2022

Two heap-overflow vulnerabilities exist in openSUSE/libsolv libsolv through 13 Dec 2020 in the decisionmap variable via

All versions of Samba prior to 4.15.5 are vulnerable to a malicious client using a server symlink to determine if a file

Brocade Fabric OS before Brocade Fabric OS v8.2.1c, v8.1.2h, and all versions of Brocade Fabric OS v8.0.x and v7.x conta

A vulnerability in Brocade Fabric OS versions before Brocade Fabric OS v8.0.1b, v7.4.1d could allow an authenticated att

"Sametime Android potential path traversal vulnerability when using File class"

"Sametime Android PathTraversal Vulnerability"

Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability discovered in Survey Maker WordPress plugin (versions <=

The Samba vfs_fruit module uses extended file attributes (EA, xattr) to provide "...enhanced compatibility with Apple SM

Open Redirect on Rudloff/alltube in Packagist rudloff/alltube prior to 3.0.1.

An issue was found in Zfaka <= 1.4.5. The verification of the background file upload function check is not strict, resul

Plesk CMS 18.0.37 is affected by an insecure permissions vulnerability that allows privilege Escalation from user to adm

The Float menu WordPress plugin before 4.3.1 does not have CSRF check in place when deleting menu, which could allow att

The Ad Inserter WordPress plugin before 2.7.10, Ad Inserter Pro WordPress plugin before 2.7.10 do not sanitise and escap

The AnyComment WordPress plugin before 0.2.18 is affected by a race condition when liking/disliking a comment/reply, whi

The Database Backup for WordPress plugin before 2.5.1 does not properly sanitise and escape the fragment parameter befor

The GiveWP WordPress plugin before 2.17.3 does not escape the json parameter before outputting it back in an attribute i

The WOOCS WordPress plugin before 1.3.7.5 does not sanitise and escape the woocs_in_order_currency parameter of the wooc

The Popup Builder WordPress plugin before 4.0.7 does not validate and properly escape the orderby and order parameters b

The Shield Security WordPress plugin before 13.0.6 does not sanitise and escape admin notes, which could allow high priv

The Coming soon and Maintenance mode WordPress plugin before 3.6.8 does not have CSRF check in its coming_soon_send_mail

The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.5.3 does not sanitise and escape the Description fiel

The Coming soon and Maintenance mode WordPress plugin before 3.5.3 does not have authorisation and CSRF checks in its co

The AnyComment WordPress plugin before 0.2.18 does not have CSRF checks in the Import and Revert HyperComments features,

The ExportFeed WordPress plugin through 2.0.1.0 does not sanitise and escape the product_id POST parameter before using

The Anti-Malware Security and Brute-Force Firewall WordPress plugin before 4.20.94 does not sanitise and escape the POST

The GiveWP WordPress plugin before 2.17.3 does not escape the s parameter before outputting it back in an attribute in t

The GiveWP WordPress plugin before 2.17.3 does not sanitise and escape the form_id parameter before outputting it back i

The Popup Builder WordPress plugin before 4.0.7 does not validate and sanitise the sgpb_type parameter before using it i

The Duplicate Page or Post WordPress plugin before 1.5.1 does not have any authorisation and has a flawed CSRF check in

The Download Manager WordPress plugin before 3.2.34 does not sanitise and escape the package_ids parameter before using

The Five Star Business Profile and Schema WordPress plugin before 2.1.7 does not have any authorisation and CSRF in its

The Buffer Button WordPress plugin through 1.0 was vulnerable to Authenticated Stored Cross Site Scripting (XSS) within

The Translation Exchange WordPress plugin through 1.0.14 was vulnerable to Authenticated Stored Cross-Site Scripting (XS

The FeedWordPress plugin before 2022.0123 is affected by a Reflected Cross-Site Scripting (XSS) within the "visibility"

The Advanced Database Cleaner WordPress plugin before 3.0.4 does not sanitise and escape $_GET keys and values before ou

Numerous Plugins and Themes from the AccessPress Themes (aka Access Keys) vendor are backdoored due to their website bei

Authorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.9.

This affects the package drogonframework/drogon before 1.7.5. The unsafe handling of file names during upload using Http

PreMiD 2.2.0 allows unintended access via the websocket transport. An attacker can receive events from a socket and emit

An issue was discovered in drivers/usb/gadget/function/rndis.c in the Linux kernel before 5.16.10. The RNDIS USB gadget

Pritunl Client through 1.2.3019.52 on Windows allows local privilege escalation, related to an ACL entry for CREATOR OWN

In Alluxio before 2.7.3, the logserver does not validate the input stream. NOTE: this is not the same as the CVE-2021-44

Openmct versions 1.3.0 to 1.7.7 are vulnerable against stored XSS via the “Summary Widget” element, that allows the inje

Openmct versions 1.3.0 to 1.7.7 are vulnerable against stored XSS via the “Condition Widget” element, that allows the in

Openmct versions 1.3.0 to 1.7.7 are vulnerable against stored XSS via the “Web Page” element, that allows the injection

An issue was discovered in Cobbler before 3.3.1. Files in /etc/cobbler are world readable. Two of those files contain so

An issue was discovered in Cobbler through 3.3.1. Routines in several files use the HTTP protocol instead of the more se

Business Logic Errors in Packagist microweber/microweber prior to 1.2.11.

Authorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.8.

Plesk 18.0.37 is affected by a Cross Site Request Forgery (CSRF) vulnerability that allows an attacker to insert data on