2022

ID numbers displayed in the quiz grading report required additional sanitizing to prevent a stored XSS risk. Moodle 3.10

An SQL injection risk existed on sites with MNet enabled and configured, via an XML-RPC call from the connected peer hos

It was possible for a student to view their quiz grade before it had been released, using a quiz web service. Moodle 3.1

Teachers exporting a forum in CSV format could receive a CSV of forums from all courses in some circumstances. Moodle ve

Cross-site Scripting (XSS) vulnerability in firmware section of Secomea GateManager allows logged in user to inject java

An attacker could exploit this vulnerability in Hitachi ABB Power Grids Ellipse Enterprise Asset Management (EAM) versio

An attacker could trick a user of Hitachi ABB Power Grids Ellipse Enterprise Asset Management (EAM) versions prior to an

LFENCE/JMP (mitigation V2-2) may not sufficiently mitigate CVE-2017-5715 on some AMD CPUs.

Some AMD CPUs may transiently execute beyond unconditional direct branches, which may potentially result in data leakage

In ACE2 ColorOS11, the attacker can obtain the foreground package name through permission promotion, resulting in user i

The package simple-git before 3.3.0 are vulnerable to Command Injection via argument injection. When calling the .fetch(

A Command Injection vulnerability exits in TOTOLINK A3100R <=V4.1.2cu.5050_B20200504 in adm/ntm.asp via the hosTime para

A Server-side Template Injection (SSTI) vulnerability exists in Nystudio107 Seomatic 3.4.12 in src/helpers/UrlHelper.php

Missing Authorization in GitHub repository saleor/saleor prior to 3.1.2.

NVIDIA distributions of Jetson Linux contain a vulnerability where an error in the IOMMU configuration may allow an unpr

Improper Authorization in GitHub repository cobbler/cobbler prior to 3.3.2.

Missing Authorization in GitHub repository gogs/gogs prior to 0.12.5.

Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.2.12.

Server-Side Request Forgery (SSRF) in GitHub repository gogs/gogs prior to 0.12.5.

Integer Overflow or Wraparound in GitHub repository microweber/microweber prior to 1.3.

Unrestricted Upload of File with Dangerous Type in GitHub repository microweber/microweber prior to 1.2.11.

The following Yokogawa Electric products hard-code the password for CAMS server applications: CENTUM VP versions from R5

The following Yokogawa Electric products contain insecure DLL loading issues. CENTUM CS 3000 versions from R3.08.10 to R

CAMS for HIS Server contained in the following Yokogawa Electric products improperly authenticate the receiving packets.

CAMS for HIS Log Server contained in the following Yokogawa Electric products fails to properly neutralize log outputs:

'Root Service' service implemented in the following Yokogawa Electric products creates some named pipe with improper ACL

CAMS for HIS Log Server contained in the following Yokogawa Electric products is vulnerable to uncontrolled resource con

'Long-term Data Archive Package' service implemented in the following Yokogawa Electric products creates some named pipe

Path traversal vulnerability exists in CAMS for HIS Server contained in the following Yokogawa Electric products: CENTUM

The following Yokogawa Electric products do not change the passwords of the internal Windows accounts from the initial c

There is a path traversal vulnerability in CAMS for HIS Log Server contained in the following Yokogawa Electric products

drivers/bluetooth/virtio_bt.c in the Linux kernel before 5.16.3 has a memory leak (socket buffers have memory allocated

lib/Horde/Mime/Viewer/Ooo.php in Horde Mime_Viewer before 2.2.4 allows XSS via an OpenOffice document, leading to accoun

The swagger-ui-dist package before 4.1.3 for Node.js could allow a remote attacker to hijack the clicking action of the

jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of nested o

Swagger UI 4.1.2 and earlier could allow a remote attacker to conduct spoofing attacks. By persuading a victim to open a

Cross-site Scripting (XSS) - Reflected in GitHub repository orchardcms/orchardcore prior to 1.3.0.

FreeTAKServer-UI v1.9.8 was discovered to leak sensitive API and Websocket keys.

An issue in the ?filename= argument of the route /DataPackageTable in FreeTAKServer-UI v1.9.8 allows attackers to place

FreeTAKServer 1.9.8 contains a hardcoded Flask secret key which allows attackers to create crafted cookies to bypass aut

An access control issue in the component /ManageRoute/postRoute of FreeTAKServer v1.9.8 allows unauthenticated attackers

FreeTAKServer-UI v1.9.8 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Callsign par

FreeTAKServer-UI v1.9.8 was discovered to contain a SQL injection vulnerability via the API endpoint /AuthenticateUser.

Improper Authorization in GitHub repository orchardcms/orchardcore prior to 1.3.0.

Cross-site Scripting (XSS) - Stored in GitHub repository orchardcms/orchardcore prior to 1.3.0.

Improper access control vulnerability in McAfee WebAdvisor Chrome and Edge browser extensions up to 8.1.0.1895 allows a

A race condition vulnerability exists in the QuickClean feature of McAfee Total Protection for Windows prior to 16.0.43

UltraVNC is a free and open source remote pc access software. A vulnerability has been found in versions prior to 1.3.8.

Istio is an open platform to connect, manage, and secure microservices. In affected versions the Istio control plane, is

A Cross Site Scripting (XSS) vulnerabilitiy exits in jeecg-boot 3.0 in /jeecg-boot/jmreport/view with a mouseover event.