2022

Combodo iTop is a web based IT Service Management tool. In versions prior to 3.0.0-beta6 the export CSV page don't prope

Cross-site Scripting (XSS) - Stored in GitHub repository chatwoot/chatwoot prior to 2.5.0.

An authenticated user may trigger an invariant assertion during command dispatch due to incorrect validation on the $ext

Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.4774.

Blazer before 2.6.0 allows SQL Injection. In certain circumstances, an attacker could get a user to run a query they wou

There is a cross-site scripting (XSS) vulnerability in an NI Web Server component installed with several NI products. De

In pam_tacplus.c in pam_tacplus before 1.4.1, pam_sm_acct_mgmt does not zero out the arep data structure.

A reflected XSS issue exists in the Management Console of several WSO2 products. This affects API Manager 2.2.0, 2.5.0,

The CreateRedirect extension before 2022-04-14 for MediaWiki does not properly check whether the user has permissions to

A reflected cross-site scripting (XSS) vulnerability in the /public/launchNewWindow.jsp component of Zimbra Collaboratio

Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts file

Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 allows an unauthenticated attacker to inject arbitrary memcache commands i

gp_rtp_builder_do_hevc in ietf/rtp_pck_mpeg4.c in GPAC 2.0.0 has a heap-based buffer over-read, as demonstrated by MP4Bo

In GNOME Epiphany before 41.4 and 42.x before 42.2, an HTML document can trigger a client buffer overflow (in ephy_strin

An issue was discovered in MISP before 2.4.158. In UsersController.php, password confirmation can be bypassed via vector

An issue was discovered in MISP before 2.4.158. There is XSS in app/Controller/OrganisationsController.php in a situatio

An issue was discovered in MISP before 2.4.158. There is XSS in the cerebrate view if one administrator puts a javascrip

An issue was discovered in MISP before 2.4.158. There is stored XSS in the event graph via a tag name.

An issue was discovered in MISP before 2.4.158. There is stored XSS in the galaxy clusters.

An issue was discovered in MISP before 2.4.158. There is stored XSS via the LinOTP login field.

An issue was discovered in MISP before 2.4.158. PHAR deserialization can occur.

Shopware is an open commerce platform based on Symfony Framework and Vue. Permissions set to sales channel context by ad

HumHub is an Open Source Enterprise Social Network. In affected versions users who are forced to change their password b

An SQL Injection vulnerability exists in Webtareas 2.4p3 and earlier via the $uq HTTP POST parameter in editapprovalstag

A denial of service vulnerability exists in MDT's firmware for the KNXnet/IP Secure router SCN-IP100.03 and KNX IP inter

SharedSecretClusterAuthenticator in Atlassian Bitbucket Data Center versions 5.14.0 and later before 7.6.14, 7.7.0 and l

Shopware is an open commerce platform based on Symfony Framework and Vue. In affected versions an attacker can abuse the

Origin Protocol is a blockchain based project. The Origin Protocol project website allows for malicious users to inject

Databasir is a team-oriented relational database model document management platform. Databasir 1.01 has Server-Side Requ

Databasir is a team-oriented relational database model document management platform. Databasir 1.01 has remote code exec

A vulnerability in Jira Seraph allows a remote, unauthenticated attacker to bypass authentication by sending a specially

wire-webapp is the web application interface for the wire messaging service. Insufficient escaping in markdown “code hig

A malicious actor having access to the exported configuration file may obtain the stored credentials and thereby gain ac

There is no limit to the number of attempts to authenticate for the local configuration pages for the Hills ComNav Versi

Authorized users may install a maliciously modified package file when updating the device via the web user interface. Th

Hills ComNav version 3002-19 suffers from a weak communication channel. Traffic across the local network for the configu

The weak password on the web user interface can be exploited via HTTP or HTTPS. Once such access has been obtained, the

A flaw was found in ovn-kubernetes. This flaw allows a system administrator or privileged attacker to create an egress n

The affected product is vulnerable to a network-based attack by threat actors supplying a crafted, malicious XML payload

The affected product is vulnerable to a network-based attack by threat actors utilizing crafted naming conventions of fi

The setup program for the affected product configures its files and folders with full access, which may allow unauthoriz

The affected product is vulnerable to a network-based attack by threat actors sending unimpeded requests to the receivin

The affected product is vulnerable to misconfigured binaries, allowing users on the target PC with SYSTEM level privileg

An XSS issue was discovered on Olivetti d-COLOR MF3555 2XD_S000.002.271 devices. The Web Application doesn't properly ch

An issue was discovered on Olivetti d-COLOR MF3555 2XD_S000.002.271 devices. The Web Application is affected by Denial o

An issue was discovered on Olivetti d-COLOR MF3555 2XD_S000.002.271 devices. The Web Application is affected by Broken A

A URL redirection vulnerability in Skyhigh SWG in main releases 10.x prior to 10.2.9, 9.x prior to 9.2.20, 8.x prior to

Amazon AWS amazon-ssm-agent before 3.1.1208.0 creates a world-writable sudoers file, which allows local attackers to inj

The generic P-256 feature in crypto/elliptic in Go before 1.17.9 and 1.18.x before 1.18.1 allows a panic via long scalar

Certificate.Verify in crypto/x509 in Go 1.18.x before 1.18.1 can be caused to panic on macOS when presented with certain