2022

Discourse is the an open source discussion platform. In some rare cases users redeeming an invitation can be added as a

The Nintex Workflow plugin 5.2.2.30 for SharePoint allows XSS.

Information Exposure Through Log Files vulnerability discovered in Foundry Code-Workbooks where the endpoint backing tha

A cross-site scripting (XSS) vulnerability in EyouCMS V1.5.9-UTF8-SP1 allows attackers to execute arbitrary web scripts

EyouCMS V1.5.9-UTF8-SP1 was discovered to contain a Cross-Site Request Forgery (CSRF) via the Edit Admin Profile module.

IBM CICS TX 11.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sens

IBM CICS TX 11.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript c

Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 is vulnerable to Reflected XSS in the image m

Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 is vulnerable to Reflected XSS - user can cau

IBM CICS TX 11.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript c

IBM CICS TX 11.1 could disclose sensitive information to a local user due to insecure permission settings. IBM X-Force

IBM CICS TX 11.1 Standard and Advanced could allow a remote attacker to bypass security restrictions, caused by a rever

IBM CICS TX 11.7 could allow an attacker to obtain sensitive information from HTTP response headers. IBM X-Force ID: 22

IBM CICS TX 11.7 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensi

IBM CICS TX 11.1 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to

IBM CICS TX 11.1 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID:

A malformed packet causes a stack overflow in the Ember ZNet stack. This causes an assert which leads to a reset, immed

Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Silicon Labs Ember ZNet allows

IBM MQ Internet Pass-Thru 2.1, 9.2 LTS and 9.2 CD stores potentially sensitive information in trace files that could be

A stored cross-site scripting (XSS) vulnerability in the Add function of Eramba GRC Software c2.8.1 allows attackers to

OP5 Monitor 8.3.1, 8.3.2, and OP5 8.3.3 are vulnerable to Cross Site Scripting (XSS).

The OAuth Client by DigitialPixies WordPress plugin through 1.1.0 does not have CSRF checks in some places, which could

The OAuth Client by DigitialPixies WordPress plugin through 1.1.0 does not sanitize and escapes some of its settings, wh

The ProfileGrid WordPress plugin before 5.1.1 does not sanitise and escape a parameter before outputting it back in the

The Testimonials WordPress plugin before 2.7, super-testimonial-pro WordPress plugin before 1.0.8 do not sanitize and es

The Webmaster Tools Verification WordPress plugin through 1.2 does not have authorisation and CSRF checks when disabling

The WPB Show Core WordPress plugin does not sanitize and escape a parameter before outputting it back in the page, leadi

The WP Attachments WordPress plugin before 5.0.5 does not sanitize and escapes some of its settings, which could allow h

The Chat Bubble WordPress plugin before 2.3 does not sanitise and escape some contact parameters, which could allow unau

The reSmush.it : the only free Image Optimizer & compress plugin WordPress plugin before 0.4.4 lacks authorization in va

The reSmush.it : the only free Image Optimizer & compress plugin WordPress plugin before 0.4.4 does not perform CSRF che

GNOME Nautilus 42.2 allows a NULL pointer dereference and get_basename application crash via a pasted ZIP archive.

In PHP versions prior to 7.4.33, 8.0.25 and 8.1.12, when using imageloadfont() function in gd extension, it is possible

Xiongmai Camera XM-JPR2-LX V4.02.R12.A6420987.10002.147502.00000 is vulnerable to plain-text traffic sniffing.

A vulnerability was found in NagVis up to 1.9.33 and classified as problematic. This issue affects the function checkAut

A vulnerability, which was classified as problematic, was found in NodeBB up to 2.5.7. This affects an unknown part of t

A vulnerability has been found in MZ Automation libiec61850 up to 1.4 and classified as critical. This vulnerability aff

A vulnerability classified as critical was found in Axiomatic Bento4. Affected by this vulnerability is the function AP4

A vulnerability was found in matrix-appservice-irc up to 0.35.1. It has been declared as critical. This vulnerability af

A vulnerability was found in LibTIFF. It has been classified as critical. This affects the function TIFFReadRGBATileExt

A vulnerability, which was classified as critical, was found in Vesta Control Panel. Affected is an unknown function of

A vulnerability, which was classified as critical, has been found in Ultimate Member Plugin up to 2.5.0. This issue affe

A vulnerability classified as problematic was found in ffmpeg. This vulnerability affects the function smc_encode_stream

A vulnerability classified as problematic has been found in ffmpeg. This affects an unknown part of the file libavcodec/

SimpleXMQ before 3.4.0, as used in SimpleX Chat before 4.2, does not apply a key derivation function to intended data, w

CBRN-Analysis before 22 has weak file permissions under Public Profile, leading to disclosure of file contents or privil

Element iOS is an iOS Matrix client provided by Element. It is based on MatrixSDK. Prior to version 1.9.7, events encryp

The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server with your computer. In version 3.6.0,

IBM WebSphere Application Server 8.5, and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to

IBM Cloud Pak for Security (CP4S) 1.10.0.0 79and 1.10.2.0 is vulnerable to cross-site scripting. This vulnerability allo