2022

The Tasks.org Android app is an open-source app for to-do lists and reminders. The Tasks.org app uses the activity `Shar

OpenFGA is an authorization/permission engine. Versions prior to version 0.2.4 are vulnerable to authorization bypass un

OpenFGA is an authorization/permission engine. Versions prior to version 0.2.4 are vulnerable to authorization bypass un

OpenFGA is an authorization/permission engine. Prior to version 0.2.4, the `streamed-list-objects` endpoint was not vali

Kirby is a Content Management System. Prior to versions 3.5.8.2, 3.6.6.2, 3.7.5.1, and 3.8.1, a user enumeration vulnera

A cross site scripting vulnerability exists in some map service configurations of ArcGIS Server versions 10.8.1 and 10.7

A remote file download issue can occur in some capabilities of Esri ArcGIS Server web services that may in some edge cas

There is a reflected cross site scripting issue in the Esri ArcGIS Server services directory versions 10.9.1 and below t

Esri ArcGIS Server versions 10.9.1 and below have an unvalidated redirect issue that may allow a remote, unauthenticated

Esri ArcGIS Server versions 10.9.1 and prior have a path traversal vulnerability that may result in a denial of service

There is as reflected cross site scripting issue in Esri ArcGIS Server versions 10.9.1 and below which may allow a remot

AlgoSec – FireFlow Reflected Cross-Site-Scripting (RXSS) A malicious user injects JavaScript code into a parameter calle

PRTG Network Monitor through 22.2.77.2204 does not prevent custom input for a device’s icon, which can be modified to in

Apache Geode versions up to 1.15.0 are vulnerable to a Cross-Site Scripting (XSS) via data injection when using Pulse we

An authenticated attacker could read Nessus Debug Log file attachments from the web UI without having the correct privil

A double-free vulnerability exists in the web interface /action/ipcamSetParamPost functionality of Abode Systems, Inc. i

The AdminPad WordPress plugin before 2.2 does not have CSRF check when updating admin's note, allowing attackers to make

Server-Side Request Forgery (SSRF) vulnerability in Package Center functionality in Synology DiskStation Manager (DSM) b

In free5GC 3.2.1, a malformed NGAP message can crash the AMF and NGAP decoders via an index-out-of-range panic in aper.G

Improper access control vulnerability in GROWI prior to v5.1.4 (v5 series) and versions prior to v4.5.25 (v4 series) all

Improper authorization in handler for custom URL scheme vulnerability in Lemon8 App for Android versions prior to 3.3.5

Cross-site scripting vulnerability in BookStack versions prior to v22.09 allows a remote authenticated attacker to injec

In Eclipse Openj9 before version 0.35.0, interface calls can be inlined without a runtime type check. Malicious bytecode

Juiker app hard-coded its AES key in the source code. A physical attacker, after getting the Android root privilege, can

Multiple stored cross-site scripting vulnerabilities in the web user interface of IPFire versions prior to 2.27 allows a

Use of hard-coded TLS certificate by default allows an attacker to perform Man-in-the-Middle (MitM) attacks even in the

Session fixation and insufficient session expiration vulnerabilities allow an attacker to perfom session hijacking attac

Observable discrepancies in the login process allow an attacker to guess legitimate user names registered in the BMC. Th

A broken access control vulnerability in the SubNet_handler_func function of spx_restservice allows an attacker to arbit

An improper input validation vulnerability in the TLS certificate generation function allows an attacker to cause a Deni

A broken access control vulnerability in the KillDupUsr_func function of spx_restservice allows an attacker to arbitrari

A broken access control vulnerability in the FirstReset_handler_func function of spx_restservice allows an attacker to a

A broken access control vulnerability in the First_network_func function of spx_restservice allows an attacker to arbitr

Flux is an open and extensible continuous delivery solution for Kubernetes. Versions prior to 0.35.0 are subject to a De

IOWOW is a C utility library and persistent key/value storage engine. Versions 1.4.15 and prior contain a stack buffer o

Dell PowerScale OneFS, versions 8.2.0.x-9.4.0.x contain allocation of Resources Without Limits or Throttling vulnerabili

Dell PowerScale OneFS, versions 8.2.x-9.4.0.x, contain a privilege context switching error. A local authenticated malici

Dell PowerScale OneFS, versions 8.2.2-9.3.0, contain an OS command injection vulnerability. A privileged local malicious

Dell PowerScale OneFS, versions 9.0.0 up to and including 9.1.0.19, 9.2.1.12, and 9.3.0.6, contain sensitive data in log

The Dell Isilon OneFS versions 8.2.2 and earlier SSHD process improperly allows Transmission Control Protocol (TCP) and

Auth. Stored Cross-Site Scripting (XSS) in Pop-Up Chop Chop plugin <= 2.1.7 on WordPress.

Auth. (admin+) Stored Cross-Site Scripting (XSS) in Fatcat Apps Analytics Cat plugin <= 1.0.9 on WordPress.

A potential DOS vulnerability was discovered in GitLab CE/EE affecting all versions from 10.8 before 15.1.6, all version

LibTIFF 4.4.0 has an out-of-bounds write in _TIFFmemcpy in libtiff/tif_unix.c:346 when called from extractImageSection,

LibTIFF 4.4.0 has an out-of-bounds write in _TIFFmemset in libtiff/tif_unix.c:340 when called from processCropSelections

LibTIFF 4.4.0 has an out-of-bounds read in writeSingleSection in tools/tiffcrop.c:7345, allowing attackers to cause a de

LibTIFF 4.4.0 has an out-of-bounds write in extractContigSamplesShifted24bits in tools/tiffcrop.c:3604, allowing attacke

LibTIFF 4.4.0 has an out-of-bounds write in _TIFFmemcpy in libtiff/tif_unix.c:346 when called from extractImageSection,

A vulnerability, which was classified as critical, was found in Linux Kernel. Affected is the function l2cap_conn_del of

PHPGurukul Hospital Management System In PHP V 4.0 is vulnerable to Cross Site Scripting (XSS) via doctor/view-patient.p