2022

A vulnerability within the malware removal functionality of Avast and AVG Antivirus allowed an attacker with write acces

GPAC MP4box v2.0.0 was discovered to contain a stack overflow in the smil_parse_time_list parameter at /scenegraph/svg_a

Improper access control in Key-Value RBAC in StackStorm version 3.7.0 didn't check the permissions in Jinja filters, all

Buffer overflow in firmware lewei_cam binary version 2.0.10 in Force 1 Discovery Wifi U818A HD+ FPV Drone allows attacke

When aborting a SFTP connection, MobaXterm before v22.1 sends a hardcoded password to the server. The server treats this

An access control issue in MobaXterm before v22.1 allows attackers to make connections to the server via the SSH or SFTP

A default username and password for an administrator account was discovered in ZKTeco ZKTime 10.0 through 11.1.0, builds

A cross-site scripting (XSS) vulnerability in the component /signup_script.php of Ecommerce-Website v1.0 allows attacker

A cross-site scripting (XSS) vulnerability in ClicShopping_V3 v3.402 allows attackers to execute arbitrary web scripts o

Rukovoditel v3.2.1 was discovered to contain a DOM-based cross-site scripting (XSS) vulnerability in the component /ruko

SLiMS 9 Bulian v9.5.0 was discovered to contain a SQL injection vulnerability via the keywords parameter.

Cross-site scripting (XSS) vulnerability in the Web UI of StackStorm versions prior to 3.8.0 allowed logged in users wit

An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0. Remote code execution can occur through ClientUplo

The BD BodyGuard™ infusion pumps specified allow for access through the RS-232 (serial) port interface. If exploited, th

Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 is vulnerable to XSS in the text input field

A remote code execution vulnerability in EdgeRouters (Version 2.0.9-hotfix.4 and earlier) allows a malicious actor with

Improper authentication in Veeam Backup for Google Cloud v1.0 and v3.0 allows attackers to bypass authentication mechani

A OS Command Injection vulnerability exists in Node.js versions <14.21.1, <16.18.1, <18.12.1, <19.0.1 due to an insuffic

MegaRAC Default Credentials Vulnerability

MegaRAC Default Credentials Vulnerability

curl can be told to parse a `.netrc` file for credentials. If that file endsin a line with 4095 consecutive non-white sp

XML Injection with Endpoint Manager 2022. 3 and below causing a download of a malicious file to run and possibly execute

An unauthenticated attacker can cause a denial-of-service to the following products: Ivanti Connect Secure (ICS) in vers

The llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that are not terminated wit

A weak randomness in WebCrypto keygen vulnerability exists in Node.js 18 due to a change with EntropySource() in SecretK

An unauthenticated attacker can cause a denial-of-service to the following products: Ivanti Connect Secure (ICS) in vers

A possible escalation to RCE vulnerability exists when using YAML serialized columns in Active Record < 7.0.3.1, <6.1.6.

When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data t

A sequence injection vulnerability exists in Rack <2.0.9.1, <2.1.4.1 and <2.2.3.1 which could allow is a possible shell

A possible denial of service vulnerability exists in Rack <2.0.9.1, <2.1.4.1 and <2.2.3.1 in the multipart parsing compo

AMI MegaRAC User Enumeration Vulnerability

A privilege escalation vulnerability is identified in Ivanti EPM (LANDesk Management Suite) that allows a user to execut

ZTE OTCP product is impacted by a permission and access control vulnerability. Due to improper permission settings, an a

Cacti is an open source platform which provides a robust and extensible operational monitoring and fault management fram

NodeBB is an open source Node.js based forum software. Due to a plain object with a prototype being used in socket.io me

The default configuration of Lazy Mouse does not require a password, allowing remote unauthenticated users to execute ar

PC Keyboard allows remote unauthenticated users to send instructions to the server to execute arbitrary code without any

Franklin Fueling System FFS Colibri 1.9.22.8925 is affected by: File system overwrite. The impact is: File system rewrit

An issue was discovered in Sangoma Asterisk through 16.28, 17 and 18 through 18.14, 19 through 19.6, and certified throu

A use-after-free in res_pjsip_pubsub.c in Sangoma Asterisk 16.28, 18.14, 19.6, and certified/18.9-cert2 may allow a remo

All Craft CMS versions between 3.0.0 and 3.7.32 disclose password hashes of users who authenticate using their E-Mail ad

In Sangoma Asterisk through 16.28.0, 17.x and 18.x through 18.14.0, and 19.x through 19.6.0, an incoming Setup message t

Cross Site Scripting (XSS) vulnerability in TomExam 3.0 via p_name parameter to list.thtml.

An issue in the /api/audits component of Pwndoc v0.5.3 allows attackers to escalate privileges and execute arbitrary cod

A Firewall Rule which allows all incoming TCP connections to all programs from any source and to all ports is created in

Phpgurukul User Registration & User Management System v3.0 was discovered to contain multiple stored cross-site scriptin

OpenRazer is an open source driver and user-space daemon to control Razer device lighting and other features on GNU/Linu

Floating Point Comparison with Incorrect Operator in GitHub repository vim/vim prior to 9.0.0804.

Use After Free in GitHub repository vim/vim prior to 9.0.0882.

Zabbix Frontend provides a feature that allows admins to maintain the installation and ensure that only certain IP addre