2022

PwnDoc through 0.5.3 might allow remote attackers to identify disabled user account names by leveraging response message

PwnDoc through 0.5.3 might allow remote attackers to identify valid user account names by leveraging response timings fo

An issue was discovered in OpenStack Sushy-Tools through 0.21.0 and VirtualBMC through 2.2.2. Changing the boot device c

wasm2c v1.0.29 was discovered to contain an abort in CWriter::Write.

The Log HTTP Requests plugin for WordPress is vulnerable to Stored Cross-Site Scripting via logged HTTP requests in vers

Using custom code, an attacker can write into name or description fields larger than the appropriate buffer size causing

A stored cross-site scripting (XSS) vulnerability in the Dashboard Configuration feature (index.php?module=dashboard_con

A stored cross-site scripting (XSS) vulnerability in the Users Access Groups feature (/index.php?module=users_groups/use

A stored cross-site scripting (XSS) vulnerability in the Users Alerts feature (/index.php?module=users_alerts/users_aler

A stored cross-site scripting (XSS) vulnerability in the Global Entities feature (/index.php?module=entities/entities) o

A stored cross-site scripting (XSS) vulnerability in the Global Variables feature (/index.php?module=global_vars/vars) o

A stored cross-site scripting (XSS) vulnerability in the Global Lists feature (/index.php?module=global_lists/lists) of

The Bricks theme for WordPress is vulnerable to authorization bypass due to a missing capability check on the bricks_sav

Unrestricted Upload of File with Dangerous Type vulnerability in OpenNebula OpenNebula core on Linux allows File Content

Files or Directories Accessible to External Parties vulnerability in OpenNebula on Linux allows File Discovery.

SEMCMS SHOP v 1.1 is vulnerable to Cross Site Scripting (XSS) via Ant_M_Coup.php.

Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in ExpressTech Quiz And Survey Master plugin <= 7.3

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Themepoints Testimonials plugin <= 2.6 on WordPress.

An information disclosure vulnerability in GitLab CE/EE affecting all versions starting from 9.3 before 15.2.5, all vers

An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.6 before 15.2.5, all versions start

Employee Record Management System v 1.2 is vulnerable to Cross Site Scripting (XSS) via editempprofile.php.

Hospital Management System v 4.0 is vulnerable to Cross Site Scripting (XSS) via /hospital/hms/admin/patient-search.php.

Using warp-cli command "add-trusted-ssid", a user was able to disconnect WARP client and bypass the "Lock WARP switch" f

It was possible for a user to delete a VPN profile from WARP mobile client on iOS platform despite the Lock WARP switch

Lock Warp switch is a feature of Zero Trust platform which, when enabled, prevents users of enrolled devices from disab

It was possible to bypass Lock WARP switch feature https://developers.cloudflare.com/cloudflare-one/connections/connect

It was possible to bypass policies configured for Zero Trust Secure Web Gateway by using warp-cli 'set-custom-endpoint'

A vulnerability was found in seccome Ehoney. It has been rated as critical. This issue affects some unknown processing o

A vulnerability was found in a port or fork of Redis. It has been declared as critical. This vulnerability affects unkno

A vulnerability was found in SourceCodester Web-Based Student Clearance System. It has been classified as critical. This

A vulnerability was found in seccome Ehoney and classified as critical. Affected by this issue is some unknown functiona

A vulnerability has been found in seccome Ehoney and classified as critical. Affected by this vulnerability is an unknow

A vulnerability, which was classified as critical, was found in seccome Ehoney. Affected is an unknown function of the f

A vulnerability, which was classified as critical, has been found in seccome Ehoney. This issue affects some unknown pro

Users can read any files by log server, Apache DolphinScheduler users should upgrade to version 2.0.6 or higher.

Attackers can create long chains of CAs that would lead to OctoRPKI exceeding its max iterations parameter. In consequen

The physical IoT device of the AliveCor's KardiaMobile, a smartphone-based personal electrocardiogram (EKG) has no encr

Advantech R-SeeNet Versions 2.4.19 and prior are vulnerable to path traversal attacks. An unauthorized attacker could r

Directory Traversal vulnerability in LiteSpeed Technologies OpenLiteSpeed Web Server and LiteSpeed Web Server dashboards

Softr v2.0 was discovered to contain a Cross-Site Scripting (XSS) vulnerability via the First Name parameter under the C

Multiple command injection vulnerabilities in GL.iNet GoodCloud IoT Device Management System Version 1.00.220412.00 via

Multiple stored cross-site scripting (XSS) vulnerabilities in GL.iNet GoodCloud IoT Device Management System Version 1.0

gl-inet GL-MT300N-V2 Mango v3.212 and GL-AX1800 Flint v3.214 were discovered to contain multiple command injection vulne

Incomplete filtering of JavaScript code in different configuration fields of the web based interface of the VIDEOJET mul

An error in the URL handler of the VIDEOJET multi 4000 may lead to a reflected cross site scripting (XSS) in the web-bas

Crash in the OPUS protocol dissector in Wireshark 3.6.0 to 3.6.8 allows denial of service via packet injection or crafte

It may be possible to gain some details of the deployment through a well-crafted attack. This may allow that data to be

Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. In Nextcloud Server pri

Password Storage Application v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Setup pag

A stored cross-site scripting (XSS) vulnerability in Simple Online Public Access Catalog v1.0 allows attackers to execut