2022

Client-side JavaScript controls may be bypassed to change user credentials and permissions without authentication, inclu

The www-data (Apache web server) account is configured to run sudo with no password for many commands (including /bin/sh

An attacker with weak credentials could access the TCP port via an open FTP port, allowing an attacker to read sensitive

Controls limiting uploads to certain file extensions may be bypassed. This could allow an attacker to intercept the init

A remote authentication bypass vulnerability was discovered in HPE Cray Legacy Shasta System Solutions; HPE Slingshot; a

Concrete CMS Versions 9.0.0 through 9.0.2 and 8.5.7 and below can download zip files over HTTP and execute code from tho

Weak default root user credentials allow remote attackers to easily obtain OS superuser privileges over the open TCP por

LRM does not implement authentication or authorization by default. A malicious actor can inject, replay, modify, and/or

LRM does not restrict the types of files that can be uploaded to the affected product. A malicious actor can upload any

LRM contains a directory traversal vulnerability that can allow a malicious actor to upload outside the intended directo

LRM utilizes elevated privileges. An unauthenticated malicious actor can upload and execute code remotely at the operati

In CODESYS V2 PLCWinNT and Runtime Toolkit 32 in versions prior to V2.4.7.57 password protection is not enabled by defau

In CODESYS Gateway Server V2 for versions prior to V2.3.9.38 only a part of the the specified password is been compared

Jenkins xUnit Plugin 3.0.8 and earlier implements an agent-to-controller message that creates a user-specified directory

The function that calls the diff tool in Diffy 3.4.1 does not properly handle double quotes in a filename when run in a

Pure Storage FlashArray products running Purity//FA 6.2.0 - 6.2.3, 6.1.0 - 6.1.12, 6.0.0 - 6.0.8, 5.3.0 - 5.3.17, 5.2.x

IdeaTMS 2022 is vulnerable to SQL Injection via the PATH_INFO

Docebo Community Edition v4.0.5 and below was discovered to contain a SQL injection vulnerability. NOTE: This vulnerabil

A Spring Data MongoDB application is vulnerable to SpEL Injection when using @Query or @Aggregation-annotated query meth

Laiketui 3.5.0 is affected by an arbitrary file upload vulnerability that can allow an attacker to execute arbitrary cod

The Quectel RG502Q-EA modem before 2022-02-23 allow OS Command Injection.

iSpyConnect iSpy v7.2.2.0 allows attackers to bypass authentication via a crafted URL.

iSpy v7.2.2.0 is vulnerable to remote command execution via path traversal.

A vulnerability has been identified in Cerberus DMS (All versions), Desigo CC (All versions), Desigo CC Compact (All ver

An arbitrary file upload vulnerability /images/background/1.php in of SolarView Compact 6.0 allows attackers to execute

An unauthenticated, remote attacker could upload malicious logic to the devices based on ProConOS/ProConOS eCLR in order

An unauthenticated, remote attacker could upload malicious logic to devices based on ProConOS/ProConOS eCLR in order to

Unrestricted Upload of File with Dangerous Type in GitHub repository polonel/trudesk prior to 1.2.4.

IBM Curam Social Program Management 8.0.0 and 8.0.1 does not invalidate session after logout which could allow an authen

IBM Curam Social Program Management 8.0.0 and 8.0.1 does not invalidate session after logout which could allow an authen

An issue was discovered on Fujitsu ETERNUS CentricStor CS8000 (Control Center) devices before 8.1A SP02 P04. The vulnera

An issue was discovered on Fujitsu ETERNUS CentricStor CS8000 (Control Center) devices before 8.1A SP02 P04. The vulnera

A cross-site scripting (XSS) vulnerability in the web tracking component of Mautic before 4.3.0 allows remote attackers

The Events Made Easy WordPress plugin before 2.2.81 does not properly sanitise and escape a parameter before using it in

Incorrect Use of Privileged APIs in GitHub repository polonel/trudesk prior to 1.2.4.

An issue was discovered in TitanFTP (aka Titan FTP) NextGen before 1.2.1050. There is Remote Code Execution due to a har

ASUS RT-N53 3.0.0.4.376.3754 has a command injection vulnerability in the SystemCmd parameter of the apply.cgi interface

Rescue Dispatch Management System v1.0 is vulnerable to SQL Injection via \rdms\admin?page=user\manage_user&id=.

A stack-based buffer overflow vulnerability exists in the BlynkConsole.h runCommand functionality of Blynk -Library v1.0

A use-after-free vulnerability exists in the mips_collector appsrv_server functionality of Anker Eufy Homebase 2 2.1.8.5

Proietti Tech srl Planet Time Enterprise 4.2.0.1,4.2.0.0,4.1.0.0,4.0.0.0,3.3.1.0,3.3.0.0 is vulnerable to Remote code ex

In some cases, an unsuccessful attempt to log into IBM Spectrum Protect Operations Center 8.1.0.000 through 8.1.14.000 d

Online Ordering System v2.3.2 was discovered to contain a SQL injection vulnerability via /ordering/admin/inventory/inde

Online Ordering System v2.3.2 was discovered to contain a SQL injection vulnerability via /ordering/admin/store/index.ph

Online Ordering System v2.3.2 was discovered to contain a SQL injection vulnerability via /ordering/index.php?q=category

A vulnerability in Antminer Monitor 0.50.0 exists because of backdoor or misconfiguration inside a settings file in flas

A vulnerability in the management interface of MiVoice Business through 9.3 PR1 and MiVoice Business Express through 8.0

Online Discussion Forum Site 1 was discovered to contain a blind SQL injection vulnerability via the component /odfs/pos

ASG technologies ( A Rocket Software Company) ASG-Zena Cross Platform Server Enterprise Edition 4.2.1 is vulnerable to X

VoIPmonitor WEB GUI up to version 24.61 is affected by SQL injection through the "api.php" file and "user" parameter.