2022

Spip Web Framework v3.1.13 and below was discovered to contain multiple SQL injection vulnerabilities at /ecrire via the

A PHP injection vulnerability in Spip before v3.2.8 allows attackers to execute arbitrary PHP code via the _oups paramet

Multiple cross-site scripting (XSS) vulnerabilities in the component /spip.php of Spip Web Framework v3.1.13 and below a

An issue in the Unmarshal function in Go-Yaml v3 causes the program to crash when attempting to deserialize invalid inpu

An issue in the component ast/parser.go of Open Policy Agent v0.39.0 causes the application to incorrectly interpret eve

An authenticated user with access to the Strapi admin panel can view private and sensitive data, such as email and passw

An authenticated user with access to the Strapi admin panel can view private and sensitive data, such as email and passw

Improper access control in the CI/CD cache mechanism in GitLab CE/EE affecting all versions starting from 1.0.2 before 1

Missing sanitization of data in Pipeline error messages in GitLab CE/EE affecting all versions starting from 1.0.2 befor

Missing input masking in GitLab CE/EE affecting all versions starting from 1.0.2 before 14.8.6, all versions from 14.9.0

The affected ThroughTek P2P products (SDKs using versions before 3.1.5, any versions with nossl tag, device firmware not

Inadequate encryption may allow the credentials used by Emerson OpenEnterprise, up through version 3.3.5, to access fiel

The affected Bachmann Electronic M-Base Controllers of version MSYS v1.06.14 and later use weak cryptography to protect

A malicious attacker could exploit the interface of the Fieldcomm Group HART-IP (release 1.0.0.0) by constructing messag

Successful exploitation of this vulnerability for multiple Mitsubishi Electric Factory Automation Engineering Software P

Authenticated (contributor or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in Opal Hotel Room Booki

Authenticated (administrator or higher role) Local File Inclusion (LFI) vulnerability in Wow-Company's Counter Box plugi

A remote code execution (RCE) vulnerability in Subconverter v0.7.2 allows attackers to execute arbitrary code via crafte

Use After Free in GitHub repository vim/vim prior to 8.2.4979.

IBM Security Identity Governance and Intelligence 5.2.4, 5.2.5, and 5.2.6 could allow a remote attacker to obtain sensit

In spring security versions prior to 5.4.11+, 5.5.7+ , 5.6.4+ and older unsupported versions, RegexRequestMatcher can ea

Spring Security versions 5.5.x prior to 5.5.7, 5.6.x prior to 5.6.4, and earlier unsupported versions contain an integer

JFrog Artifactory prior to 7.31.10, is vulnerable to Broken Access Control where a Project Admin is able to create, edit

GRANDCOM DynWEB before 4.2 contains a SQL Injection vulnerability in the admin login interface. A remote unauthenticated

Improper input validation vulnerability in Mangboard commerce package could lead to occur for abnormal request. A remote

Improper input validation vulnerability in HANDY Groupware’s ActiveX moudle allows attackers to download or execute arbi

Mobotix Control Center (MxCC) through 2.5.4.5 has Insufficiently Protected Credentials, Storing Passwords in a Recoverab

Cross-site Scripting (XSS) - Stored in GitHub repository jgraph/drawio prior to 18.0.4.

An issue was discovered in ShopXO CMS 2.2.0. After entering the management page, there is an arbitrary file upload vulne

Out-of-bounds Write in GitHub repository vim/vim prior to 8.2.4977.

On vulnerable configurations, the named daemon may, in some circumstances, terminate with an assertion failure. Vulnerab

When generating a user invitation code in Octopus Server, the validity of this code can be set for a specific number of

Arm Mali GPU Kernel Driver allows improper GPU operations in Valhall r29p0 through r36p0 before r37p0 to reach a use-aft

Arm Mali GPU Kernel Driver has a use-after-free: Midgard r28p0 through r29p0 before r30p0, Bifrost r17p0 through r23p0 b

Arm Mali GPU Kernel Driver (Midgard r4p0 through r31p0, Bifrost r0p0 through r36p0 before r37p0, and Valhall r19p0 throu

Windows Print Spooler Elevation of Privilege Vulnerability

Hydrogen is a React-based framework for building dynamic, Shopify-powered custom storefronts. There is a potential Cross

CaSS is a Competency and Skills System. CaSS Library, (npm:cassproject) has a missing cryptographic step when storing cr

Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository jgraph/drawio prior to 18.0.7.

Cleartext transmission of sensitive information. The following products are affected: Acronis Cyber Protect 15 (Windows)

Cleartext transmission of sensitive information. The following products are affected: Acronis Cyber Protect 15 (Linux, W

Open redirect via user-controlled query parameter. The following products are affected: Acronis Cyber Protect 15 (Linux,

HTML injection via report name. The following products are affected: Acronis Cyber Protect 15 (Linux, Windows) before bu

Sensitive information disclosure due to insecure folder permissions. The following products are affected: Acronis Cyber

Tenda TX9 Pro V22.03.02.10 is vulnerable to Buffer Overflow via the functtion setIPv6Status() in httpd module.

Uncontrolled Recursion in GitHub repository vim/vim prior to 8.2.4975.

IBM DataPower Gateway 10.0.2.0 through 1.0.3.0, 10.0.1.0 through 10.0.1.5, and 2018.4.1.0 through 2018.4.1.18 is vulnera

A flaw was found in moodle where logic used to count failed login attempts could result in the account lockout threshold

A flaw was found in moodle where an SQL injection risk was identified in Badges code relating to configuring criteria.

A flaw was found in moodle where global search results could include author information on some activities where a user