2022

Geon is a board game based on solving questions about the Pythagorean Theorem. Malicious users can obtain the uuid from

Flask-AppBuilder is an application development framework, built on top of the Flask web framework. Flask-AppBuilder cont

Moby is an open-source project created by Docker to enable and accelerate software containerization. A bug was found in

The BMC (IBM Power 9 AC922 OP910, OP920, OP930, and OP940) may be subject to a firmware downgrade attack which may affec

A Denial of Service vulnerability exists in mbed TLS 3.0.0 and earlier in the mbedtls_pkcs12_derivation function when an

An SQL Injection vulnerability exists in Dreamer CMS 4.0.0 via the tableName parameter.

MotionEye v0.42.1 and below allows attackers to access sensitive information via a GET request to /config/list. To explo

NVIDIA DCGM contains a vulnerability in nvhostengine, where a network user can cause detection of error conditions witho

SQL Injection in GitHub repository forkcms/forkcms prior to 5.11.1.

An Access Control vulnerability exists in SoroushPlus+ Messenger 1.0.30 in the Lock Screen Security Feature function due

Open Redirect on login in GitHub repository go-gitea/gitea prior to 1.16.5.

Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/data-hub prior to 1.2.4.

Improper Input Validation vulnerability in project file upload in Nozomi Networks Guardian and CMC allows an authenticat

Improper Input Validation vulnerability in custom report logo upload in Nozomi Networks Guardian, and CMC allows an auth

A Cross Site Scripting (XSS) vulnerability exists in Yogesh Ojha reNgine v1.0 via the Scan Engine name file in the Scan

In halo 1.4.14, the function point of uploading the avatar, any file can be uploaded, such as uploading an HTML file, wh

Heap Buffer Overflow in iterate_chained_fixups in GitHub repository radareorg/radare2 prior to 5.6.6.

An issue was discovered in ApiManager 1.1. there is sql injection vulnerability that can use in /index.php?act=api&tag=8

Cross-site Scripting (XSS) - Stored in GitHub repository forkcms/forkcms prior to 5.11.1.

Heap Buffer Overflow in parseDragons in GitHub repository radareorg/radare2 prior to 5.6.8.

Insecure Temporary File in GitHub repository horovod/horovod prior to 0.24.0.

OWASP Zed Attack Proxy (ZAP) through w2022-03-21 does not verify the TLS certificate chain of an HTTPS server.

GNOME OCRFeeder before 0.8.4 allows OS command injection via shell metacharacters in a PDF or image filename.

Tenda M3 1.10 V1.0.0.12(4856) was discovered to contain a command injection vulnerability via the component /cgi-bin/upl

Tenda M3 1.10 V1.0.0.12(4856) was discovered to contain a command injection vulnerability via the component /goform/SetI

Tenda M3 1.10 V1.0.0.12(4856) was discovered to contain a command injection vulnerability via the component /goform/SetL

Tenda M3 1.10 V1.0.0.12(4856) was discovered to contain a command injection vulnerability via the component /goform/setW

Tenda M3 1.10 V1.0.0.12(4856) was discovered to contain a command injection vulnerability via the component /goform/setP

Tenda M3 1.10 V1.0.0.12(4856) was discovered to contain a command injection vulnerability via the component /goform/setA

Tenda M3 1.10 V1.0.0.12(4856) was discovered to contain a command injection vulnerability via the component /cgi-bin/upl

Tenda M3 1.10 V1.0.0.12(4856) was discovered to contain a command injection vulnerability via the component /goform/delA

Tenda M3 1.10 V1.0.0.12(4856) was discovered to contain a command injection vulnerability via the component /goform/setF

Tenda M3 1.10 V1.0.0.12(4856) was discovered to contain a command injection vulnerability via the component /goform/Writ

Tenda M3 1.10 V1.0.0.12(4856) was discovered to contain a command injection vulnerability via the component /goform/exeC

D-Link DIR-816 A2 1.10 B05 allows unauthenticated attackers to arbitrarily reset the device via a crafted tokenid parame

Passwork On-Premise Edition before 4.6.13 has multiple XSS issues.

Passwork On-Premise Edition before 4.6.13 allows CSRF via the groups, password, and history subsystems.

Passwork On-Premise Edition before 4.6.13 allows migration/uploadExportFile Directory Traversal (to upload files).

Passwork On-Premise Edition before 4.6.13 allows migration/downloadExportFile Directory Traversal (to read files).

The remote keyless system on Honda Civic 2018 vehicles sends the same RF signal for each door-open request, which allows

The Reporting module in Aseco Lietuva document management system DVS Avilys before 3.5.58 allows unauthorized file downl

OpenEMR v6.0.0 was discovered to contain an incorrect access control issue.

wpsupdater.exe in Kingsoft WPS Office through 11.2.0.10382 allows remote code execution by modifying HKEY_CURRENT_USER i

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All unpatched versions of Argo CD starting wit

NXP LPC55S66JBD64, LPC55S66JBD100, LPC55S66JEV98, LPC55S69JBD64, LPC55S69JBD100, and LPC55S69JEV98 microcontrollers (ROM

Razer Synapse before 3.7.0228.022817 allows privilege escalation because it relies on %PROGRAMDATA%\Razer\Synapse3\Servi

Whatsapp iOS 2.19.80 and prior and Android 2.19.222 and prior user interface does not properly represent URI messages to

iMessage (Messages app) iOS 12.4 and prior user interface does not properly represent URI messages to the user, which re

Instagram iOS 106.0 and prior and Android 107.0.0.11 and prior user interface does not properly represent URI messages t

The Facebook Messenger app for iOS 227.0 and prior and Android 228.1.0.10.116 and prior user interface does not properly