2022

The package git-pull-or-clone before 2.0.2 are vulnerable to Command Injection due to the use of the --upload-pack featu

All versions of package jailed are vulnerable to Sandbox Bypass via an exported alert() method which can access the main

The package convict before 6.2.2 are vulnerable to Prototype Pollution via the convict function due to missing validatio

This affects all versions of package org.nanohttpd:nanohttpd. Whenever an HTTP Session is parsing the body of an HTTP re

The package sqlite3 before 5.0.3 are vulnerable to Denial of Service (DoS) which will invoke the toString function of th

The package dexie before 3.2.2, from 4.0.0-alpha.1 and before 4.0.0-alpha.3 are vulnerable to Prototype Pollution in the

All versions of package masuit.tools.core are vulnerable to Arbitrary Code Execution via the ReceiveVarData<T> function

The package s-cart/s-cart before 6.9; the package s-cart/core before 6.9 are vulnerable to Cross-site Scripting (XSS) wh

This affects all versions of package libxmljs. When invoking the libxmljs.parseXml function with a non-buffer argument t

CSV-Safe gem < 3.0.0 doesn't filter out special characters which could trigger CSV Injection.

In Shopizer versions 2.0 to 2.17.0 a regular admin can permanently delete a superadmin (although this cannot happen acco

A Stored Cross Site Scripting (XSS) vulnerability exists in Shopizer versions 2.0 through 2.17.0, where a privileged use

Formula Injection/CSV Injection due to Improper Neutralization of Formula Elements in CSV File in GitHub repository luya

PingID Desktop prior to 1.7.3 has a misconfiguration in the encryption libraries which can lead to sensitive data exposu

A misconfiguration of RSA in PingID iOS app prior to 1.19 is vulnerable to pre-computed dictionary attacks, leading to a

A misconfiguration of RSA in PingID Android app prior to 1.19 is vulnerable to pre-computed dictionary attacks, leading

A misconfiguration of RSA in PingID Windows Login prior to 2.7 is vulnerable to pre-computed dictionary attacks, leading

An issue was discovered in MediaWiki through 1.37.2. The SecurePoll extension allows a leak because sorting by timestamp

Multiple components in Apache NiFi 0.0.1 to 1.16.0 do not restrict XML External Entity references in the default configu

static_compressed_inmemory_website_callback.c in Glewlwyd through 2.6.2 allows directory traversal.

Woodpecker before 0.15.1 allows XSS via build logs because web/src/components/repo/build/BuildLog.vue lacks escaping.

NVIDIA Omniverse Nucleus and Cache contain a vulnerability in its configuration of OpenSSL, where an attacker with physi

DJI drone devices sold in 2017 through 2022 broadcast unencrypted information about the drone operator's physical locati

This affects the package @yaireo/tagify before 4.9.8. The package is used for rendering UI components inside the input o

Improper handling of Length parameter in GitHub repository erudika/scoold prior to 1.49.4. When the text size is large e

USU Oracle Optimization before 5.17.5 allows authenticated DataCollection users to achieve agent root access because som

USU Oracle Optimization before 5.17 allows authenticated quantum users to achieve remote code execution because of /v2/q

USU Oracle Optimization before 5.17.5 allows attackers to discover the quantum credentials via an agent-installer downlo

USU Oracle Optimization before 5.17.5 lacks Polkit authentication, which allows smartcollector users to achieve root acc

Cross-Site Request Forgery (CSRF) leading to Arbitrary File Upload vulnerability in Rara One Click Demo Import plugin <=

Multiple (13x) Cross-Site Request Forgery (CSRF) vulnerabilities in WPKube's Subscribe To Comments Reloaded plugin <= 21

Small HTTP Server version 3.06 suffers from a remote buffer overflow vulnerability via long GET request.

ALLMediaServer 1.6 is vulnerable to Buffer Overflow via MediaServer.exe.

ASDA-Soft: Version 5.4.1.0 and prior does not properly sanitize input while processing a specific project file, allowing

ASDA-Soft: Version 5.4.1.0 and prior does not properly sanitize input while processing a specific project file, allowing

Users with the capability to configure badge criteria (teachers and managers by default) were able to configure course b

A flaw was found in the QXL display device emulation in QEMU. A double fetch of guest controlled values `cursor->header.

A flaw was found in the QXL display device emulation in QEMU. An integer overflow in the cursor_alloc() function can lea

Linux distributions using CAP_SYS_NICE for gnome-shell may be exposed to a privilege escalation issue. An attacker, with

Under certain circumstances improper privilege management in Metasys ADS/ADX/OAS servers versions 10 and 11 could allow

A hardcoded cryptographic key in Automation360 22 allows an attacker to decrypt exported RPA packages.

A vulnerability was found in the pfkey_register function in net/key/af_key.c in the Linux kernel. This flaw allows a loc

A NULL pointer dereference flaw was found in pesign's cms_set_pw_data() function of the cms_common.c file. The function

A privilege escalation flaw was found in Podman. This flaw allows an attacker to publish a malicious image to a public r

A use-after-free vulnerability was found in the Linux kernel in drivers/net/hamradio. This flaw allows a local attacker

A heap-use-after-free flaw was found in ImageMagick's RelinquishDCMInfo() function of dcm.c file. This vulnerability is

A use-after-free flaw was found in the Linux kernel’s sound subsystem in the way a user triggers concurrent calls of PCM

A flaw was found in the Linux kernel in linux/net/netfilter/nf_tables_api.c of the netfilter subsystem. This flaw allows

Insufficient capability checks could allow users with the moodle/site:uploadusers capability to delete users, without ha

Elcomplus SmartPTT SCADA Server is vulnerable to an unauthenticated user can request various files from the server witho