2022

A Remote Command Execution (RCE) vulnerability exists in HNAP1/control/SetNetworkTomographySettings.php of D-Link Router

A Remote Command Execution (RCE) vulnerability exists in all series H/W revisions D-link DIR-810L, DIR-820L/LW, DIR-826L

A reflected cross-site scripting (XSS) vulnerability in PHP-Fusion 7.02.07 allows remote attackers to inject arbitrary w

Prototype pollution vulnerability via .parse() in Plist before v3.0.4 allows attackers to cause a Denial of Service (DoS

The UpdraftPlus WordPress plugin Free before 1.22.3 and Premium before 2.22.3 do not properly validate a user has the re

The use of a hard-coded cryptographic key significantly increases the possibility encrypted data may be recovered from A

Authorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.7.

HashiCorp Nomad and Nomad Enterprise 0.9.2 through 1.0.17, 1.1.11, and 1.2.5 allow operators with read-fs and alloc-exec

Cross-Site Request Forgery (CSRF) in Packagist microweber/microweber prior to 1.2.11.

IBM MQ 9.1 LTS is vulnerable to a denial of service attack caused by an issue within the channel process. IBM X-Force ID

A problem was found in ming-soft MCMS v5.1. There is a sql injection vulnerability in /ms/cms/content/list.do

Traefik is an HTTP reverse proxy and load balancer. Prior to version 2.6.1, Traefik skips the router transport layer sec

A vulnerability in the checkpoint manager implementation of Cisco Redundancy Configuration Manager (RCM) for Cisco StarO

A vulnerability in the web-based management interface of Cisco Prime Infrastructure and Cisco Evolved Programmable Netwo

A vulnerability in the DNS-based Authentication of Named Entities (DANE) email verification component of Cisco AsyncOS S

A segmentation fault during PCF file parsing in pcf2bdf versions >=1.05 allows an attacker to trigger a program crash vi

A heap-buffer-overflow in pcf2bdf, versions >= 1.05 allows an attacker to trigger unsafe memory access via a specially c

Core FTP / SFTP Server v2 Build 725 was discovered to allow unauthenticated attackers to cause a Denial of Service (DoS)

Stack-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.

TRIGONE Remote System Monitor 3.61 is vulnerable to an unquoted path service allowing local users to launch processes wi

Out-of-bounds Read in Homebrew mruby prior to 3.2.

The Crypt_GPG extension before 1.6.7 for PHP does not prevent additional options in GPG calls, which presents a risk for

There is an Assertion in 'context_p->next_scanner_info_p->type == SCANNER_TYPE_FUNCTION' failed at parser_parse_function

Generation of Error Message Containing Sensitive Information in Packagist snipe/snipe-it prior to 5.3.11.

The Quick Edit module does not properly check entity access in some circumstances. This could result in users with the "

Drupal core's form API has a vulnerability where certain contributed or custom modules' forms may be vulnerable to impro

Forms generated by JQueryForm.com before 2022-02-05 allows a remote authenticated attacker to bypass authentication and

Forms generated by JQueryForm.com before 2022-02-05 (if file-upload capability is enabled) allow remote unauthenticated

Forms generated by JQueryForm.com before 2022-02-05 allow remote attackers to obtain the URI to any uploaded file by cap

Forms generated by JQueryForm.com before 2022-02-05 allows a remote authenticated attacker to access the cleartext crede

A reflected cross-site scripting (XSS) vulnerability in forms generated by JQueryForm.com before 2022-02-05 allows remot

Wasmtime is an open source runtime for WebAssembly & WASI. Prior to versions 0.34.1 and 0.33.1, there exists a bug in th

Hutool v5.7.18's HttpRequest was discovered to ignore all TLS/SSL certificate validation.

Jeecg-boot v3.0 was discovered to contain a SQL injection vulnerability via the code parameter in /sys/user/queryUserCom

Jeecg-boot v3.0 was discovered to contain a SQL injection vulnerability via the code parameter in /jeecg-boot/sys/user/q

In the Linux kernel through 5.16.10, certain binary files may have the exec-all attribute if they were built in approxim

Buffer overflow in PJSUA API when calling pjsua_call_dump. An attacker-controlled 'buffer' argument may cause a buffer o

Read out-of-bounds in PJSUA API when calling pjsua_recorder_create. An attacker-controlled 'filename' argument may cause

Stack overflow in PJSUA API when calling pjsua_playlist_create. An attacker-controlled 'file_names' argument may cause a

Stack overflow in PJSUA API when calling pjsua_recorder_create. An attacker-controlled 'filename' argument may cause a b

Stack overflow in PJSUA API when calling pjsua_player_create. An attacker-controlled 'filename' argument may cause a buf

An issue was discovered in drivers/usb/gadget/composite.c in the Linux kernel before 5.16.10. The USB Gadget subsystem l

DuxCMS v3.1.3 was discovered to contain a SQL injection vulnerability via the component s/tools/SendTpl/index?keyword=.

In Qt 5.9.x through 5.15.x before 5.15.9 and 6.x before 6.2.4 on Linux and UNIX, QProcess could execute a binary from th

BookWyrm is a decentralized social network for tracking reading habits and reviewing books. The functionality to load a

A trivial sandbox (enabled with the `-dSAFER` option) escape flaw was found in the ghostscript interpreter by injecting

A flaw in netfilter could allow a network-connected attacker to infer openvpn connection endpoint information for furthe

A flaw was found in the Linux kernel. A use-after-free vulnerability in the NFC stack can lead to a threat to confidenti

A race problem was seen in the vt_k_ioctl in drivers/tty/vt/vt_ioctl.c in the Linux kernel, which may cause an out of bo

A use-after-free flaw was found in the Linux kernel’s Bluetooth subsystem in the way user calls connect to the socket an