2022

A vulnerability in Apache CXF before versions 3.5.5 and 3.4.10 allows an attacker to perform a remote directory listing

AeroCMS v0.0.1 is vulnerable to Cross Site Request Forgery (CSRF).

A Denial-of-Service (DoS) vulnerability was discovered in the fsicapd component used in WithSecure products whereby the

Jettison before v1.5.2 was discovered to contain a stack overflow via the map parameter. This vulnerability allows attac

A stack overflow in the org.json.JSONTokener.nextValue::JSONTokener.java component of hutool-json v5.8.10 allows attacke

hutool-json v5.8.10 was discovered to contain an out of memory error.

A stack overflow in the XML.toJSONObject component of hutool-json v5.8.10 allows attackers to cause a Denial of Service

A stack overflow in Jettison before v1.5.2 allows attackers to cause a Denial of Service (DoS) via crafted JSON data.

The Samsung TV (2021 and 2022 model) smart remote control allows attackers to enable microphone access via Bluetooth spo

Resque Scheduler version 1.27.4 is vulnerable to Cross-site scripting (XSS). A remote attacker could inject javascript c

There exists a path traversal vulnerability in the Android Google Search app. This is caused by the incorrect usage of u

EXEMSI MSI Wrapper Versions prior to 10.0.50 and at least since version 6.0.91 will introduce a local privilege escalati

AeroCMS v0.0.1 is vulnerable to ClickJacking.

AeroCMS v0.0.1 was discovered to contain a cross-site scripting (XSS) vulnerability via add_post.php. This vulnerability

AeroCMS v0.0.1 is vulnerable to SQL Injection via the delete parameter.

Debug tool in Secomea SiteManager allows logged-in administrator to modify system state in an unintended manner.

PHP Remote File Inclusion in GitHub repository tsolucio/corebos prior to 8.0.

A vulnerability was found in ipti br.tag. It has been declared as problematic. Affected by this vulnerability is an unkn

Multiple Wiesemann&Theis products of the ComServer Series are prone to an authentication bypass through IP spoofing. Aft

In versions prior to 0.8.1, the linux-loader crate uses the offsets and sizes provided in the ELF headers to determine t

Passport-wsfed-saml2 is a ws-federation protocol and SAML2 tokens authentication provider for Passport. In versions prio

Tuleap is an Open Source Suite to improve management of software developments and collaboration. In versions prior to 14

Netty project is an event-driven asynchronous network application framework. Starting in version 4.1.83.Final and prior

Tuleap is an Open Source Suite to improve management of software developments and collaboration. In versions prior to 14

In SAP Solution Manager (Enterprise Search) - versions 740, and 750, an unauthenticated attacker can generate a link tha

SAP Disclosure Management - version 10.1, allows an authenticated attacker to exploit certain misconfigured application

Due to improper input sanitization in SAP Sourcing and SAP Contract Lifecycle Management - version 1100, an attacker can

An unauthenticated attacker over the network can attach to an open interface exposed through JNDI by the User Defined Se

An unauthenticated user can attach to an open interface exposed through JNDI by the Messaging System of SAP NetWeaver Pr

In some SAP standard roles in SAP Business Planning and Consolidation - versions - SAP_BW 750, 751, 752, 753, 754, 755,

SAP Business Objects Platform - versions 420, and 430, allows an attacker with normal BI user privileges to upload/repla

Due to a lack of proper input validation, SAP Commerce Webservices 2.0 (Swagger UI) - versions 1905, 2005, 2105, 2011, 2

Due to the unrestricted scope of the RFC function module, SAP BASIS - versions 731, 740, 750, 751, 752, 753, 754, 755, 7

Logrhythm Web Console 7.4.9 allows for HTML tag injection through Contextualize Action -> Create a new Contextualize Act

A directory traversal vulnerability in the component SCS.Web.Server.SPI/1.0 of Linx Sphere LINX 7.35.ST15 allows attacke

Due to a missing authentication check, SAP Business Objects Business Intelligence Platform (Web Intelligence) - versions

Due to insufficient input validation, SAP NetWeaver AS Java (HTTP Provider Service) - version 7.50, allows an unauthenti

SAP Solution Manager (Diagnostic Agent) - version 7.20, allows an authenticated attacker on Windows system to access a f

Insufficient processing of user input in WebSoft HCM 2021.2.3.327 allows an authenticated attacker to inject arbitrary H

Insufficient processing of user input in WebSoft HCM 2021.2.3.327 allows an unauthenticated attacker to inject arbitrary

Insufficient processing of user input in WebSoft HCM 2021.2.3.327 allows an authenticated attacker to inject arbitrary H

Insufficient processing of user input in WebSoft HCM 2021.2.3.327 allows an authenticated attacker to inject arbitrary H

An arbitrary file upload vulnerability in /queuing/admin/ajax.php?action=save_settings of Dynamic Transaction Queuing Sy

An issue was discovered in the Arm Mali GPU Kernel Driver. There is a use-after-free. A non-privileged user can make imp

Improper Privilege Management in GitHub repository ikus060/rdiffweb prior to 2.5.2.

A cleartext storage of sensitive information vulnerability exists in PcVue versions 8.10 through 15.2.3. This could all

An insertion of sensitive information into log file vulnerability exists in PcVue versions 15 through 15.2.2. This coul

The All-In-One Security (AIOS) WordPress plugin before 5.0.8 is susceptible to IP Spoofing attacks, which can lead to by

The Booster for WooCommerce WordPress plugin before 5.6.7, Booster Plus for WooCommerce WordPress plugin before 5.6.6, B

The Image Hover Effects WordPress plugin before 5.5 does not sanitise and escape some of its settings, which could allow