2022

Elcomplus SmartPTT is vulnerable when a low-authenticated user can access higher level administration authorization by i

Elcomplus SmartPTT is vulnerable as the backup and restore system does not adequately validate upload requests, enabling

Elcomplus SmartPTT is vulnerable when an attacker injects JavaScript code into a specific parameter that can executed up

Elcomplus SmartPTT is vulnerable as the backup and restore system does not adequately validate download requests, enabli

A cross-site scripting (XSS) vulnerability in PHP MySQL Admin Panel Generator v1 allows attackers to execute arbitrary w

Turtlapp Turtle Note v0.7.2.6 does not filter the <meta> tag during markdown parsing, allowing attackers to execute HTML

Shopware is an open source e-commerce software platform. Prior to version 5.7.9, Shopware is vulnerable to non-stored cr

Encode OSS httpx < 0.23.0 is affected by improper input validation in `httpx.URL`, `httpx.Client` and some functions usi

The Ericom PowerTerm WebConnect 6.0 login portal can unsafely write an XSS payload from the AppPortal cookie into the pa

Lexmark products through 2022-02-10 have Incorrect Access Control.

novel-plus V3.6.1 allows unrestricted file uploads. Unrestricted file suffixes and contents can lead to server attacks a

NoMachine for Windows prior to version 6.15.1 and 7.5.2 suffer from local privilege escalation due to the lack of safe D

In JetBrains Rider before 2022.1 local code execution via links in ReSharper Quick Documentation was possible

In JetBrains PyCharm before 2022.1 exposure of the debugger port to the internal network was possible

In JetBrains IntelliJ IDEA before 2022.1 local code execution via links in Quick Documentation was possible

In JetBrains IntelliJ IDEA before 2022.1 origin checks in the internal web server were flawed

In JetBrains IntelliJ IDEA before 2022.1 reflected XSS via error messages in internal web server was possible

In JetBrains IntelliJ IDEA before 2022.1 HTML injection into IDE messages was possible

In JetBrains IntelliJ IDEA before 2022.1 local code execution via workspace settings was possible

In JetBrains IntelliJ IDEA before 2022.1 local code execution via HTML descriptions in custom JSON schemas was possible

In JetBrains IntelliJ IDEA before 2022.1 local code execution via custom Pandoc path was possible

In JetBrains IntelliJ IDEA before 2022.1 notification mechanisms about using Unicode directionality formatting character

In JetBrains Hub before 2022.1.14638 stored XSS via project icon was possible.

Command Injection Vulnerability in GitHub repository hestiacp/hestiacp prior to 1.5.12. An authenticated remote attacker

Missing authentication for critical function in AssetView prior to Ver.13.2.0 allows a remote unauthenticated attacker w

cifs-utils through 6.14, with verbose logging, can cause an information leak when a file contains = (equal sign) charact

component/common/network/dhcp/dhcps.c in ambiot amb1_sdk (aka SDK for Ameba1) before 2022-03-11 mishandles data structur

ESAPI (The OWASP Enterprise Security API) is a free, open source, web application security control library. Prior to ver

A flaw was found in 3Scale APICast in versions prior to 2.11.0, where it incorrectly identified connections for reuse. T

Redis is an in-memory database that persists on disk. Prior to versions 6.2.7 and 7.0.0, an attacker attempting to load

Redis is an in-memory database that persists on disk. By exploiting weaknesses in the Lua script execution environment,

NVIDIA Jetson Linux Driver Package contains a vulnerability in the Cboot ext4_mount function, where Insufficient validat

NVIDIA Jetson Linux Driver Package contains a vulnerability in the Cboot blob_decompress function, where insufficient va

NVIDIA Jetson Linux Driver Package contains a vulnerability in the Cboot ext4_read_file function, where insufficient val

NVIDIA Jetson Linux Driver Package contains a vulnerability in the Cboot module tegrabl_cbo.c, where, if TFTP is enabled

NVIDIA Jetson Linux Driver Package contains a vulnerability in the Cboot module tegrabl_cbo.c, where insufficient valida

Linksys MR9600 devices before 2.0.5 allow attackers to read arbitrary files via a symbolic link to the root directory of

IBM UrbanCode Deploy (UCD) 7.2.2.1 could allow an authenticated user with special permissions to obtain elevated privile

In this physical attack, an attacker may potentially exploit the Zynq-7000 SoC First Stage Boot Loader (FSBL) by bypassi

A vulnerability in SonicOS CFS (Content filtering service) returns a large 403 forbidden HTTP response message to the so

A vulnerability in SonicOS SNMP service resulting exposure of Wireless Access Point sensitive information in cleartext.

A vulnerability in SonicOS SNMP service resulting exposure of sensitive information to an unauthorized user.

Improper Restriction of TCP Communication Channel in HTTP/S inbound traffic from WAN to DMZ bypassing security policy un

chafa: NULL Pointer Dereference in function gif_internal_decode_frame at libnsgif.c:599 allows attackers to cause a deni

An insecure data storage vulnerability allows a physical attacker with root privileges to retrieve TOTP secret keys from

Seacms v11.6 was discovered to contain a remote code execution (RCE) vulnerability via the component /admin/weixin.php.

In Miele Benchmark Programming Tool with versions Prior to 1.2.71, executable files manipulated by attackers are unknowi

IBM QRadar 7.3, 7.4, and 7.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary J

IBM Security Identity Manager (IBM Security Verify Password Synchronization Plug-in for Windows AD 10.x) is vulnerable t

IBM Security Identity Manager (IBM Security Verify Password Synchronization Plug-in for Windows AD 10.x) is vulnerable t