2022

A lack of appropriate timeouts in GitLab Pages included in GitLab CE/EE all versions prior to 14.7.7, 14.8 prior to 14.8

Missing filtering in an error message in GitLab CE/EE affecting all versions prior to 14.7.7, 14.8 prior to 14.8.5, and

A business logic error in Project Import in GitLab CE/EE versions 14.9 prior to 14.9.2, 14.8 prior to 14.8.5, and 14.0 p

An improper access control vulnerability in GitLab CE/EE affecting all versions from 13.11 prior to 14.7.7, 14.8 prior t

A potential DOS vulnerability was discovered in GitLab CE/EE affecting all versions from 13.1 prior to 14.7.7, 14.8.0 pr

Adding a very large number of tags to a runner in GitLab CE/EE affecting all versions prior to 14.7.7, 14.8 prior to 14.

Incorrect authorization in the Asana integration's branch restriction feature in all versions of GitLab CE/EE starting f

Authenticated (editor or higher user role) Cross-Site Scripting (XSS) vulnerability in Web-Settler Testimonial Slider –

Authenticated (subscriber or higher user role if allowed to access projects) Stored Cross-Site Scripting (XSS) vulnerabi

An exception is thrown from a function in AVEVA System Platform versions 2017 through 2020 R2 P01, but it is not caught,

AVEVA System Platform versions 2017 through 2020 R2 P01 does not perform any authentication for functionality that requi

Softing OPC UA C++ SDK (Software Development Kit) versions from 5.59 to 5.64 exported library functions don't properly v

After Automation Direct CLICK PLC CPU Modules: C0-1x CPUs with firmware prior to v3.00 is unlocked by an authorized user

AVEVA System Platform versions 2017 through 2020 R2 P01 does not properly verify that the source of data or communicatio

All programming connections receive the same unlocked privileges, which can result in a privilege escalation. During the

Automation Direct CLICK PLC CPU Modules: C0-1x CPUs with firmware prior to v3.00 passwords are sent as plaintext during

AVEVA System Platform versions 2017 through 2020 R2 P01 uses external input to construct a pathname that is intended to

Automation Direct CLICK PLC CPU Modules: C0-1x CPUs with firmware prior to v3.00 does not protect against additional sof

The programming protocol allows for a previously entered password and lock state to be read by an attacker. If the previ

AVEVA System Platform versions 2017 through 2020 R2 P01 does not verify, or incorrectly verifies, the cryptographic sign

Xerox ColorQube 8580 was discovered to contain an access control issue which allows attackers to print, view the status,

Bettini Srl GAMS Product Line v4.3.0 was discovered to re-use static SSH keys across installations, allowing unauthentic

Directus is a real-time API and App dashboard for managing SQL database content. Prior to version 9.7.0, unauthorized Ja

CreateWiki is Miraheze's MediaWiki extension for requesting & creating wikis. Without the patch for this issue, anonymou

Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to version 22.4.0rc1, the T

Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine. In version 0.3.1 and prior, bytestrings ca

Server-Side Request Forgery (SSRF) in GitHub repository janeczku/calibre-web prior to 0.6.18.

A Remiote Code Execution (RCE) vulnerability exiss in Subrion CMS 4.2.1 via modified code in a background field; when th

Moment.js is a JavaScript date library for parsing, validating, manipulating, and formatting dates. A path traversal vul

An Access Control vulnerability exists in HisiPHP 2.0.11 via special packets that are constructed in $files = Dir::getLi

In the Noo JobMonster WordPress theme before 4.5.2.9 JobMonster there is a XSS vulnerability as the input for the search

There is a XSS vulnerability in Careerfy.

There is a Cross-Site Scripting vulnerability in the JobSearch WP JobSearch WordPress plugin before 1.5.1.

There are unauthenticated reflected Cross-Site Scripting (XSS) vulnerabilities in CareerUp Careerup WordPress theme befo

The JobMonster Theme was vulnerable to Directory Listing in the /wp-content/uploads/jobmonster/ folder, as it did not in

The Blackhole for Bad Bots WordPress plugin before 3.3.2 uses headers such as CF-CONNECTING-IP, CLIENT-IP etc to determi

The Wyzi Theme was affected by reflected XSS vulnerabilities in the business search feature

The Mark Posts WordPress plugin before 2.0.1 does not escape new markers, allowing high privilege users such as admin to

The Ad Inserter Free and Pro WordPress plugins before 2.7.12 do not sanitise and escape the REQUEST_URI before outputtin

The Easy Social Icons WordPress plugin before 3.1.4 does not sanitize the selected_icons attribute to the cnss_widget be

The Profile Builder WordPress plugin before 3.6.8 does not sanitise and escape Form Fields titles and description, which

The UpdraftPlus WordPress Backup Plugin WordPress plugin before 1.22.9 does not sanitise and escape the updraft_interval

The Amelia WordPress plugin before 1.0.48 does not have proper authorisation when handling Amelia SMS service, allowing

The FormBuilder WordPress plugin through 1.08 does not have CSRF checks in place when creating/updating and deleting for

The Amelia WordPress plugin before 1.0.49 does not have proper authorisation when managing appointments, allowing any cu

The Booking Package WordPress plugin before 1.5.29 requires a token for exporting the ical representation of it's bookin

The MapPress Maps for WordPress plugin before 2.73.13 allows a high privileged user to bypass the DISALLOW_FILE_EDIT and

The Insights from Google PageSpeed WordPress plugin before 4.0.4 does not sanitise and escape various parameters before

The Material Design for Contact Form 7 WordPress plugin through 2.6.4 does not check authorization or that the option me

The Library File Manager WordPress plugin before 5.2.3 is using an outdated version of the elFinder library, which is kn