2022

Improper file permissions in the CommandPost, Collector, and Sensor components of Fidelis Network and Deception enables

Improper file permissions in the CommandPost, Collector, Sensor, and Sandbox components of Fidelis Network and Deception

This broken access control vulnerability pertains specifically to a domain admin who can access configuration & user dat

needrestart 0.8 through 3.5 before 3.6 is prone to local privilege escalation. Regexes to detect the Perl, Python, and R

Remote Code Execution (RCE) in Alexander Stokmann's Code Snippets Extended plugin <= 1.4.7 on WordPress via Cross-Site R

Nextcloud Talk is a video and audio conferencing app for Nextcloud. In versions prior to 13.0.5 and 14.0.0, a call moder

A remote authenticated stored cross-site scripting (xss) vulnerability was discovered in Aruba ClearPass Policy Manager

Classic Buffer Overflow in GitHub repository vim/vim prior to 8.2.4969.

HashiCorp Vault and Vault Enterprise from 1.10.0 to 1.10.2 did not correctly configure and enforce MFA on login after se

Denial of Service (DoS) in the Z-Wave S0 NonceGet protocol specification in Silicon Labs Z-Wave 500 series allows local

A remote authenticated stored cross-site scripting (xss) vulnerability was discovered in Aruba ClearPass Policy Manager

A authenticated remote command injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10

A authenticated remote command injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10

A remote authenticated information disclosure vulnerability was discovered in Aruba ClearPass Policy Manager version(s):

A remote authorization bypass vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and belo

The Workspace client component of TIBCO Software Inc.'s TIBCO BPM Enterprise and TIBCO BPM Enterprise Distribution for T

The REST API component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server - Community Editi

A vulnerability was found in Ignition where ignition configs are accessible from unprivileged containers in VMs running

WBCE CMS 1.5.2 is vulnerable to Cross Site Scripting (XSS) via \admin\pages\sections_save.php namesection2 parameters.

GIMP 2.10.30 and 2.99.10 are vulnerable to Buffer Overflow. Through a crafted XCF file, the program will allocate for a

Improper Update of Reference Count vulnerability in net/sched of Linux Kernel allows local attacker to cause privilege e

IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.5 and 6.1.0.0 through 6.1.1.0 could allow an authenti

IBM WebSphere Application Server Liberty and Open Liberty 17.0.0.3 through 22.0.0.5 are vulnerable to identity spoofing

Buffer Over-read in GitHub repository vim/vim prior to 8.2.4974.

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.4968.

Integer Overflow or Wraparound vulnerability in io_uring of Linux Kernel allows local attacker to cause memory corruptio

IBM DataPower Gateway 10.0.2.0, 10.0.3.0, 10.0.1.0 through 10.0.1.4, and 2018.4.1.0 through 2018.4.1.17 could allow a re

IBM Sterling Secure Proxy 6.0.3 and IBM Secure External Authentication Server 6.0.3 does not properly ensure that a cert

IBM DataPower Gateway 10.0.1.0 through 10.0.1.4 and 2018.4.1.0 through 2018.4.1.17 could allow a remote user to cause a

WBCE CMS 1.5.2 is vulnerable to Cross Site Scripting (XSS) via /admin/users/save.php.

GXCMS V1.5 has a file upload vulnerability in the background. The vulnerability is the template management page. You can

FlyteConsole is the web user interface for the Flyte platform. FlyteConsole prior to version 0.52.0 is vulnerable to ser

The Skyoftech So Listing Tabs module 2.2.0 for OpenCart allows a remote attacker to inject a serialized PHP object via t

IBM Spectrum Protect Operations Center 8.1.12 and 8.1.13 could allow a local attacker to obtain sensitive information, c

IBM Security Identity Governance and Intelligence 5.2.6 could disclose sensitive information in URL parameters that coul

A cross-site request forgery (CSRF) vulnerability in Jenkins Storable Configs Plugin 1.0 and earlier allows attackers to

Jenkins Storable Configs Plugin 1.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) a

Jenkins Autocomplete Parameter Plugin 1.1 and earlier references Dropdown Autocomplete parameter and Auto Complete Strin

A cross-site request forgery (CSRF) vulnerability in Jenkins Autocomplete Parameter Plugin 1.1 and earlier allows attack

Jenkins vboxwrapper Plugin 1.3 and earlier does not escape the name and description of VBox node parameters on views dis

Jenkins Selection tasks Plugin 1.0 and earlier does not escape the name and description of Script Selection task variabl

Jenkins Random String Parameter Plugin 1.0 and earlier does not escape the name and description of Random String paramet

Jenkins Promoted Builds (Simple) Plugin 1.9 and earlier does not escape the name and description of Promotion Level para

Jenkins Multiselect parameter Plugin 1.3 and earlier does not escape the name and description of Multiselect parameters

Jenkins JDK Parameter Plugin 1.0 and earlier does not escape the name and description of JDK parameters on views display

Jenkins Global Variable String Parameter Plugin 1.2 and earlier does not escape the name and description of Global Varia

Jenkins Autocomplete Parameter Plugin 1.1 and earlier does not escape the name of Dropdown Autocomplete and Auto Complet

Jenkins Application Detector Plugin 1.0.8 and earlier does not escape the name of Chois Application Version parameters o

A missing permission check in Jenkins SSH Plugin 2.6.1 and earlier allows attackers with Overall/Read permission to conn

A cross-site request forgery (CSRF) vulnerability in Jenkins SSH Plugin 2.6.1 and earlier allows attackers to connect to