2022

An off-by-one error was found in the SCSI device emulation in QEMU. It could occur while processing MODE SELECT commands

A flaw was found in mbsync versions prior to 1.4.4. Due to inadequate handling of extremely large (>=2GiB) IMAP literals

IBM Guardium Data Encryption (GDE) 5.0.0.2 and 5.0.0.3 could allow a remote attacker to obtain sensitive information, ca

IBM Maximo Asset Management 7.6.1.2 does not require that users should have strong passwords by default, which makes it

A reflected cross-site scripting (XSS) vulnerability in the Symantec Layer7 API Management OAuth Toolkit (OTK) allows a

An path traversal vulnerability leading to delete arbitrary files was discovered in BigFileAgent. Remote attackers can u

An improper input validation leading to arbitrary file creation was discovered in ToWord of ToOffice. Remote attackers u

Missing fixes for CVE-2021-40438 and CVE-2021-26691 in the versions of httpd, as shipped in Red Hat Enterprise Linux 8.5

A flaw in the processing of received ICMP errors (ICMP fragment needed and ICMP redirect) in the Linux kernel functional

A race condition accessing file object in the Linux kernel OverlayFS subsystem was found in the way users do rename in s

A flaw was found in s390 eBPF JIT in bpf_jit_insn in arch/s390/net/bpf_jit_comp.c in the Linux kernel. In this flaw, a l

A locking protection bypass flaw was found in some versions of gnome-shell as shipped within CentOS Stream 8, when the "

Unsanitized user input in ExpressionEngine <= 5.4.0 control panel member creation leads to an SQL injection. The user ne

Multiple flaws were found in the way samba AD DC implemented access and conformance checking of stored data. An attacker

A flaw was found in the way Samba, as an Active Directory Domain Controller, implemented Kerberos name-based authenticat

A flaw was found in the way samba, as an Active Directory Domain Controller, is able to support an RODC (read-only domai

A flaw was found in the way Samba maps domain users to local users. An authenticated attacker could use this flaw to cau

A flaw was found in the way samba implemented SMB1 authentication. An attacker could use this flaw to retrieve the plain

ZEROF Web Server 2.0 allows /admin.back XSS.

ZEROF Web Server 2.0 allows /HandleEvent SQL Injection.

Prism is a syntax highlighting library. Starting with version 1.14.0 and prior to version 1.27.0, Prism's command line p

CRLF Injection leads to Stack Trace Exposure due to lack of filtering at https://demo.microweber.org/ in Packagist micro

Use of Hard-coded Cryptographic Key in Go github.com/gravitl/netmaker prior to 0.8.5,0.9.4,0.10.0,0.10.1.

Heap-based Buffer Overflow in Homebrew mruby prior to 3.2.

Dart SDK contains the HTTPClient in dart:io library whcih includes authorization headers when handling cross origin redi

This affects the package cesanta/mongoose before 7.6. The unsafe handling of file names during upload using mg_http_uplo

This affects the package sprinfall/webcc before 0.3.0. It is possible to traverse directories to fetch arbitrary files f

Scoold 1.47.2 is a Q&A/knowledge base platform written in Java. When writing a Q&A, the markdown editor is vulnerable to

Generation of Error Message Containing Sensitive Information in Packagist microweber/microweber prior to 1.2.11.

A Process Control vulnerability in ProductAgentUI.exe as used in Bitdefender Antivirus Plus allows an attacker to tamper

An issue was discovered in Cerebrate through 1.4. XSS could occur in the bookmarks component.

An issue was discovered in Cerebrate through 1.4. Username enumeration could occur.

An issue was discovered in Cerebrate through 1.4. Endpoints could be open even when not enabled.

An issue was discovered in Cerebrate through 1.4. An incorrect sharing group ACL allowed an unprivileged user to edit an

An issue was discovered in Cerebrate through 1.4. genericForm allows reflected XSS in form descriptions via a user-contr

In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames.

In Expat (aka libexpat) before 2.4.5, there is an integer overflow in copyString.

In Expat (aka libexpat) before 2.4.5, an attacker can trigger stack exhaustion in build_model via a large nesting depth

D-Link DSL-2730E CT-20131125 devices allow XSS via the username parameter to the password page in the maintenance config

TP-Link TL-WA850RE Wi-Fi Range Extender before v6_200923 was discovered to use highly predictable and easily detectable

A remote code execution vulnerability was identified in GitHub Enterprise Server that could be exploited when building a

snapd 2.54.2 fails to perform sufficient validation of snap content interface and layout paths, resulting in the ability

A race condition existed in the snapd 2.54.2 snap-confine binary when preparing a private mount namespace for a snap. Th

snapd 2.54.2 did not properly validate the location of the snap-confine binary. A local attacker who can hardlink this b

snapd 2.54.2 and earlier created ~/snap directories in user home directories without specifying owner-only permissions.

O2OA v6.4.7 was discovered to contain a remote code execution (RCE) vulnerability via /x_program_center/jaxrs/invoke.

Remote Code Execution (RCE) vulnerability exists in D-Link Router DIR-846 DIR846A1_FW100A43.bin and DIR846enFW100A53DLA-

Remote Command Execution (RCE) vulnerability exists in HNAP1/control/SetWizardConfig.php in D-Link Router DIR-846 DIR846

Next.js is a React framework. Starting with version 10.0.0 and prior to version 12.1.0, Next.js is vulnerable to User In

An incorrect access control issue in the component FileManager of Ovidentia CMS 6.0 allows authenticated attackers to to