2022

IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the AIX kernel

Code Injection in GitHub repository dolibarr/dolibarr prior to 15.0.1.

Qt through 5.15.8 and 6.x through 6.2.3 can load system library files from an unintended working directory.

An issue was discovered in Zoho ManageEngine Key Manager Plus before 6200. A service exposed by the application allows a

Zoho ManageEngine SharePoint Manager Plus before 4329 allows account takeover because authorization is mishandled.

Zoho ManageEngine SharePoint Manager Plus before 4329 is vulnerable to a sensitive data leak that leads to privilege esc

Zoho ManageEngine Desktop Central before 10.1.2137.8 exposes the installed server name to anyone. The internal hostname

jQuery Cookie 1.4.1 is affected by prototype pollution, which can lead to DOM cross-site scripting (XSS).

Improper Authorization in GitHub repository webmin/webmin prior to 1.990.

Improper Access Control to Remote Code Execution in GitHub repository webmin/webmin prior to 1.990.

An exposure of sensitive system information to an unauthorized control sphere vulnerability [CWE-497] in FortiManager ve

An improper neutralization of special elements used in an OS Command vulnerability [CWE-78] in FortiAP-C console 5.4.0 t

An improper access control vulnerability [CWE-284 ] in FortiToken Mobile (Android) external push notification 5.1.0 and

Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository scrapy/scrapy prior to 2.6.1.

An Off-by-one Error occurs in cmr113_decode of rtl_433 21.12 when decoding a crafted file.

rtl_433 21.12 was discovered to contain a stack overflow in the function somfy_iohc_decode(). This vulnerability allows

tsMuxer git-c6a0277 was discovered to contain a segmentation fault via DTSStreamReader::findFrame in dtsStreamReader.cpp

tsMuxer git-2678966 was discovered to contain a heap-based buffer overflow via the function HevcUnit::updateBits in hevc

There is an Assertion `num <= INT_BIT' failed at BitStreamReader::skipBits in /bitStream.h:132 of tsMuxer git-c6a0277.

An integer overflow in DTSStreamReader::findFrame() of tsMuxer git-2678966 allows attackers to cause a Denial of Service

Argus Surveillance DVR v4.0 employs weak password encryption.

The component /rootfs in RageFile of Stepmania v5.1b2 and below allows attackers access to the entire file system.

image_processing is an image processing wrapper for libvips and ImageMagick/GraphicsMagick. Prior to version 1.12.2, usi

Extensis Portfolio v4.0 was discovered to contain hardcoded credentials which allows attackers to gain administrator pri

An unrestricted file upload vulnerability in the Backup/Restore Archive component of Extensis Portfolio v4.0 allows remo

Extensis Portfolio v4.0 was discovered to contain an authenticated unrestricted file upload vulnerability via the compon

An unrestricted file upload vulnerability in the FileTransferServlet component of Extensis Portfolio v4.0 allows remote

Extensis Portfolio v4.0 was discovered to contain an authenticated unrestricted file upload vulnerability via the Catalo

Insecure permissions in the file database.sdb of BatFlat CMS v1.3.6 allows attackers to dump the entire database.

diag_routes.php in pfSense 2.5.2 allows sed data injection. Authenticated users are intended to be able to view data abo

Fluture-Node is a FP-style HTTP and streaming utils for Node based on Fluture. Using `followRedirects` or `followRedirec

ssr-pages is an HTML page builder for the purpose of server-side rendering (SSR). In versions prior to 0.1.4, a path tra

ssr-pages is an HTML page builder for the purpose of server-side rendering (SSR). In versions prior to 0.1.5, a cross si

A improper handling of insufficient permissions or privileges in Fortinet FortiAnalyzer version 5.6.0 through 5.6.11, Fo

A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiWLM version 8.6.

A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM versio

wire-avs is the audio visual signaling (AVS) component of Wire, an open-source messenger. A remote format string vulnera

An improper input validation vulnerability in the web server CGI facilities of FortiMail before 7.0.1 may allow an unaut

A improper input validation in Fortinet FortiGate version 6.4.3 and below, version 6.2.5 and below, version 6.0.11 and b

The use of a cryptographically weak pseudo-random number generator in the password reset feature of FortiPortal before 6

An improper authentication vulnerability in FortiMail before 7.0.1 may allow a remote attacker to efficiently guess one

An issue was discovered in taocms 3.0.2. This is a SQL blind injection that can obtain database data through the Comment

IBM MQ Appliance 9.2 CD and 9.2 LTS local messaging users stored with a password hash that provides insufficient protect

IBM MQ Appliance 9.2 CD and 9.2 LTS does not invalidate session after logout which could allow an authenticated user to

IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a local user with elevated privileges to cause a denial of service due t

A security vulnerability in the Spectrum Scale 5.0 and 5.1 allows a non-root user to overflow the mmfsd daemon with requ

ZyXEL ZyWALL 2 Plus Internet Security Appliance is affected by Cross Site Scripting (XSS). Insecure URI handling leads t

AyaCMS 3.1.2 is vulnerable to Remote Code Execution (RCE) via /aya/module/admin/ust_tab_e.inc.php,

There is a SQL injection vulnerability in the background of taocms 3.0.2 in parameter id:action=admin&id=2&ctrl=edit.

Archeevo below 5.0 is affected by local file inclusion through file=~/web.config to allow an attacker to retrieve local