2022

A random memory access flaw was found in the Linux kernel's GPU i915 kernel driver functionality in the way a user may r

A flaw was found in the sctp_make_strreset_req function in net/sctp/sm_make_chunk.c in the SCTP network protocol in the

A use-after-free read flaw was found in sock_getsockopt() in net/core/sock.c due to SO_PEERCRED and SO_PEERGROUPS race w

A use-after-free flaw was found in nci_request in net/nfc/nci/core.c in NFC Controller Interface (NCI) in the Linux kern

An out of memory bounds write flaw (1 or 2 bytes of memory) in the Linux kernel NFS subsystem was found in the way users

A flaw was found in the libvirt libxl driver. A malicious guest could continuously reboot itself and cause libvirtd on t

Delta Electronics CNCSoft (Version 1.01.30) and prior) is vulnerable to an out-of-bounds read while processing a specifi

GE Gas Power ToolBoxST Version v04.07.05C suffers from an XML external entity (XXE) vulnerability using the DTD paramete

This vulnerability can be exploited by parsing maliciously crafted project files with Horner Automation Cscape EnvisionR

In ImfChromaticities.cpp routine RGBtoXYZ(), there are some division operations such as `float Z = (1 - chroma.white.x -

An integer overflow could occur when OpenEXR processes a crafted file on systems where size_t < 64 bits. This could caus

It was found that 3scale's APIdocs does not validate the access token, in the case of invalid token, it uses session aut

A flaw was found in the QEMU implementation of VMWare's paravirtual RDMA device. The issue occurs while handling a "PVRD

A flaw was found in Caribou due to a regression of CVE-2020-25712 fix. An attacker could use this flaw to bypass screen-

The lack of validation of a key-value field in the Splunk-to-Splunk protocol results in a denial-of-service in Splunk En

SolarWinds received a report of a vulnerability related to an input that was not sanitized in WebHelpDesk. SolarWinds ha

An remote code execution vulnerability due to SSTI vulnerability and insufficient file name parameter validation was dis

An Buffer Overflow vulnerability leading to remote code execution was discovered in MEX01. Remote attackers can use this

An improper authentication vulnerability leading to information leakage was discovered in iptime NAS2dual. Remote attack

In cloud foundry CAPI versions prior to 1.122, a denial-of-service attack in which a developer can push a service broker

A POST based reflected Cross Site Scripting vulnerability on has been identified in Keycloak.

An improper authorization handling flaw was found in Foreman. The OpenSCAP plugin for the smart-proxy allows foreman cli

slaacd in OpenBSD 6.9 and 7.0 before 2022-03-22 has an integer signedness error and resultant heap-based buffer overflow

engine.c in slaacd in OpenBSD 6.9 and 7.0 before 2022-02-21 has a buffer overflow triggerable by an IPv6 router advertis

The imgcrypt library provides API exensions for containerd to support encrypted container images and implements the ctd-

Two Buffer Overflow vulnerabilities exists in T10 V2_Firmware V4.1.8cu.5207_B20210320 in the http_request_parse function

Yonyou u8 v13.0 was discovered to contain a DOM-based cross-site scripting (XSS) vulnerability via the component /u8sl/W

A stored cross-site scripting (XSS) vulnerability in the Column module of ClassCMS v2.5 and below allows attackers to ex

ALF-BanCO v8.2.5 and below was discovered to use a hardcoded password to encrypt the SQLite database containing the user

grpc-swift is the Swift language implementation of gRPC, a remote procedure call (RPC) framework. Prior to version 1.7.2

An SQL Injection vlnerability exits in Yeswiki doryphore 20211012 via the email parameter in the registration form.

A stored cross-site scripting (XSS) vulnerability in the upload function of /admin/show.php allows attackers to execute

phpIPAM 1.4.4 allows Reflected XSS and CSRF via app/admin/subnets/find_free_section_subnets.php of the subnets functiona

An XML External Entity (XXE) vulnerability exists in soa-model before 1.6.4 in the WSDLParser function.

A File Deletion vulnerability exists in TinyShop 3.1.1 in the back_list parameter in controllers\admin.php, which could

In PowerDNS Authoritative Server before 4.4.3, 4.5.x before 4.5.4, and 4.6.x before 4.6.1 and PowerDNS Recursor before 4

SQL injection through marking blog comments on bulk as spam in GitHub repository forkcms/forkcms prior to 5.11.1.

An authentication bypass vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Sopho

A vulnerability affecting F-Secure SAFE browser was discovered. A maliciously crafted website attached with USSD code in

zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matche

Improper neutralization of special elements used in a command ('Command Injection') vulnerability in File service functi

Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in Authentication functionality in

Anchor CMS v0.12.7 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component anchor/routes/posts.p

TuziCMS v2.0.6 was discovered to contain a SQL injection vulnerability via the component App\Manage\Controller\ZhuantiCo

EyouCMS v1.5.5 was discovered to have no access control in the component /data/sqldata.

A remote code execution (RCE) vulnerability in Ionize v1.0.8.1 allows attackers to execute arbitrary code via a crafted

Survey King v0.3.0 does not filter data properly when exporting excel files, allowing attackers to execute arbitrary cod

Multiple cross-site scripting (XSS) vulnerabilities in Parking Management System v1.0 allows attackers to execute arbitr

Bluedon Information Security Technologies Co.,Ltd Internet Access Detector v1.0 was discovered to contain an information

Discourse is an open source discussion platform. Versions 2.8.2 and prior in the `stable` branch, 2.9.0.beta3 and prior