2022

The Privacy Policy Generator, Terms & Conditions Generator WordPress Plugin : WPLegalPages WordPress plugin before 2.7.1

The Ivory Search WordPress plugin before 5.4.1 does not escape some of the Form settings, which could allow high privile

The Translate WordPress with GTranslate WordPress plugin before 2.9.7 does not sanitise and escape the body parameter in

The IP2Location Country Blocker WordPress plugin before 2.26.5 bans can be bypassed by using a specific parameter in the

The IP2Location Country Blocker WordPress plugin before 2.26.5 does not have authorisation and CSRF checks in the ip2loc

The Advanced Cron Manager WordPress plugin before 2.4.2 and Advanced Cron Manager Pro WordPress plugin before 2.5.3 do n

The Store Toolkit for WooCommerce WordPress plugin before 2.3.2 does not sanitise and escape the tab parameter before ou

The CLUEVO LMS, E-Learning Platform WordPress plugin before 1.8.1 does not sanitise and escape Course's module, which co

The SEUR Oficial WordPress plugin before 1.7.2 creates a PHP file with a random name when installed, even though it is u

The Ultimate Product Catalog WordPress plugin before 5.0.26 does not have authorisation and CSRF checks in some AJAX act

The RVM WordPress plugin before 6.4.2 does not have proper authorisation, CSRF checks and validation of the rvm_upload_r

The Rearrange Woocommerce Products WordPress plugin before 3.0.8 does not have proper access controls in the save_all_or

The SupportCandy WordPress plugin before 2.2.7 does not validate and escape the page attribute of its shortcode, which c

The SupportCandy WordPress plugin before 2.2.7 does not have CSRF check in the wpsc_tickets AJAX action, nor has any san

The SupportCandy WordPress plugin before 2.2.7 does not sanitise and escape the query string before outputting it back i

The SupportCandy WordPress plugin before 2.2.7 does not have CRSF check in its wpsc_tickets AJAX action, which could all

The SupportCandy WordPress plugin before 2.2.5 does not have authorisation and CSRF checks in its wpsc_tickets AJAX acti

IIPImage High Resolution Streaming Image Server prior to commit 882925b295a80ec992063deffc2a3b0d803c3195 is affected by

FISCO-BCOS release-3.0.0-rc2 contains a denial of service vulnerability. Some transactions may not be committed successf

XMPie uStore 12.3.7244.0 allows for administrators to generate reports based on raw SQL queries. Since the application s

Full list of recipients from customer users in a contact field could be disclosed in notification emails event when the

OTRS administrators can configure dynamic field and inject malicious JavaScript code in the error message of the regular

In affected Octopus Server versions when the server HTTP and HTTPS bindings are configured to localhost, Octopus Server

Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in support service manageme

Improper neutralization of special elements in output used by a downstream component ('Injection') vulnerability in work

Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in mail sending

Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Security Managemen

Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Log Management fun

Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Log Management fun

Exposure of sensitive information to an unauthorized actor vulnerability in Web Server in Synology DiskStation Manager (

An issue was discovered in Servisnet Tessa 0.0.2. An attacker can obtain sensitive information via a /js/app.js request.

A flaw was found in the REST API in StarWind Stack. REST command, which manipulates a virtual disk, doesn’t check input

A flaw was found in StarWind Stack. The endpoint for setting a new password doesn’t check the current username and old p

An issue was discovered in Servisnet Tessa 0.0.2. Authorization data is available via an unauthenticated /data-service/u

An issue was discovered in Servisnet Tessa 0.0.2. An attacker can add a new sysadmin user via a manipulation of the Auth

CGI.escape_html in Ruby before 2.7.5 and 3.x before 3.0.3 has an integer overflow and resultant buffer overflow via a lo

Certain Korenix JetWave devices allow authenticated users to execute arbitrary code as root via /syscmd.asp. This affect

A flaw was found in StarWind iSCSI target. StarWind service does not limit client connections and allocates memory on ea

A flaw was found in StarWind iSCSI target. An attacker could script standard iSCSI Initiator operation(s) to exhaust the

In Apache Traffic Control Traffic Ops prior to 6.1.0 or 5.1.6, an unprivileged user who can reach Traffic Ops over HTTPS

Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v.

perM 0.4.0 has a Buffer Overflow related to strncpy. (Debian initially fixed this in 0.4.0-7.)

Cross-site Scripting (XSS) - Reflected in Packagist ptrofimov/beanstalk_console prior to 1.7.12.

Cross-site Scripting (XSS) - DOM in NPM karma prior to 6.3.14.

Local privilege escalation due to unrestricted loading of unsigned libraries. The following products are affected: Acron

Local privilege escalation due to race condition on application startup. The following products are affected: Acronis Cy

Local privilege escalation due to excessive permissions assigned to child processes. The following products are affected

Cross-Site Scripting (XSS) vulnerability discovered in Yasr – Yet Another Stars Rating WordPress plugin (versions <= 2.9

A stack-based buffer overflow vulnerability exists in the Gerber Viewer gerber and excellon DCodeNumber parsing function

A stack-based buffer overflow vulnerability exists in the Gerber Viewer gerber and excellon GCodeNumber parsing function