2022

Cookie without HTTPONLY flag set. NUMBER cookie(s) was set without Secure or HTTPOnly flags. The images show the cookie

Misconfigured security-related HTTP headers: Several security-related headers were missing or mis-configured on the web

Weak web transport security (Weak TLS): An attacker may be able to decrypt the data using attacks

An issue was discovered in the Sametime chat feature in the Notes 11.0 - 11.0.1 FP4 clients. An authenticated Sametime c

This vulnerability arises because the application allows the user to perform some sensitive action without verifying tha

There is a security vulnerability in login form related to Cross-site Request Forgery which prevents user to login after

HCL Commerce is affected by an Insufficient Session Expiration vulnerability. After the session expires, in some circums

In multiple Tecson Tankspion and GOKs SmartBox 4 products the affected application doesn't properly restrict access to a

Reflected Cross-Site Scripting (XSS) vulnerability in Adam Skaat's Countdown & Clock plugin on WordPress via &ycd_type v

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Adam Skaat

FUDforum 3.1.1 is vulnerable to Stored XSS.

Dragon Path Technologies Bharti Airtel Routers Hardware BDT-121 version 1.0 is vulnerable to Cross Site Scripting (XSS)

A vulnerability in the role-based access control (RBAC) functionality of the Brocade SANNav before 2.2.0 could allow an

The Monitoring Console app configured in Distributed mode allows for a Reflected XSS in a query parameter in Splunk Ente

In Splunk Enterprise versions before 8.1.2, the uri path to load a relative resource within a web page is vulnerable to

When handling a mismatched pre-authentication cookie, the application leaks the internal error message in the response,

Keylime does not enforce that the agent registrar data is the same when the tenant uses it for validation of the EK and

A misconfiguration in the node default path allows for local privilege escalation from a lower privileged user to the Sp

Stored Cross-Site Scripting (XSS) vulnerability in Andrea Pernici News Sitemap for Google plugin <= 1.0.16 on WordPress,

The Splunk Enterprise REST API allows enumeration of usernames via the lockout error message. The potential vulnerabilit

A crafted request bypasses S2S TCP Token authentication writing arbitrary events to an index in Splunk Enterprise Indexe

A potential vulnerability in Splunk Enterprise's implementation of DUO MFA allows for bypassing the MFA verification in

Brocade SANnav before SANnav 2.2.0 application uses the Blowfish symmetric encryption algorithm for the storage of passw

In Brocade SANnav before Brocade SANnav 2.2.0, multiple endpoints associated with Zone management are susceptible to SQL

Under certain circumstances an authenticated user could lock other users out of the system or take over their accounts i

IBM Guardium Data Encryption (GDE) 4.0.0 and 5.0.0 prepares a structured message for communication with another componen

IBM Guardium Data Encryption (GDE) 4.0.0 and 5.0.0 could allow a remote attacker to obtain sensitive information when a

An issue was discovered in the 3CX Phone System Management Console prior to version 18 Update 3 FINAL. An unauthenticate

Tenda AX1806 v1.0.0.1 was discovered to contain a stack overflow via the wanMTU parameter in the function fromAdvSetMacM

Tenda AX1806 v1.0.0.1 was discovered to contain a stack overflow via the timeZone parameter in the function form_fast_se

Tenda AX1806 v1.0.0.1 was discovered to contain a stack overflow via the list parameter in the function fromSetIpMacBind

Tenda AX1806 v1.0.0.1 was discovered to contain a heap overflow via the mac parameter in the function GetParentControlIn

Tenda AX1806 v1.0.0.1 was discovered to contain a stack overflow via the shareSpeed parameter in the function fromSetWif

SQL Injection vulnerability in admin/batch_manager.php in piwigo v2.9.5, via the filter_category parameter to admin.php?

SQL Injection vulnerability in admin/user_perm.php in piwigo v2.9.5, via the cat_false parameter to admin.php?page=group

SQL Injection vulnerability in admin/user_perm.php in piwigo v2.9.5, via the cat_false parameter to admin.php?page=user_

SQL Injection vulnerability in cat_move.php in piwigo v2.9.5, via the selection parameter to move_categories.

SQL Injection vulnerability in admin/group_list.php in piwigo v2.9.5, via the group parameter to delete.

Netty is an open-source, asynchronous event-driven network application framework. The package `io.netty:netty-codec-http

uClibc-ng through 1.0.40 and uClibc through 0.9.33.2 use predictable DNS transaction IDs that may lead to DNS cache pois

In WebKitGTK through 2.36.0 (and WPE WebKit), there is a heap-based buffer overflow in WebCore::TextureMapperLayer::setC

Flux is an open and extensible continuous delivery solution for Kubernetes. Path Traversal in the kustomize-controller v

Flux is an open and extensible continuous delivery solution for Kubernetes. Path Traversal in the kustomize-controller v

A security issue was discovered in ingress-nginx where a user that can create or update ingress objects can use .metadat

A security issue was discovered in ingress-nginx where a user that can create or update ingress objects can use the spec

Sourcegraph is a fast and featureful code search and navigation engine. Versions before 3.38.0 are vulnerable to Remote

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. In affe

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. The XWiki Crypt

Rsyslog is a rocket-fast system for log processing. Modules for TCP syslog reception have a potential heap buffer overfl

TkVideoplayer is a simple library to play video files in tkinter. Uncontrolled memory consumption in versions of TKVideo