2022

MariaDB through 10.5.9 allows attackers to trigger a convert_const_to_int use-after-free when the BIGINT data type is us

MariaDB through 10.5.9 allows an application crash via certain long SELECT DISTINCT statements that improperly interact

MariaDB before 10.6.5 has a sql_lex.cc integer overflow, leading to an application crash.

MariaDB before 10.6.2 allows an application crash because of mishandling of a pushdown from a HAVING clause to a WHERE c

MariaDB through 10.5.9 allows a sql_parse.cc application crash because of incorrect used_tables expectations.

MariaDB through 10.5.9 allows an application crash in sub_select_postjoin_aggr for a NULL value of aggr.

MariaDB through 10.5.13 allows a ha_maria::extra application crash via certain SELECT statements.

MariaDB through 10.5.9 allows a set_var.cc application crash via certain uses of an UPDATE statement in conjunction with

MariaDB through 10.5.9 allows an application crash in find_field_in_tables and find_order_in_list via an unused common t

Cuppa CMS v1.0 was discovered to contain a SQL injection vulnerability in /administrator/components/table_manager/ via t

Cuppa CMS v1.0 was discovered to contain a SQL injection vulnerability in /administrator/components/menu/ via the path=c

Cuppa CMS v1.0 was discovered to contain a SQL injection vulnerability in /administrator/components/table_manager/ via t

Hospital Management System v4.0 was discovered to contain a SQL injection vulnerability in /Hospital-Management-System-m

Emlog pro v1.1.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the component /admin/con

Flask-AppBuilder is an application development framework, built on top of the Flask web framework. In affected versions

Victor CMS v1.0 was discovered to contain multiple SQL injection vulnerabilities in the component admin/users.php?source

Cross Site Scripting (XSS) vulnerability exists in Sourcecodester Stock Management System in PHP/OOP 1.0, which allows r

PrinterLogic Web Stack versions 19.1.1.13 SP9 and below use a hardcoded APP_KEY value, leading to pre-auth remote code e

PrinterLogic Web Stack versions 19.1.1.13 SP9 and below deserializes attacker controlled leading to pre-auth remote code

A flaw was found in the Linux kernel. A null pointer dereference in bond_ipsec_add_sa() may lead to local denial of serv

Victor CMS v1.0 was discovered to contain a SQL injection vulnerability in the component admin/posts.php?source=add_post

There is a release of invalid pointer vulnerability in some Huawei products, successful exploit may cause the process an

There is an information exposure vulnerability on several Huawei Products. The vulnerability is due to that the software

In ASQ in Stormshield Network Security (SNS) 1.0.0 through 2.7.8, 2.8.0 through 2.16.0, 3.0.0 through 3.7.20, 3.8.0 thro

Stormshield Network Security (SNS) before 4.2.2 allows a read-only administrator to gain privileges via CLI commands.

In Git for windows through 2.34.1 when using git pull to update the local warehouse, git.cmd can be run directly.

Online Course Registration v1.0 was discovered to contain hardcoded credentials in the source code which allows attacker

Beetel 777VR1-DI Hardware Version REV.1.01 Firmware Version V01.00.09_55 was discovered to contain a cross-site scriptin

Authenticated remote code execution in MotionEye <= 0.42.1 and MotioneEyeOS <= 20200606 allows a remote attacker to uplo

Improper Validation of Specified Quantity in Input in Packagist dolibarr/dolibarr prior to 16.0.

This affects the package juce-framework/JUCE before 6.1.5. This vulnerability is triggered when a malicious archive is c

The package juce-framework/juce before 6.1.5 are vulnerable to Arbitrary File Write via Archive Extraction (Zip Slip) vi

The Logs plugin before 3.0.4 for Craft CMS allows remote attackers to read arbitrary files via input to actionStream in

In strongSwan before 5.9.5, a malicious responder can send an EAP-Success message too early without actually authenticat

An issue was discovered in FAUST iServer before 9.0.019.019.7. For each URL request, it accesses the corresponding .fau

Alps Alpine Touchpad Driver 10.3201.101.215 is vulnerable to DLL Injection.

xterm through Patch 370, when Sixel support is enabled, allows attackers to trigger a buffer overflow in set_sixel in gr

Use After Free in GitHub repository vim/vim prior to 8.2.

Stack-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.

Server-Side Request Forgery (SSRF) in Pypi calibreweb prior to 0.6.16.

Improper Access Control in Pypi calibreweb prior to 0.6.16.

Adenza AxiomSL ControllerView through 10.8.1 allows redirection for SSO login URLs.

Adenza AxiomSL ControllerView through 10.8.1 is vulnerable to user enumeration. An attacker can identify valid usernames

Signiant Manager+Agents before 15.1 allows XML External Entity (XXE) attacks.

The query API in Casdoor before 1.13.1 has a SQL injection vulnerability related to the field and value parameters, as d

MarkText through 0.16.3 does not sanitize the input of a mermaid block before rendering. This could lead to Remote Code

MariaDB before 10.7.2 allows an application crash because it does not recognize that SELECT_LEX::nest_level is local to

save_window_function_values in MariaDB before 10.6.3 allows an application crash because of incorrect handling of with_w

get_sort_by_table in MariaDB before 10.6.2 allows an application crash via certain subquery uses of ORDER BY.