2022

An issue was discovered in illumos before f859e7171bb5db34321e45585839c6c3200ebb90, OmniOS Community Edition r151038, Op

In Philips (formerly Carestream) Vue MyVue PACS through 12.2.x.x, the VideoStream function allows Path Traversal by auth

fastrack Reflex 2.0 W307S_REFLEX_v90.89 Activity Tracker allows a Remote attacker to change the time, date, and month vi

Certain General Electric Renewable Energy products store cleartext credentials in flash memory. This affects iNET and iN

An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. There is Blind Store

An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. The REST API publicl

OX App Suite through 7.10.6 allows XSS via a malicious capability to the metrics or help module, as demonstrated by a /#

OX App Suite through 7.10.6 allows XSS via script code within a contact that has an e-mail address but lacks a name.

OX App Suite through 8.2 allows XSS via a certain complex hierarchy that forces use of Show Entire Message for a huge HT

OX App Suite through 8.2 allows XSS because BMFreehand10 and image/x-freehand are not blocked.

OX App Suite through 7.10.6 allows XSS via HTML in text/plain e-mail messages.

OX App Suite through 7.10.6 allows SSRF because the anti-SSRF protection mechanism only checks the first DNS AA or AAAA

OX App Suite through 7.10.6 has Uncontrolled Resource Consumption via a large request body containing a redirect URL to

OX App Suite through 7.10.6 has Uncontrolled Resource Consumption via a large location request parameter to the redirect

OX App Suite through 7.10.6 allows XSS via XHTML CDATA for a snippet, as demonstrated by the onerror attribute of an IMG

OX App Suite through 7.10.6 allows XSS via a deep link, as demonstrated by class="deep-link-app" for a /#!!&app=%2e./ UR

A vulnerability was found in docconv up to 1.2.0 and classified as problematic. This issue affects the function ConvertD

A vulnerability classified as problematic has been found in SourceCodester Blood Bank Management System 1.0. Affected is

A vulnerability was found in styler_praat_scripts. It has been classified as problematic. Affected is an unknown functio

A vulnerability has been found in Starcounter-Jack JSON-Patch up to 3.1.0 and classified as problematic. This vulnerabil

A vulnerability, which was classified as critical, was found in hughsk flat up to 5.0.0. This affects the function unfla

A vulnerability was found in barronwaffles dwc_network_server_emulator. It has been declared as critical. This vulnerabi

A vulnerability was found in FreePBX cdr 14.0. It has been classified as critical. This affects the function ajaxHandler

An issue was discovered in Squid 4.9 through 4.17 and 5.0.6 through 5.6. Due to inconsistent handling of internal URIs,

A vulnerability classified as problematic has been found in cronvel tree-kit up to 0.6.x. This affects an unknown part.

** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in dns-stats hedgehog. It has been rated as problematic. Affec

A vulnerability classified as critical was found in SimbCo httpster. This vulnerability affects the function fs.realpath

A vulnerability classified as critical has been found in Calsign APDE. This affects the function handleExtract of the fi

A vulnerability was found in Macaron i18n. It has been declared as problematic. Affected by this vulnerability is an unk

Planet eStream before 6.72.10.07 discloses sensitive information, related to the ON cookie (findable in HTML source code

GetFile.aspx in Planet eStream before 6.72.10.07 allows ..\ directory traversal to read arbitrary local files.

Snipe-IT through 6.0.14 allows attackers to check whether a user account exists because of response variations in a /pas

Snipe-IT before 6.0.14 is vulnerable to Cross Site Scripting (XSS) for View Assigned Assets.

An issue was discovered in Simmeth Lieferantenmanager before 5.6. In the design of the API, a user is inherently able to

An issue was discovered in /DS/LM_API/api/SelectionService/InsertQueryWithActiveRelationsReturnId in Simmeth Lieferanten

In Planet eStream before 6.72.10.07, multiple Stored Cross-Site Scripting (XSS) vulnerabilities exist: Disclaimer, Searc

In Planet eStream before 6.72.10.07, a Reflected Cross-Site Scripting (XSS) vulnerability exists via any metadata filter

Brave Browser before 1.43.88 allowed a remote attacker to cause a denial of service in private and guest windows via a c

Brave Browser before 1.42.51 allowed a remote attacker to cause a denial of service via a crafted HTML file that referen

Brave Browser before 1.43.34 allowed a remote attacker to cause a denial of service via a crafted HTML file that mention

IBM Navigator for i 7.3, 7.4, and 7.5 could allow an authenticated user to obtain sensitive information they are authori

IBM Security Verify Governance, Identity Manager 10.01 could allow a remote attacker to obtain sensitive information whe

Typora through 1.3.8 allows XSS if a document containing an SVG element with an attacker-controlled onload attribute is

An issue was discovered in the Linux kernel 5.10.x before 5.10.155. A use-after-free in io_sqpoll_wait_sq in fs/io_uring

Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.0.

IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1could allow a non-privileged local user to exploit a vulnerability in the AIX pfcdd k

IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the AIX perfst

IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1could allow a non-privileged local user to exploit a vulnerability in the AIX kernel

IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1could allow a non-privileged local user to exploit a vulnerability in the AIX SMB cl

IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the AIX NFS k