2022

The Checkout Field Editor (Checkout Manager) for WooCommerce WordPress plugin before 1.8.0 unserializes user input provi

The Salat Times WordPress plugin before 3.2.2 does not sanitize and escapes its settings, allowing high-privilege users

The Find and Replace All WordPress plugin before 1.3 does not sanitize and escape some parameters from its setting page

The Download Plugin WordPress plugin before 2.0.0 does not properly validate a user has the required privileges to acces

Vulnerability in the HQSwSmiDxe DXE driver on some consumer Acer Notebook devices may allow an attacker with elevated pr

decode-uri-component 0.2.0 is vulnerable to Improper Input Validation resulting in DoS.

SQL injection in School Management System 1.0 allows remote attackers to modify or delete data, causing persistent chang

A null pointer dereference vulnerability exists in the handle_ioctl_0x830a0_systembuffer functionality of Callback techn

A null pointer dereference vulnerability exists in the handle_ioctl_8314C functionality of Callback technologies CBFS Fi

A null pointer dereference vulnerability exists in the handle_ioctl_83150 functionality of Callback technologies CBFS Fi

GNU Emacs through 28.2 allows attackers to execute commands via shell metacharacters in the name of a source-code file,

An issue was discovered in the Linux kernel through 6.0.10. l2cap_config_req in net/bluetooth/l2cap_core.c has an intege

In Botan before 2.19.3, it is possible to forge OCSP responses due to a certificate verification error. This issue was i

KubeView through 0.1.31 allows attackers to obtain control of a Kubernetes cluster because api/scrape/kube-system does n

A SQL injection issue was discovered in AAA in OpenDaylight (ODL) before 0.16.5. The aaa-idm-store-h2/src/main/java/org/

A SQL injection issue was discovered in AAA in OpenDaylight (ODL) before 0.16.5. The aaa-idm-store-h2/src/main/java/org/

A SQL injection issue was discovered in AAA in OpenDaylight (ODL) before 0.16.5. The aaa-idm-store-h2/src/main/java/org/

An issue was discovered in the Linux kernel through 6.0.10. In drivers/media/dvb-core/dvb_ca_en50221.c, a use-after-free

The ESL (Electronic Shelf Label) protocol, as implemented by (for example) the OV80e934802 RF transceiver on the ETAG-21

qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for

drachtio-server before 0.8.19 has a heap-based buffer over-read via a long Request-URI in an INVITE request.

In PaddlePaddle before 2.4, paddle.audio.functional.get_window is vulnerable to code injection because it calls eval on

In PyTorch before trunk/89695, torch.jit.annotations.parse_type_line can cause arbitrary code execution because eval is

Book Store Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability in /bsms_ci/index

TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the pass paramete

TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the port paramete

Nexcloud desktop is the Desktop sync client for Nextcloud. An attacker can inject arbitrary HyperText Markup Language in

Nexcloud desktop is the Desktop sync client for Nextcloud. An attacker can inject arbitrary HyperText Markup Language in

BaserCMS is a content management system with a japanese language focus. In affected versions there is a cross-site scrip

A blind Server-Side Request Forgery (SSRF) vulnerability was found in Moodle. This flaw exists due to insufficient valid

MPXJ is an open source library to read and write project plans from a variety of file formats and databases. On Unix-lik

Nextcould talk android is the android OS implementation of the nextcloud talk chat system. In affected versions the rece

Remote code execution vulnerability can be achieved by using cookie values as paths to a file by this builder program. A

A specific file on the sERP server if Kyungrinara(ERP solution) has a fixed password with the SYSTEM authority. This vul

Remote code execution vulnerability due to insufficient verification of URLs, etc. in OndiskPlayerAgent. A remote attack

Nextcloud server is an open source personal cloud server. Affected versions of nextcloud server did not properly limit u

user_oidc is an OpenID Connect user backend for Nextcloud. In versions prior to 1.2.1 sensitive information such as the

user_oidc is an OpenID Connect user backend for Nextcloud. Versions prior to 1.2.1 did not properly validate discovery u

Nextcloud also ships a CLI utility called nextcloudcmd which is sometimes used for automated scripting and headless serv

Nexcloud desktop is the Desktop sync client for Nextcloud. An attacker can inject arbitrary HyperText Markup Language in

Tiny File Manager version 2.4.8 executes the code of files uploaded by users of the application, instead of just returni

Tiny File Manager version 2.4.8 allows an unauthenticated remote attacker to access the application's internal files. Th

Automotive Shop Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /

Automotive Shop Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /

Automotive Shop Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /

super-xray is a web vulnerability scanning tool. Versions prior to 0.7 assumed trusted input for the program config whic

Frappe version 14.10.0 allows an external attacker to remotely obtain arbitrary local files. This is possible because th

Browsershot version 3.57.2 allows an external attacker to remotely obtain arbitrary local files. This is possible becaus

Badaso version 2.6.3 allows an unauthenticated remote attacker to execute arbitrary code remotely on the server. This is

Microweber version 1.3.1 allows an unauthenticated user to perform an account takeover via an XSS on the 'select-file' p