2022

Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the id paramete

Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the id paramete

Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the id paramete

An arbitrary file upload vulnerability in add_product.php of Restaurant POS System v1.0 allows attackers to execute arbi

An arbitrary file upload vulnerability in admin-add-vehicle.php of Vehicle Booking System v1.0 allows attackers to execu

Fast Food Ordering System v1.0 was discovered to contain a SQL injection vulnerability via the component /fastfood/purch

x86: unintended memory sharing between guests On Intel systems that support the "virtualize APIC accesses" feature, a gu

Xenstore: Guests can get access to Xenstore nodes of deleted domains Access rights of Xenstore nodes are per domid. When

Xenstore: Guests can crash xenstored Due to a bug in the fix of XSA-115 a malicious guest can cause xenstored to use a w

If Apache Tomcat 8.5.0 to 8.5.82, 9.0.0-M1 to 9.0.67, 10.0.0-M1 to 10.0.26 or 10.1.0-M1 to 10.1.0 was configured to igno

An Improper Access Control vulnerability in the bdservicehost.exe component, as used in Bitdefender Engines for Windows,

The package muhammara before 2.6.1, from 3.0.0 and before 3.1.1; all versions of package hummus are vulnerable to Denial

The package muhammara before 2.6.0; all versions of package hummus are vulnerable to Denial of Service (DoS) when PDFStr

Out of bounds write in V8 in Google Chrome prior to 106.0.5249.91 allowed a remote attacker to perform an out of bounds

Use after free in Custom Elements in Google Chrome prior to 106.0.5249.91 allowed a remote attacker to potentially explo

Sanitization Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /php

Sanitization Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /adm

Sanitization Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /adm

Oracle Solaris version 10 1/13, when using the Common Desktop Environment (CDE), is vulnerable to a privilege escalation

The application was identified to have an CSV injection in data export functionality, allowing for malicious code to be

The application was vulnerable to Cross-Site Request Forgery (CSRF) attacks, allowing an attacker to coerce users into

SAUTER Controls moduWeb firmware version 2.7.1 is vulnerable to reflective cross-site scripting (XSS). The web applicati

The application was vulnerable to multiple instances of SQL injection (authenticated and unauthenticated) through a vul

Multiple instances of XSS (stored and reflected) was found in the application. For example, features such as student as

Broken access controls on PDFtron data in M-Files Hubshare before 3.3.11.3 allows unauthenticated attackers to access r

Improper input validation and output encoding in all comments fields, in M-Files Hubshare before 3.3.10.9 allows auth

Javascript injection in PDFtron in M-Files Hubshare before 3.3.10.9 allows authenticated attackers to perform an accoun

Forma LMS on its 3.1.0 version and earlier is vulnerable to a SQL injection vulnerability. The exploitation of this vuln

Forma LMS on its 3.1.0 version and earlier is vulnerable to a SQL injection vulnerability. The exploitation of this vuln

Delta Electronics InfraSuite Device Master versions 00.00.01a and prior deserialize network packets without proper veri

Delta Electronics InfraSuite Device Master versions 00.00.01a and prior allow unauthenticated users to trigger the Writ

Forma LMS on its 3.1.0 version and earlier is vulnerable to a SQL injection vulnerability. The exploitation of this vuln

Delta Electronics InfraSuite Device Master versions 00.00.01a and prior lacks authentication for a function that chan

Delta Electronics InfraSuite Device Master versions 00.00.01a and prior allow unauthenticated users to access the aprun

Spring Security, versions 5.7 prior to 5.7.5, and 5.6 prior to 5.6.9, and older unsupported versions could be susceptibl

The Zoom Client for Meetings (for Android, iOS, Linux, macOS, and Windows) before version 5.12.2 is susceptible to a URL

conduit-hyper integrates a conduit application with the hyper server. Prior to version 0.4.2, `conduit-hyper` did not ch

The denial-of-service can be triggered by transmitting a carefully crafted CAN frame on the same CAN network as the vuln

The Customizer Export/Import WordPress plugin before 0.9.5 unserializes the content of an imported file, which could lea

The Ocean Extra WordPress plugin before 2.0.5 unserialises the content of an imported file, which could lead to PHP obje

The PublishPress Capabilities WordPress plugin before 2.5.2, PublishPress Capabilities Pro WordPress plugin before 2.5.2

The LearnPress WordPress plugin before 4.1.7.2 unserialises user input in a REST API endpoint available to unauthenticat

The Smart Slider 3 WordPress plugin before 3.5.1.11 unserialises the content of an imported file, which could lead to PH

The Easy WP SMTP WordPress plugin before 1.5.0 unserialises the content of an imported file, which could lead to PHP obj

A Regular Expression Denial of Service (ReDoS) flaw was found in kangax html-minifier 4.0.0 because of the reCustomIgnor

A remote, unauthenticated, directory traversal vulnerability was identified within the web interface used by IND780 Adva

strongSwan before 5.9.8 allows remote attackers to cause a denial of service in the revocation plugin by sending a craft

In Total.js 4 before 0e5ace7, /api/common/ping can achieve remote command execution via shell metacharacters in the host

curl before 7.86.0 has a double free. If curl is told to use an HTTP proxy for a transfer with a non-HTTP(S) URL, it set

multipath-tools 0.7.0 through 0.9.x before 0.9.2 allows local users to obtain root access, as exploited alone or in conj