2022

Recursive rendering of Mustache template helpers containing user input could, in some cases, result in an XSS risk or a

Joplin version 2.8.8 allows an external attacker to execute arbitrary commands remotely on any client that opens a link

Gridea version 0.9.3 allows an external attacker to execute arbitrary code remotely on any client attempting to view a m

A vulnerable component of Orion Platform was vulnerable to SQL Injection, an authenticated attacker could leverage this

Billing System Project v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /phpinventor

Billing System Project v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /phpinventor

Billing System Project v1.0 was discovered to contain a remote code execution (RCE) vulnerability via the component /php

Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.5.0a3.

sflow decode package does not employ sufficient packet sanitisation which can lead to a denial of service attack. Attack

In Amazon AWS Redshift JDBC Driver (aka amazon-redshift-jdbc-driver or redshift-jdbc42) before 2.1.0.8, the Object Facto

Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.5.0a3.

ZKTeco Xiamen Information Technology ZKBio Time 8.0.7 Build: 20220721.14829 was discovered to contain a CSV injection vu

Discourse is an open source discussion platform. In versions prior to 2.8.9 on the `stable` branch and prior to 2.9.0.be

IBM Robotic Process Automation Clients are vulnerable to proxy credentials being exposed in upgrade logs. IBM X-Force ID

matrix-nio is a Python Matrix client library, designed according to sans I/O principles. Prior to version 0.20, when a u

matrix-rust-sdk is an implementation of a Matrix client-server library in Rust, and matrix-sdk-crypto is the Matrix encr

SnapCenter versions prior to 4.7 shipped without Content Security Policy (CSP) implemented which could allow certain typ

A zip slip vulnerability in the file upload function of Chamilo v1.11 allows attackers to execute arbitrary code via a c

A vulnerability in /src/amf/amf-context.c in Open5GS 2.4.10 and earlier leads to AMF denial of service.

Matrix JavaScript SDK is the Matrix Client-Server software development kit (SDK) for JavaScript. Prior to version 19.7.0

A misconfiguration in the Service Mode profile directory of Clash for Windows v0.19.9 allows attackers to escalate privi

Use After Free in GitHub repository vim/vim prior to 9.0.0614.

An issue was discovered in Samsung TizenRT through 3.0_GBM (and 3.1_PRE). l2_packet_receive_timeout in wpa_supplicant/sr

An issue was discovered in Samsung TizenRT through 3.0_GBM (and 3.1_PRE). createDB in security/provisioning/src/provisio

There is a use-after-free issue in JBIG2Stream::close() located in JBIG2Stream.cc in Xpdf 4.04. It can be triggered by s

The trudesk application allows large characters to insert in the input field "Full Name" on the signup field which can a

Time-based SQL Injection vulnerabilities were found in Metersphere v1.15.4 via the "orders" parameter.

BigProf Online Invoicing System before 3.0 offers a functionality that allows an administrator to move the records of me

Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has an unauthenticated update_all_realm_license API.

Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a hardcoded opt/axess/AXAssets/default_axess/axess/TR69/Handlers/turbolin

Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 uses ZODB storage without authentication.

QEMU before 2.0.0 block drivers for CLOOP, QCOW2 version 2 and various other image formats are vulnerable to potential m

IBM WebSphere MQ 7.1 is vulnerable to a denial of service, caused by an error when handling user ids. A remote attacker

Double free in DOMStorage in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to potentially exploit heap c

Flatpress v1.2.1 was discovered to contain a remote code execution (RCE) vulnerability in the Upload File function.

In wolfSSL before 5.5.1, malicious clients can cause a buffer overflow during a TLS 1.3 handshake. This occurs when an a

nheko is a desktop client for the Matrix communication application. All versions below 0.10.2 are vulnerable homeservers

A link following vulnerability in Trend Micro Deep Security 20 and Cloud One - Workload Security Agent for Windows could

Matrix iOS SDK allows developers to build iOS apps compatible with Matrix. Prior to version 0.23.19, an attacker coopera

Matrix iOS SDK allows developers to build iOS apps compatible with Matrix. Prior to version 0.23.19, an attacker coopera

Networking OS10, versions 10.5.1.x, 10.5.2.x, and 10.5.3.x contain a vulnerability that could allow an attacker to cause

NIOHTTP1 and projects using it for generating HTTP responses can be subject to a HTTP Response Injection attack. This oc

Matrix Javascript SDK is the Matrix Client-Server SDK for JavaScript. Prior to version 19.7.0, an attacker cooperating w

Matrix Javascript SDK is the Matrix Client-Server SDK for JavaScript. Prior to version 19.7.0, an attacker cooperating w

matrix-android-sdk2 is the Matrix SDK for Android. Prior to version 1.5.1, an attacker cooperating with a malicious home

matrix-android-sdk2 is the Matrix SDK for Android. Prior to version 1.5.1, an attacker cooperating with a malicious home

In GraphicsMagick, a heap buffer overflow was found when parsing MIFF.

An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. There is an SMM memory corruption vulnerability

Hertz v0.3.0 ws discovered to contain a path traversal vulnerability via the normalizePath function.

Twig is a template language for PHP. Versions 1.x prior to 1.44.7, 2.x prior to 2.15.3, and 3.x prior to 3.4.3 encounter