization in GitHub repository kromitgmbh/titra prior to 0.79.1.

BF-OS version 3.x up to and including 3.83 do not enforce strong passwords which may allow a remote attacker to brute-fo

In httpclient, there is a possible out of bounds write due to uninitialized data. This could lead to remote escalation o

The Simple Membership WordPress plugin before 4.1.3 allows user to change their membership at the registration stage due

The Youzify WordPress plugin before 1.2.0 does not sanitise and escape a parameter before using it in a SQL statement vi

In Realtek eCos RSDK 1.5.7p1 and MSDK 4.9.4p1, the SIP ALG function that rewrites SDP data has a stack-based buffer over

IBM DataPower Gateway 10.0.2.0 through 10.0.4.0, 10.0.1.0 through 10.0.1.8, 10.5.0.0, and 2018.4.1.0 through 2018.4.1.21

EllieGrid Android Application version 3.4.1 is vulnerable to Code Injection. The application appears to evaluate user in

DedeCMS v5.7.95 was discovered to contain a remote code execution (RCE) vulnerability via the component mytag_ main.php.

Hiby R3 PRO firmware v1.5 to v1.7 was discovered to contain a file upload vulnerability via the file upload feature.

Improper Neutralization of Special Elements used in an SQL Command leading to Unauthenticated SQL Injection vulnerabilit

IBM PowerVM VIOS 3.1 could allow a remote attacker to tamper with system configuration or cause a denial of service. IBM