2022

A vulnerability in the IPSec decryption routine of Cisco IOS XE Software could allow an unauthenticated, remote attacker

A vulnerability in the AppNav-XE feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cau

Multiple vulnerabilities in the Cisco IOx application hosting environment on multiple Cisco platforms could allow an att

A vulnerability in the Tool Command Language (Tcl) interpreter of Cisco IOS XE Software could allow an authenticated, lo

Multiple vulnerabilities that affect Cisco Catalyst Digital Building Series Switches and Cisco Catalyst Micro Switches c

A vulnerability in IP ingress packet processing of the Cisco Embedded Wireless Controller with Catalyst Access Points So

XSS via Embedded SVG in SVG Diagram Format in GitHub repository plantuml/plantuml prior to 1.2022.4. Stored XSS in the c

NGINX NJS 0.7.2 was discovered to contain a NULL pointer dereference via the component njs_vmcode_array at /src/njs_vmco

STB v2.27 was discovered to contain an integer shift of invalid size in the component stbi__jpeg_decode_block_prog_ac.

Irzip v0.640 was discovered to contain a heap memory corruption via the component lrzip.c:initialise_control.

stb_image.h v2.27 was discovered to contain an heap-based use-after-free via the function stbi__jpeg_huff_decode.

stb_image.h v2.27 was discovered to contain an integer overflow via the function stbi__jpeg_decode_block_prog_dc. This v

SuiteCRM v7.11.23 was discovered to allow remote code execution via a crafted payload injected into the FirstName text f

A vulnerability affecting F-Secure SAFE browser was discovered. A maliciously crafted website could make a phishing atta

A vulnerability affecting F-Secure SAFE browser was discovered. A maliciously crafted website could make a phishing atta

An Address bar spoofing vulnerability was discovered in Safe Browser for Android. When user clicks on a specially crafte

The Signal app before 5.34 for iOS allows URI spoofing via RTLO injection. It incorrectly renders RTLO encoded URLs begi

An issue was discovered in Asterisk through 19.x and Certified Asterisk through 16.8-cert13. The func_odbc module provid

An SSRF issue was discovered in Asterisk through 19.x. When using STIR/SHAKEN, it's possible to send arbitrary requests

An issue was discovered in Asterisk through 19.x. When using STIR/SHAKEN, it is possible to download files that are not

Kaseya Unitrends Client/Agent through 10.5,5 allows remote attackers to execute arbitrary code.

OS command injection vulnerability exists in CENTUM VP R4.01.00 to R4.03.00, CENTUM VP Small R4.01.00 to R4.03.00, CENTU

Improper authentication vulnerability in the communication protocol provided by AD (Automation Design) server of CENTUM

Metabase is an open source business intelligence and analytics application. In affected versions Metabase ships with an

Metabase is an open source business intelligence and analytics application. SQLite has an FDW-like feature called `ATTAC

Metabase is an open source business intelligence and analytics application. Metabase has a proxy to load arbitrary URLs

Discourse is an open source platform for community discussion. A category's group permissions settings can be viewed by

DisCatSharp is a Discord API wrapper for .NET. Users of versions 9.8.5, 9.8.6, 9.9.0 and previously published prerelease

GeoWebCache is a tile caching server implemented in Java. The GeoWebCache disk quota mechanism can perform an unchecked

Discourse is an open source platform for community discussion. In affected versions an attacker can poison the cache for

Authenticated (admin+ user) Stored Cross-Site Scripting (XSS) in Modern Events Calendar Lite (WordPress plugin) <= 6.5.1

In Spring Framework versions 5.3.0 - 5.3.18, 5.2.0 - 5.2.20, and older unsupported versions, the patterns for disallowed

An authenticated, high privileged malicious actor with network access to the VMware Cloud Director tenant or provider ma

Buffer Overflow in uudecoder in Mutt affecting all versions starting from 0.94.13 before 2.2.3 allows read past end of i

An out-of-bounds read/write vulnerability was found in e2fsprogs 1.46.5. This issue leads to a segmentation fault and po

On affected Arista EOS platforms, if a VXLAN match rule exists in an IPv4 access-list that is applied to the ingress of

Hard-coded credentials in the B. Braun Melsungen AG SpaceCom Version L81/U61 and earlier, and the Data module compactplu

An improper verification of the cryptographic signature of firmware updates of the B. Braun Melsungen AG SpaceCom Versio

A vulnerability in the B. Braun Melsungen AG SpaceCom Version L81/U61 and earlier, and the Data module compactplus Versi

A XPath injection vulnerability in the B. Braun Melsungen AG SpaceCom Version L81/U61 and earlier, and the Data module c

Improper access controls in the B. Braun Melsungen AG SpaceCom Version L81/U61 and earlier, and the Data module compactp

A reflected cross-site scripting (XSS) vulnerability in the B. Braun Melsungen AG SpaceCom Version L81/U61 and earlier,

Active debug code in the B. Braun Melsungen AG SpaceCom Version L8/U61, and the Data module compactplus Versions A10 and

An open redirect vulnerability in the administrative interface of the B. Braun Melsungen AG SpaceCom device Version L81/

A session fixation vulnerability in the B. Braun Melsungen AG SpaceCom administrative interface Version L81/U61 and earl

A relative path traversal attack in the B. Braun Melsungen AG SpaceCom Version L81/U61 and earlier, and the Data module

A vulnerability in the configuration import mechanism of the B. Braun Melsungen AG SpaceCom Version L81/U61 and earlier,

A memory corruption vulnerability exists in the cgi.c unescape functionality of ArduPilot APWeb master branch 50b6b7ac -

A SQL injection vulnerability exists in the HelpdeskEmailActions.aspx functionality of Lansweeper lansweeper 9.1.20.2. A

An SQL injection vulnerability exists in the EchoAssets.aspx functionality of Lansweeper lansweeper 9.1.20.2. A speciall