2022

Missing Authorization in Packagist librenms/librenms prior to 22.2.0.

Improper Authorization in Packagist librenms/librenms prior to 22.2.0.

Affected versions of Atlassian Jira Service Management Server and Data Center allow authenticated remote attackers to vi

Affected versions of Atlassian Jira Server and Data Center allow remote attackers to modify several resources (including

Affected versions of Atlassian Confluence Server and Data Center allow authenticated local attackers to achieve elevated

Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to toggle the Thread C

Affected versions of Atlassian Jira Service Management Server and Data Center allow authenticated remote attackers to vi

Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to restore the default

NVIDIA License System contains a vulnerability in the installation scripts for the DLS virtual appliance, where a user o

Incorrect Authorization in Packagist librenms/librenms prior to 22.2.0.

njs through 0.7.0, used in NGINX, was discovered to contain a heap use-after-free in njs_await_fulfilled.

The rad_packet_recv function in radius/packet.c suffers from a memcpy buffer overflow, resulting in an overly-large recv

The rad_packet_recv function in opt/src/accel-pppd/radius/packet.c suffers from a buffer overflow vulnerability, whereby

XCOM Data Transport for Windows, Linux, and UNIX 11.6 releases contain a vulnerability due to insufficient input validat

AXIS IP Utility before 4.18.0 allows for remote code execution and local privilege escalation by the means of DLL hijack

Infinite loop in RTMPT protocol dissector in Wireshark 3.6.0 to 3.6.1 and 3.4.0 to 3.4.11 allows denial of service via p

Crash in the PVFS protocol dissector in Wireshark 3.6.0 to 3.6.1 and 3.4.0 to 3.4.11 allows denial of service via packet

Unaligned access in the CSN.1 protocol dissector in Wireshark 3.6.0 to 3.6.1 and 3.4.0 to 3.4.11 allows denial of servic

Crash in the CMS protocol dissector in Wireshark 3.6.0 to 3.6.1 and 3.4.0 to 3.4.11 allows denial of service via packet

Missing access control in ForgeRock Access Management 7.1.0 and earlier versions on all platforms allows remote unauthen

njs through 0.7.1, used in NGINX, was discovered to contain a control flow hijack caused by a Type Confusion vulnerabili

njs through 0.7.1, used in NGINX, was discovered to contain a segmentation violation via njs_object_set_prototype in /sr

njs through 0.7.0, used in NGINX, was discovered to contain an out-of-bounds array access via njs_vmcode_typeof in /src/

Artifex MuJS v1.1.3 was discovered to contain a heap buffer overflow which is caused by conflicting JumpList of nested t

Tongda2000 v11.10 was discovered to contain a SQL injection vulnerability in /mobile_seal/get_seal.php via the DEVICE_LI

Tongda2000 v11.10 was discovered to contain a SQL injection vulnerability in export_data.php via the d_name parameter.

svg-sanitizer is a SVG/XML sanitizer written in PHP. A cross-site scripting vulnerability impacts all users of the `svg-

K-Box is a web-based application to manage documents, images, videos and geodata. Prior to version 0.33.1, a stored Cros

A cross-site scripting (XSS) vulnerability in Pybbs v6.0 allows attackers to execute arbitrary web scripts or HTML via a

An issue in the getType function of BBS Forum v5.3 and below allows attackers to upload arbitrary files.

PublicCMS v4.0 was discovered to contain a remote code execution (RCE) vulnerability via the cmdarray parameter.

DedeCMS v5.7.87 was discovered to contain a SQL injection vulnerability in article_coonepage_rule.php via the ids parame

S-CMS v5.0 was discovered to contain a SQL injection vulnerability in member_pay.php via the O_id parameter.

Metinfo v7.5.0 was discovered to contain a SQL injection vulnerability in language_general.class.php via doModifyParamet

Metinfo v7.5.0 was discovered to contain a SQL injection vulnerability in parameter_admin.class.php via the table_para p

Sangoma Technologies Corporation Switchvox Version 102409 is affected by an information disclosure vulnerability due to

In Corda before 4.1, the meaning of serialized data can be modified via an attacker-controlled CustomSerializer.

In galois_2p8 before 0.1.2, PrimitivePolynomialField::new has an off-by-one buffer overflow for a vector.

An Arbitrary File Deletion vulnerability exists in SourceCodester Attendance Management System v1.0 via the csv paramete

A Header Injection vulnerability exists in Compass Plus TranzWare Online FIMI Web Interface Tranzware Online (TWO) 5.3.3

CompleteFTPService.exe in the server in EnterpriseDT CompleteFTP before 12.1.4 allows Remote Code Execution by leveragin

In Malwarebytes Binisoft Windows Firewall Control before 6.8.1.0, programs executed from the Tools tab can be used to es

Missing Authorization in Packagist snipe/snipe-it prior to 5.3.9.

An Incorrect Access Control vulnerability exists in zzcms 8.2, which lets a malicious user bypass authentication by chan

A Memory Leak vulnerability exists in SQLite Project SQLite3 3.35.1 and 3.37.0 via maliciously crafted SQL Queries (made

Fulusso v1.1 was discovered to contain a DOM-based cross-site scripting (XSS) vulnerability in /BindAccount/SuccessTips.

An access control issue in hprms/admin/?page=user/list of Hospital Patient Record Management System v1.0 allows attacker

Due to weak obfuscation, IBM Cognos Analytics Mobile for Android application prior to version 1.1.14 , an attacker could

IBM Cognos Analytics Mobile for Android applications prior to version 1.1.14 is vulnerable to cross-site scripting. This

A Buffer Overflow vulnerability exists in Tenda Router AX12 V22.03.01.21_CN in the sub_422CE4 function in page /goform/s