2022

qubes-mirage-firewall (aka Mirage firewall for QubesOS) 0.8.x through 0.8.3 allows guest OS users to cause a denial of s

AyaCMS 3.1.2 is vulnerable to Remote Code Execution (RCE).

A stack overflow vulnerability exists in TrendNet Wireless AC Easy-Upgrader TEW-820AP (Version v1.0R, firmware version 1

Skycaiji v2.5.1 was discovered to contain a deserialization vulnerability via /SkycaijiApp/admin/controller/Mystore.php.

IBM Content Navigator 3.0.0, 3.0.1, 3.0.2, 3.0.3, 3.0.4, 3.0.5, 3.0.6, 3.0.7, 3.0.8, 3.0.9, 3.0.10, 3.0.11, and 3.0.12 i

Sanitization Management System v1.0 is vulnerable to SQL Injection via /php-sms/admin/?page=services/view_service&id=.

hope-boot 1.0.0 has a deserialization vulnerability that can cause Remote Code Execution (RCE).

An issue was discovered in ZZCMS 2022. There is a cross-site scripting (XSS) vulnerability in admin/ad_list.php.

IBM Business Process Manager 21.0.1 through 21.0.3.1, 20.0.0.1 through 20.0.0.2 19.0.0.1 through 19.0.0.3 is vulnerable

On Windows, restricted files can be accessed via os.DirFS and http.Dir. The os.DirFS function and http.Dir type provide

Due to improper sanitization of user input on Windows, the static file handler allows for directory traversal, allowing

A cross-site scripting (XSS) vulnerability in Book Store Management System v1.0.0 allows attackers to execute arbitrary

Improper neutralization of special elements used in an LDAP query ('LDAP Injection') vulnerability in ActiveDirectory an

Authentication bypass using an alternate path or channel vulnerability in bingo!CMS version1.7.4.1 and earlier allows a

Authentication bypass vulnerability in multiple Buffalo network devices allows a network-adjacent attacker to bypass aut

Hidden functionality vulnerability in multiple Buffalo network devices allows a network-adjacent attacker with an admini

Use of hard-coded credentials vulnerability in multiple Buffalo network devices allows a network-adjacent attacker to al

Code injection in paddle.audio.functional.get_window in PaddlePaddle 2.4.0-rc0 allows arbitrary code execution.

Out-of-bounds read in gather_tree in PaddlePaddle before 2.4. 

A vulnerability, which was classified as critical, was found in maku-boot up to 2.2.0. This affects the function doExecu

Cross-site scripting vulnerability in Movable Type Movable Type 7 r.5301 and earlier (Movable Type 7 Series), Movable Ty

Improper validation of syntactic correctness of input vulnerability exist in Movable Type series. Having a user to acces

Improper authentication vulnerability in UDR-JA1604/UDR-JA1608/UDR-JA1616 firmware versions 71x10.1.107112.43A and earli

Uncontrolled resource consumption vulnerability in Cybozu Remote Service 4.0.0 to 4.0.3 allows a remote authenticated at

OS command injection vulnerability in UDR-JA1604/UDR-JA1608/UDR-JA1616 firmware versions 71x10.1.107112.43A and earlier

Typora versions prior to 1.4.4 fails to properly neutralize JavaScript code, which may result in executing JavaScript co

Stack-based buffer overflow vulnerability exists in CX-Programmer v.9.77 and earlier, which may lead to information disc

Improper neutralization of Server-Side Includes (SSW) within a web page in Movable Type series allows a remote authentic

Out-of-bounds write vulnerability exists in CX-Programmer v.9.77 and earlier, which may lead to information disclosure a

Use-after free vulnerability exists in CX-Programmer v.9.77 and earlier, which may lead to information disclosure and/or

External initialization of trusted variables or data stores vulnerability exists in WordPress Popular Posts 6.0.5 and ea

Hidden functionality vulnerability in UDR-JA1604/UDR-JA1608/UDR-JA1616 firmware versions 71x10.1.107112.43A and earlier

Stored cross-site scripting vulnerability in User group management of baserCMS versions prior to 4.7.2 allows a remote a

Stored cross-site scripting vulnerability in Permission Settings of baserCMS versions prior to 4.7.2 allows a remote aut

In all versions of BIG-IP, when running in Appliance mode, an authenticated user assigned the Administrator role may be

tdpServer of TP-Link RE300 V1 improperly processes its input, which may allow an attacker to cause a denial-of-service (

In all versions,  BIG-IP and BIG-IQ are vulnerable to cross-site request forgery (CSRF) attacks through iControl SOAP. 

Cross-site scripting vulnerability in Aficio SP 4210N firmware versions prior to Web Support 1.05 allows a remote authen

A Cross-Site Request Forgery (CSRF) in the Administrator List of MetInfo v7.7 allows attackers to arbitrarily add Super

An issue in Markdown Preview Enhanced v0.6.5 and v0.19.6 for VSCode and Atom allows attackers to execute arbitrary comma

Markdown Preview Enhanced v0.6.5 and v0.19.6 for VSCode and Atom was discovered to contain a command injection vulnerabi

Simple Phone Book/Directory Web App v1.0 was discovered to contain a SQL injection vulnerability via the editid paramete

Online Leave Management System v1.0 was discovered to contain an arbitrary file upload vulnerability at /leave_system/cl

Online Leave Management System v1.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the c

Casdoor before v1.126.1 was discovered to contain an arbitrary file deletion vulnerability via the uploadFile function.

Rapid Software LLC Rapid SCADA 5.8.4 is vulnerable to Cross Site Scripting (XSS).

ILIAS before 7.16 allows External Control of File Name or Path.

ILIAS before 7.16 has an Open Redirect.

ILIAS before 7.16 allows XSS.

ILIAS before 7.16 allows OS Command Injection.