2022

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Reactive WebServer). Supported versions tha

Mattermost 6.4.x and earlier fails to properly invalidate pending email invitations when the action is performed from th

Mattermost version 6.4.x and earlier fails to properly check the plugin version when a plugin is installed from the Mark

The Elementor Website Builder plugin for WordPress is vulnerable to unauthorized execution of several AJAX actions due t

The WordPress WP YouTube Live Plugin is vulnerable to Reflected Cross-Site Scripting via POST data found in the ~/inc/ad

The WordPress plugin Be POPIA Compliant exposed sensitive information to unauthenticated users consisting of site visito

The Simple File List WordPress plugin is vulnerable to Arbitrary File Download via the eeFile parameter found in the ~/i

Automated Logic's WebCtrl Server Version 6.1 'Help' index pages are vulnerable to open redirection. The vulnerability al

The SiteGround Security plugin for WordPress is vulnerable to authentication bypass that allows unauthenticated users to

The SiteGround Security plugin for WordPress is vulnerable to authentication bypass that allows unauthenticated users to

The Fancy Product Designer plugin for WordPress is vulnerable to Cross-Site Request Forgery via the FPD_Admin_Import cla

Real-time image information exposure is caused by insufficient authentication for activated RTSP port. This vulnerabilit

Improper input validation vulnerability in XPLATFORM's execBrowser method can cause execute arbitrary commands. IF the s

Insufficient Verification of input Data leading to arbitrary file download and execute was discovered in Nexacro platfor

Eaton Intelligent Power Protector (IPP) prior to version 1.69 is vulnerable to stored Cross Site Scripting. The vulnerab

Smokescreen is a simple HTTP proxy that fogs over naughty URLs. The primary use case for Smokescreen is to prevent serve

An Unauthenticated time-based blind SQL injection vulnerability exists in Forma LMS prior to v.1.4.3.

ecjia-daojia 1.38.1-20210202629 is vulnerable to information leakage via content/apps/installer/classes/Helper.php. When

The package git before 1.11.0 are vulnerable to Command Injection via git argument injection. When calling the fetch(rem

IBM Security Guardium 10.5 stores user credentials in plain clear text which can be read by a local privileged user. IBM

IBM Security Guardium 10.5 and 11.3 uses weaker than expected cryptographic algorithms that could allow an attacker to d

IBM Security Guardium 11.3 could allow a remote attacker to obtain sensitive information, caused by the failure to prope

IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.5 and 6.1.0.0 through 6.1.1.0 could allow a remote at

HashiCorp Consul and Consul Enterprise up to 1.9.16, 1.10.9, and 1.11.4 may allow server side request forgery when the C

In Citrix XenMobile Server through 10.12 RP9, there is an Authenticated Directory Traversal vulnerability, leading to re

Invicti Acunetix before 14 allows CSV injection via the Description field on the Add Targets page, if the Export CSV fea

A SQL injection vulnerability exists in Microfinance Management System 1.0 when MySQL is being used as the application d

Liferay Portal 7.3.7, 7.4.0, and 7.4.1, and Liferay DXP 7.2 fix pack 13, and 7.3 fix pack 2 does not properly check user

Cross-site scripting (XSS) vulnerability in the Asset module's asset categories selector in Liferay Portal 7.3.3 through

A bypass exists for Desire2Learn/D2L Brightspace’s “Disable Right Click” option in the quizzing feature, which allows a

Veritas NetBackup OpsCenter Analytics 9.1 allows XSS via the NetBackup Master Server Name, Display Name, NetBackup User

Open redirect vulnerability via endpoint authorize_and_redirect/?redirect= in GitHub repository posthog/posthog prior to

A vulnerability within the authentication process of Abacus ERP allows a remote attacker to bypass the second authentica

Selenium Server (Grid) before 4 allows CSRF because it permits non-JSON content types such as application/x-www-form-url

Certain WSO2 products allow unrestricted file upload with resultant remote code execution. The attacker must use a /file

fleetdm/fleet is an open source device management, built on osquery. All versions of fleet making use of the teams featu

ncurses 6.3 before patch 20220416 has an out-of-bounds read and segmentation violation in convert_strings in tinfo/read_

Zoho ManageEngine ADSelfService Plus before 6121, ADAuditPlus 7060, Exchange Reporter Plus 5701, and ADManagerPlus 7131

http-swagger is an open source wrapper to automatically generate RESTful API documentation with Swagger 2.0. In versions

PyPDF2 is an open source python PDF library capable of splitting, merging, cropping, and transforming the pages of PDF f

The Autolinks WordPress plugin through 1.0.1 does not have CSRF check in place when updating its settings, and does not

The sanitisation step of the Safe SVG WordPress plugin before 1.9.10 can be bypassed by spoofing the content-type in the

The Good & Bad Comments WordPress plugin through 1.0.0 does not sanitise and escape its settings, which could allow high

The Page Security & Membership WordPress plugin through 1.5.15 does not sanitise and escape some of its settings, which

The Thank Me Later WordPress plugin through 3.3.4 does not sanitise and escape the Message Subject field before outputti

The RSVP and Event Management Plugin WordPress plugin before 2.7.8 does not have any authorisation checks when exporting

The EXMAGE WordPress plugin before 1.0.7 does to ensure that images added via URLs are external images, which could lead

The Product Table for WooCommerce (wooproducttable) WordPress plugin before 3.1.2 does not have authorisation and CSRF c

The WP Downgrade WordPress plugin before 1.2.3 only perform client side validation of its "WordPress Target Version" set

The Hummingbird WordPress plugin before 3.3.2 does not sanitise and escape the Config Name, which could allow high privi