2022

Access of Memory Location After End of Buffer in GitHub repository radareorg/radare2 prior to 5.6.2.

Use After Free in NPM radare2.js prior to 5.6.2.

Buffer Access with Incorrect Length Value in GitHub repository radareorg/radare2 prior to 5.6.2.

Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.6.2.

Grafana is an open-source platform for monitoring and observability. In affected versions an attacker could serve HTML c

Use After Free in GitHub repository radareorg/radare2 prior to 5.6.0.

Gitea before 1.4.3 is affected by URL Redirection to Untrusted Site ('Open Redirect') via internal URLs.

Cross-site Scripting (XSS) - Reflected in Packagist pimcore/pimcore prior to 10.3.1.

Gitea before 1.11.2 is affected by Trusting HTTP Permission Methods on the Server Side when referencing the vulnerable a

Cross Site Request Forgery (CSRF) vulnerability exists in Gitea before 1.5.2 via API routes.This can be dangerous especi

Server Side Request Forgery (SSRF) vulneraility exists in Gitea before 1.7.0 using the OpenID URL.

Global buffer overflow vulnerability exist in ffjpeg through 01.01.2021. It is similar to CVE-2020-23705. Issue is in th

Two Heap based buffer overflow vulnerabilities exist in ffjpeg through 01.01.2021. It is similar to CVE-2020-23852. Issu

TP-Link WR886N 3.0 1.0.1 Build 150127 Rel.34123n is vulnerable to Buffer Overflow. Authenticated attackers can crash rou

Joplin 2.6.10 allows remote attackers to execute system commands through malicious code in user search results.

In DataEase v1.6.1, an authenticated user can gain unauthorized access to all user information and can change the admini

Cross-site Scripting (XSS) - Stored in Packagist pimcore/pimcore prior to 10.3.1.

Cross-site scripting vulnerability in TransmitMail 2.5.0 to 2.6.1 allows a remote unauthenticated attacker to inject an

Reflected cross-site scripting vulnerability in the checkbox of php_mailform versions prior to Version 1.40 allows a rem

Reflected cross-site scripting vulnerability in the attached file name of php_mailform versions prior to Version 1.40 al

Cross-site scripting vulnerability in ELECOM LAN router WRC-300FEBK-R firmware v1.13 and earlier allows an attacker on t

Cross-site scripting vulnerability in CSV+ prior to 0.8.1 allows a remote unauthenticated attacker to inject an arbitrar

Directory traversal vulnerability in TransmitMail 2.5.0 to 2.6.1 allows a remote unauthenticated attacker to obtain an a

Hidden functionality vulnerability in ELECOM LAN routers (WRH-300BK3 firmware v1.05 and earlier, WRH-300WH3 firmware v1.

Server-Side Request Forgery (SSRF) in GitHub repository chocobozzz/peertube prior to f33e515991a32885622b217bf2ed1d1b0d9

Cross-site scripting vulnerability in Canon laser printers and small office multifunctional printers (LBP162L/LBP162, MF

Cross-site Scripting (XSS) - Stored in Packagist microweber/microweber prior to 1.2.11.

Cross-Site Request Forgery (CSRF) in Packagist microweber/microweber prior to 1.2.11.

Generation of Error Message Containing Sensitive Information in Packagist microweber/microweber prior to 1.2.11.

NATS nats-server before 2.7.2 has Incorrect Access Control. Any authenticated user can obtain the privileges of the Syst

Frourio-express is a minimal full stack framework, for TypeScript. Frourio-express users who uses frourio-express versio

Frourio is a full stack framework, for TypeScript. Frourio users who uses frourio version prior to v0.26.0 and integrati

xrdp is an open source remote desktop protocol (RDP) server. In affected versions an integer underflow leading to a heap

twisted is an event-driven networking engine written in Python. In affected versions twisted exposes cookies and authori

QuickBox Pro v2.4.8 contains a cross-site scripting (XSS) vulnerability at "adminuseredit.php?usertoedit=XSS", as the us

The RNDIS USB device class includes a buffer overflow vulnerability. Zephyr versions >= v2.6.0 contain Heap-based Buffer

Buffer overflow in usb device class. Zephyr versions >= v2.6.0 contain Heap-based Buffer Overflow (CWE-122). For more in

NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (nvidia.ko), where a user in the guest OS can c

NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for priva

NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel driver package, where improper handling of in

NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel driver, where improper handling of insufficie

Fix of CVE-2021-40525 do not prepend delimiters upon valid directory validations. Affected implementations include: - ma

A Use of Hardcoded Credentials vulnerability exists in AquaView versions 1.60, 7.x, and 8.x that could allow an authenti

Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability

Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability

Microsoft Edge (Chromium-based) Tampering Vulnerability

The WooCommerce Stored Exporter WordPress plugin before 2.7.1 was affected by a Reflected Cross-Site Scripting (XSS) vul

The All-in-one Floating Contact Form, Call, Chat, and 50+ Social Icon Tabs WordPress plugin before 2.0.4 was vulnerable

The Paid Memberships Pro WordPress plugin before 2.6.7 does not escape the discount_code in one of its REST route (avail

The IP2Location Country Blocker WordPress plugin before 2.26.6 does not have CSRF check in the ip2location_country_block