2022

Cross-site Scripting (XSS) - DOM in GitHub repository jgraph/drawio prior to 20.5.2.

The WP Hide WordPress plugin through 0.0.2 does not have authorisation and CSRF checks in place when updating the custom

The Highlight Focus WordPress plugin through 1.1 does not sanitise and escape some of its settings, which could allow hi

The Product Stock Manager WordPress plugin before 1.0.5 does not have authorisation and proper CSRF checks in multiple A

The Easy Digital Downloads WordPress plugin before 3.0 does not have CSRF check in place when deleting payment history,

An issue was discovered in Object First Ootbi BETA build 1.0.7.712. A flaw was found in the Web Service, which could lea

handle_ipv6IpForwarding in agent/mibgroup/ip-mib/ip_scalars.c in Net-SNMP 5.4.3 through 5.9.3 has a NULL Pointer Excepti

handle_ipDefaultTTL in agent/mibgroup/ip-mib/ip_scalars.c in Net-SNMP 5.8 through 5.9.3 has a NULL Pointer Exception bug

Code Injection in GitHub repository froxlor/froxlor prior to 0.10.38.2.

A vulnerability classified as critical has been found in SourceCodester Sanitization Management System. Affected is an u

In Splunk Enterprise versions below 8.1.12, 8.2.9, and 9.0.2, a remote user who can create search macros and schedule se

OpenZeppelin Contracts is a library for secure smart contract development. Before version 4.4.1 but after 3.2.0, initial

HCL Domino is susceptible to an information disclosure vulnerability. In some scenarios, local calls made on the server

BD Totalys MultiProcessor, versions 1.70 and earlier, contain hardcoded credentials. If exploited, threat actors may be

Saibamen HotelManager v1.2 is vulnerable to Cross Site Scripting (XSS) due to improper sanitization of comment and conta

The Foundry Blobster service was found to have a cross-site scripting (XSS) vulnerability that could have allowed an att

A vulnerability in multiple management dashboard pages of Cisco Umbrella could allow an authenticated, remote attacker t

A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticat

A vulnerability in the web-based management interface of Cisco Email Security Appliance (ESA), Cisco Secure Email and We

A vulnerability in a feature that monitors RADIUS requests on Cisco Identity Services Engine (ISE) Software could allow

A vulnerability in the web-based management interface of Cisco Email Security Appliance, Cisco Secure Email and Web Mana

A vulnerability in web-based management interface of the of Cisco Email Security Appliance and Cisco Secure Email and We

A vulnerability in Cisco Email Security Appliance (ESA) and Cisco Secure Email and Web Manager could allow an unauthenti

diplib v3.0.0 is vulnerable to Double Free.

The Foundry Magritte plugin osisoft-pi-web-connector versions 0.15.0 - 0.43.0 was found to be logging in a manner that c

Code Injection in GitHub repository froxlor/froxlor prior to 0.10.39.

XML External Entity (XXE) vulnerability in Trellix IPS Manager prior to 10.1 M8 allows a remote authenticated administra

Incorrect access control in the anti-virus driver wsdkd.sys of Watchdog Antivirus v1.4.158 allows attackers to write arb

In Splunk Enterprise versions below 8.1.12, 8.2.9, and 9.0.2, a remote user that holds the “power” Splunk role can store

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in JumpDEMAND Inc. 4ECPS Web Forms plugin <= 0.2.17 on Wo

Cross-Site Request Forgery (CSRF) vulnerability in David Cole Simple SEO plugin <= 1.8.12 on WordPress allows attackers

OpenHarmony-v3.1.2 and prior versions had a DOS vulnerability in distributedhardware_device_manager when joining a netwo

OpenHarmony-v3.1.2 and prior versions had an Arbitrary file read vulnerability via download_server. Local attackers can

CandidATS version 3.0.0 on 'page' of the 'ajax.php' resource, allows an external attacker to steal the cookie of arbitra

CandidATS version 3.0.0 on 'sortDirection' of the 'ajax.php' resource, allows an external attacker to steal the cookie o

CandidATS version 3.0.0 on 'sortBy' of the 'ajax.php' resource, allows an external attacker to steal the cookie of arbit

CandidATS version 3.0.0 on 'indexFile' of the 'ajax.php' resource, allows an external attacker to steal the cookie of ar

deep-parse-json version 1.0.2 allows an external attacker to edit or add new properties to an object. This is possible b

fastest-json-copy version 1.0.1 allows an external attacker to edit or add new properties to an object. This is possible

deep-object-diff version 1.1.0 allows an external attacker to edit or add new properties to an object. This is possible

Markdownify version 1.4.1 allows an external attacker to remotely obtain arbitrary local files on any client that attemp

Zettlr version 2.3.0 allows an external attacker to remotely obtain arbitrary local files on any client that attempts to

"IBM InfoSphere Information Server 11.7 could allow a user to cause a denial of service by removing the ability to run j

"IBM MQ Appliance 9.2 CD, 9.2 LTS, 9.3 CD, and LTS 9.3 does not invalidate session after logout which could allow an aut

Cross-Site Request Forgery (CSRF) vulnerability in a3rev Software Page View Count plugin <= 2.5.5 on WordPress allows an

"IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 Web services could allow a man-in-the-middle attacker to conduc

IBM Robotic Process Automation 21.0.1 and 21.0.2 could disclose sensitive version to an unauthorized control sphere info

Auth. (admin+) Cross-Site Scripting (XSS) vulnerability in Stage Rock Convert plugin <= 2.11.0 on WordPress.

Missing Authorization, Cross-Site Request Forgery (CSRF) vulnerability in David Cole Simple SEO (WordPress plugin) plugi

"IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed