2022

Improper Access Control in GitHub repository zulip/zulip prior to 4.10.

SangforCSClient.exe in Sangfor VDI Client 5.4.2.1006 allows attackers, when they are able to read process memory, to dis

MODX Revolution through 2.8.3-pl allows remote authenticated administrators to execute arbitrary code by uploading an ex

Tricentis qTest before 10.4 allows stored XSS by an authenticated attacker.

The Job Composer app in Ohio Supercomputer Center Open OnDemand before 1.7.19 and 1.8.x before 1.8.18 allows remote auth

Arbitrary Command Injection in GitHub repository strapi/strapi prior to 4.1.0.

Cross-site Scripting (XSS) - Reflected in GitHub repository microweber/microweber prior to 1.2.11.

Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.3.

Incorrect Authorization in GitHub repository microweber/microweber prior to 1.3.

On ICL ScadaFlex II SCADA Controller SC-1 and SC-2 1.03.07 devices, unauthenticated remote attackers can overwrite, dele

KDE KCron through 21.12.2 uses a temporary file in /tmp when saving, but reuses the filename during an editing session.

valid.c in libxml2 before 2.9.13 has a use-after-free of ID and IDREF attributes.

An issue was discovered in the Linux kernel through 5.16.11. The mixed IPID assignment method with the hash-based IPID a

Tor Browser 9.0.7 on Windows 10 build 10586 is vulnerable to information disclosure. This could allow local attackers to

Home Owners Collection Management System v1.0 was discovered to contain a SQL injection vulnerability via the id paramet

Home Owners Collection Management System v1.0 allows unauthenticated attackers to compromise user accounts via a crafted

Home Owners Collection Management System v1.0 was discovered to contain a remote code execution (RCE) vulnerability via

Zulip is an open-source team collaboration tool with topic-based threading. Zulip Server version 2.0.0 and above are vul

Weblate is a copyleft software web-based continuous localization system. Versions prior to 4.11 do not properly neutrali

In JetBrains TeamCity before 2021.2.3, environment variables of the "password" type could be logged in some cases.

JetBrains TeamCity before 2021.2.3 was vulnerable to OS command injection in the Agent Push feature configuration.

In JetBrains Hub before 2022.1.14434, SAML request takeover was possible.

JetBrains TeamCity before 2021.2.2 was vulnerable to reflected XSS.

JetBrains Hub before 2021.1.14276 was vulnerable to blind Server-Side Request Forgery (SSRF).

JetBrains Hub before 2021.1.14276 was vulnerable to reflected XSS.

TP-LINK TL-WR840N(ES)_V6.20_180709 was discovered to contain a remote code execution (RCE) vulnerability via the functio

TP-LINK TL-WR840N(ES)_V6.20_180709 was discovered to contain an integer overflow via the function dm_checkString. This v

TP-LINK TL-WR840N(ES)_V6.20_180709 was discovered to contain a command injection vulnerability via the component oal_set

TP-LINK TL-WR840N(ES)_V6.20_180709 was discovered to contain a command injection vulnerability via the component oal_sta

JetBrains YouTrack before 2021.4.40426 was vulnerable to SSTI (Server-Side Template Injection) via FreeMarker templates.

A command injection vulnerability in the function formImportOMCIShell of C-DATA ONU4FERW V2.1.13_X139 allows attackers t

Zepl Notebooks before 2021-10-25 are affected by a sandbox escape vulnerability. Upon launching Remote Code Execution fr

The package karma before 6.3.16 are vulnerable to Open Redirect due to missing validation of the return_url query parame

The affected product is vulnerable to a stack-based buffer overflow while processing project files, which may allow an a

The affected product is vulnerable to an out-of-bounds write while processing project files, which allows an attacker to

Exploitation of this vulnerability may result in local privilege escalation and code execution. GE maintains exploitatio

The affected product is vulnerable due to cleartext transmission of credentials seen in the CIMPLICITY network, which ca

The affected product is vulnerable to an out-of-bounds read while processing project files, which allows an attacker to

Use-after-free in eset_rtp kernel module used in ESET products for Linux allows potential attacker to trigger denial-of-

A cross-site scripting (XSS) vulnerability in PaquitoSoftware Notimoo v1.2 allows attackers to execute arbitrary web scr

PCManager versions 11.1.1.95 has a privilege escalation vulnerability. Successful exploit could allow the attacker to ac

The laser command injection vulnerability exists on AIS-BW80H-00 versions earlier than AIS-BW80H-00 9.0.3.4(H100SP13C00)

A cross-site scripting (XSS) vulnerability in the fileNameStr parameter of jQuery-Upload-File v4.0.11 allows attackers t

There is an improper permission management vulnerability in the Wallet apps. Successful exploitation of this vulnerabili

There is a DoS vulnerability in smartphones. Successful exploitation of this vulnerability may affect service integrity.

This issues due to insufficient verification of the various input values from user’s input. The vulnerability allows rem

There is a DoS vulnerability in smartphones. Successful exploitation of this vulnerability may affect service availabili

The interface of a certain HarmonyOS module has an integer overflow vulnerability. Successful exploitation of this vulne

The interface of a certain HarmonyOS module has an invalid address access vulnerability. Successful exploitation of this

The interface of a certain HarmonyOS module has a UAF vulnerability. Successful exploitation of this vulnerability may l