2022

Authorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.6.

antd-admin 5.5.0 is affected by an incorrect access control vulnerability. Unauthorized access to some interfaces in the

HashiCorp Nomad and Nomad Enterprise 0.3.0 through 1.0.17, 1.1.11, and 1.2.5 artifact download functionality has a race

Emerson Dixell XWEB-500 products are affected by information disclosure via directory listing. A potential attacker can

Emerson Dixell XWEB-500 products are affected by arbitrary file write vulnerability in /cgi-bin/logo_extra_upload.cgi, /

ImpressCMS before 1.4.2 allows unauthenticated remote code execution via ...../// directory traversal in origName or ima

Atheme IRC Services before 7.2.12, when used in conjunction with InspIRCd, allows authentication bypass by ending an IRC

Kiteworks MFT 7.5 may allow an unauthorized user to reset other users' passwords. This is fixed in version 7.6 and later

Cross-site Scripting (XSS) - Generic in Packagist librenms/librenms prior to 22.1.0.

Cross-site Scripting (XSS) - Stored in Packagist librenms/librenms prior to 22.2.0.

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.

Cross-site Scripting (XSS) - Reflected in GitHub repository phoronix-test-suite/phoronix-test-suite prior to 10.8.2.

Heap-based Buffer Overflow in Homebrew mruby prior to 3.2.

Observable Discrepancy in Packagist snipe/snipe-it prior to v5.3.9.

Cross-site Scripting in Packagist pimcore/pimcore prior to 10.3.1.

The Custom Popup Builder WordPress plugin before 1.3.1 autoload data from its popup on every pages, as such data can be

The SpiderCalendar WordPress plugin through 1.5.65 does not sanitise and escape the callback parameter before outputting

The MapPress Maps for WordPress plugin before 2.73.4 does not sanitise and escape the mapid parameter before outputting

The NewStatPress WordPress plugin before 1.3.6 does not properly escape the whatX parameters before outputting them back

The Permalink Manager Lite WordPress plugin before 2.2.15 and Permalink Manager Pro WordPress plugin before 2.2.15 do no

Themify Portfolio Post WordPress plugin before 1.1.7 does not sanitise and escape the num_of_pages parameter before outp

The Complianz WordPress plugin before 6.0.0 does not escape the s parameter before outputting it back in an attribute in

The Ad Invalid Click Protector (AICP) WordPress plugin before 1.2.6 is affected by a SQL Injection in the id parameter o

The CMP WordPress plugin before 4.0.19 allows any user, even not logged in, to arbitrarily change the coming soon page l

The PowerPack Lite for Beaver Builder WordPress plugin before 1.2.9.3 does not sanitise and escape the tab parameter bef

In zsh before 5.8.1, an attacker can achieve code execution if they control a command output inside the prompt, as demon

In gc_data_segment in fs/f2fs/gc.c in the Linux kernel before 5.16.3, special files are not considered, leading to a mov

The WP Photo Album Plus WordPress plugin before 8.0.10 was vulnerable to Stored Cross-Site Scripting (XSS). Error log co

The Futurio Extra WordPress plugin before 1.6.3 allows any logged in user, such as subscriber, to extract any other user

The Futurio Extra WordPress plugin before 1.6.3 is affected by a SQL Injection vulnerability that could be used by high

The Form Store to DB WordPress plugin before 1.1.1 does not sanitise and escape parameter keys before outputting it back

The Remove Footer Credit WordPress plugin before 1.0.11 does properly sanitise its settings, allowing high privilege use

The WordPress Newsletter Plugin WordPress plugin before 1.6.5 does not validate the to parameter before redirecting the

The PPOM for WooCommerce WordPress plugin before 24.0 does not have authorisation and CSRF checks in the ppom_settings_p

The Ibtana WordPress plugin before 1.1.4.9 does not have authorisation and CSRF checks in the ive_save_general_settings

The Mortgage Calculators WP WordPress plugin before 1.56 does not implement any sanitisation on the color setting of the

The Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue WordPress plugin before 3.1.31 does not escape t

The Remove Footer Credit WordPress plugin before 1.0.6 does not have CSRF check in place when saving its settings, which

BD Viper LT system, versions 2.0 and later, contains hardcoded credentials. If exploited, threat actors may be able to a

Heap buffer overflow in Task Manager in Google Chrome prior to 97.0.4692.99 allowed a remote attacker who convinced a us

Heap buffer overflow in Task Manager in Google Chrome prior to 97.0.4692.99 allowed a remote attacker to potentially exp

Inappropriate implementation in Autofill in Google Chrome prior to 97.0.4692.99 allowed a remote attacker to bypass navi

Use after free in Data Transfer in Google Chrome on Chrome OS prior to 97.0.4692.99 allowed a remote attacker who convin

Use after free in Optimization Guide in Google Chrome prior to 97.0.4692.99 allowed a remote attacker who convinced a us

Heap buffer overflow in PDFium in Google Chrome prior to 97.0.4692.99 allowed a remote attacker to potentially exploit h

Inappropriate implementation in Service Worker API in Google Chrome prior to 97.0.4692.99 allowed a remote attacker who

Use after free in Bookmarks in Google Chrome prior to 97.0.4692.99 allowed a remote attacker who convinced a user to eng

Use after free in Omnibox in Google Chrome prior to 97.0.4692.99 allowed an attacker who convinced a user to engage in s

Heap buffer overflow in DevTools in Google Chrome prior to 97.0.4692.99 allowed an attacker who convinced a user to inst

Use after free in Text Input Method Editor in Google Chrome on Android prior to 97.0.4692.99 allowed a remote attacker w