2022

TOTOLink N600R V5.3c.7159_B20190425 was discovered to contain a command injection vulnerability via the ipdoamin paramet

TOTOLink N600R V5.3c.7159_B20190425 was discovered to contain a command injection vulnerability via the hosttime functio

TOTOLink N600R V5.3c.7159_B20190425 was discovered to contain a command injection vulnerability via the langtype paramet

TOTOLink N600R V5.3c.7159_B20190425 was discovered to contain a command injection vulnerability via the devicemac parame

A command injection vulnerability in the component /SetTriggerLEDBlink/Blink of D-Link DIR882 DIR882A1_FW130B06 allows a

A command injection vulnerability in the component /setnetworksettings/SubnetMask of D-Link DIR882 DIR882A1_FW130B06 all

A command injection vulnerability in the component /setnetworksettings/IPAddress of D-Link DIR882 DIR882A1_FW130B06 allo

Buffer Over-read in function find_next_quote in GitHub repository vim/vim prior to 8.2.4925. This vulnerabilities are ca

Heap buffer overflow in vim_strncpy find_word in GitHub repository vim/vim prior to 8.2.4919. This vulnerability is capa

file.copy operations in GruntJS are vulnerable to a TOCTOU race condition leading to arbitrary file write in GitHub repo

API Privilege Escalation in GitHub repository alextselegidis/easyappointments prior to 1.5.0. Full system takeover.

Tenda TX9 Pro 22.03.02.10 devices have a SetNetControlList buffer overflow.

Hotel Management System v1.0 was discovered to contain a SQL injection vulnerability via the username parameter at the l

An SQL Injection vulnerability exists in OpenMRS Reference Application Standalone Edition <=2.11 and Platform Standalone

CMSimple_XH 1.7.4 is affected by a remote code execution (RCE) vulnerability. To exploit this vulnerability, an attacker

A vulnerability has been identified in Desigo DXR2 (All versions < V01.21.142.5-22), Desigo PXC3 (All versions < V01.21.

A vulnerability has been identified in Desigo DXR2 (All versions < V01.21.142.5-22), Desigo PXC3 (All versions < V01.21.

A vulnerability has been identified in Desigo DXR2 (All versions < V01.21.142.5-22), Desigo PXC3 (All versions < V01.21.

A vulnerability has been identified in Desigo PXC4 (All versions < V02.20.142.10-10884), Desigo PXC5 (All versions < V02

Prototype poisoning in function mapObjIndexed in Ramda 0.27.0 and earlier allows attackers to compromise integrity or av

A vulnerability has been identified in Desigo DXR2 (All versions < V01.21.142.5-22), Desigo PXC3 (All versions < V01.21.

A security vulnerability has been identified in HPE Nimble Storage Hybrid Flash Arrays, HPE Nimble Storage All Flash Arr

A potential security vulnerability has been identified in Integrated Lights-Out 4 (iLO 4). The vulnerability could allow

Stored XSS in Add New Employee Form in Sourcecodester Employee Daily Task Management System 1.0 Allows Remote Attacker t

Bonanza Wealth Management System (BWM) 7.3.2 allows SQL injection via the login form. Users who supply the application w

1Password for Mac 7.2.4 through 7.9.x before 7.9.3 is vulnerable to a process validation bypass. Malicious software runn

There is an invalid memory access in the TextLine class in TextOutputDev.cc in Xpdf 4.0.4 because the text extractor mis

An argument injection vulnerability in the browser-based authentication component of the Magnitude Simba Amazon Redshift

An argument injection vulnerability in the browser-based authentication component of the Magnitude Simba Amazon Athena J

An argument injection vulnerability in the browser-based authentication component of the Magnitude Simba Amazon Redshift

An argument injection vulnerability in the browser-based authentication component of the Magnitude Simba Amazon Athena O

Craft CMS through 3.7.36 allows a remote unauthenticated attacker, who knows at least one valid username, to reset the a

There is a buffer over-read in Ruby before 2.6.10, 2.7.x before 2.7.6, 3.x before 3.0.4, and 3.1.x before 3.1.2. It occu

A double free was found in the Regexp compiler in Ruby 3.x before 3.0.4 and 3.1.x before 3.1.2. If a victim attempts to

Explore CMS v1.0 was discovered to contain a SQL injection vulnerability via a /page.php?id= request.

A stored cross-site scripting (XSS) vulnerability in PHProjekt PhpSimplyGest v1.3.0 allows attackers to execute arbitrar

Brocade SANnav before version SANnav 2.2.0 logs the REST API Authentication token in plain text.

An information exposure through log file vulnerability in Brocade SANNav versions before Brocade SANnav 2.2.0 could allo

There is a vulnerability in htmldoc 1.9.16. In image_load_jpeg function image.cxx when it calls malloc,'img->width' and

IBM Navigator for i 7.2, 7.3, and 7.4 (heritage version) could allow a remote attacker to obtain access to the web inter

IBM Robotic Process Automation 21.0.1 could allow a register user on the system to physically delete a queue that could

The Easily Generate Rest API Url WordPress plugin through 1.0.0 does not escape some of its settings, allowing high priv

The Slide Anything WordPress plugin before 2.3.44 does not sanitize and escape sliders' description, which could allow h

The Vertical scroll recent post WordPress plugin before 14.0 does not sanitise and escape a parameter before outputting

The Popup Maker WordPress plugin before 1.16.5 does not sanitise and escape some of its Popup settings, which could allo

The Themify Post Type Builder Search Addon WordPress plugin before 1.4.0 does not properly escape the current page URL b

The Personal Dictionary WordPress plugin before 1.3.4 fails to properly sanitize user supplied POST data before it is be

The Order Listener for WooCommerce WordPress plugin before 3.2.2 does not sanitise and escape the id parameter before us

The IgniteUp WordPress plugin through 3.4.1 does not sanitise and escape some fields when high privilege users don't hav

The WP Social Buttons WordPress plugin through 2.1 does not sanitise and escape its settings, allowing high privilege us