2022

Dangerous method exposed which can lead to RCE in qmpass/leadshop v1.4.15 allows an attacker to control the target host

A directory traversal vulnerability in the ZIP archive extraction routines of KNIME Analytics Platform 3.2.0 and above c

A directory traversal vulnerability in the ZIP archive extraction routines of KNIME Server since 4.3.0 can result in arb

systemd 250 and 251 allows local users to achieve a systemd-coredump deadlock by triggering a crash that has a long back

iTerm2 before 3.4.18 mishandles a DECRQSS response.

The web-based admin console in H2 Database Engine before 2.2.220 can be started via the CLI with the argument -webAdminP

A cross-site scripting (XSS) vulnerability in the Url parameter in /login.php of EyouCMS v1.6.0 allows attackers to exec

Jizhicms v2.3.3 was discovered to contain a SQL injection vulnerability via the /index.php/admins/Fields/get_fields.html

An issue in the /index/user/user_edit.html component of YJCMS v1.0.9 allows unauthenticated attackers to obtain the Admi

A logical issue in O_getOwnPropertyDescriptor() in Artifex MuJS 1.0.0 through 1.3.x before 1.3.2 allows an attacker to a

dedecmdv6 6.1.9 is vulnerable to SQL Injection. via sys_sql_query.php.

dedecmdv6 v6.1.9 is vulnerable to Remote Code Execution (RCE) via file_manage_control.php.

Boa 0.94.14rc21 is vulnerable to SQL Injection via username. NOTE: the is disputed by multiple third parties because Boa

dedecmdv6 v6.1.9 is vulnerable to Arbitrary file deletion via file_manage_control.php.

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. When the `reset

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It's possible t

qpress before PierreLvx/qpress 20220819 and before version 11.3, as used in Percona XtraBackup and other products, allow

Jizhicms v2.3.3 was discovered to contain a SQL injection vulnerability via the /Member/memberedit.html component.

pgjdbc is an open source postgresql JDBC Driver. In affected versions a prepared statement using either `PreparedStateme

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users without t

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with v

xwiki-platform-icon-ui is vulnerable to Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injec

An issue was discovered in JIZHI CMS 1.9.4. There is a CSRF vulnerability that can add an admin account via index, /admi

org.xwiki.platform:xwiki-platform-user-profile-ui is missing authorization to enable or disable users. Any user (logged

org.xwiki.platform:xwiki-platform-oldcore is missing authorization in User#setDisabledStatus, which may allow an incorre

XWiki Platform vulnerable to Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in A

XWiki Platform is vulnerable to Cross-Site Request Forgery (CSRF) that may allow attackers to delete or rename tags with

A vulnerability identified in the Tailscale client allows a malicious website to access the peer API, which can then be

A vulnerability identified in the Tailscale Windows client allows a malicious website to reconfigure the Tailscale daemo

Grails Spring Security Core plugin is vulnerable to privilege escalation. The vulnerability allows an attacker access to

A remote code execution (RCE) vulnerability in Optica allows unauthenticated attackers to execute arbitrary code via spe

CartView.php in ChurchInfo 1.3.0 allows attackers to achieve remote code execution through insecure uploads. This requir

`yiisoft/yii` before version 1.1.27 are vulnerable to Remote Code Execution (RCE) if the application calls `unserialize(

Zoho ManageEngine ServiceDesk Plus versions 13010 and prior are vulnerable to a validation bypass that allows users to a

Zoho ManageEngine ServiceDesk Plus versions 13010 and prior are vulnerable to an XML External Entity attack that leads t

An issue was discovered in libxml2 before 2.10.3. Certain invalid XML entity definitions can corrupt a hash table key, p

FileCloud Versions 20.2 and later allows remote attackers to potentially cause unauthorized remote code execution and ac

immudb is a database with built-in cryptographic proof and verification. In versions prior to 1.4.1, a malicious immudb

CRITICAL: An improper neutralization of argument delimiters in a command vulnerability was identified in GitHub Enterpri

SQL Injection vulnerability in function get_user in login_manager.php in rizalafani cms-php v1.

An issue was discovered in open-vm-tools 2009.03.18-154848. Local users can bypass intended access restrictions on mount

An issue was discovered in open-vm-tools 2009.03.18-154848. Local users can gain privileges via a symlink attack on /tmp

Insecure method vulnerability in which allowed HTTP methods are disclosed. E.g., OPTIONS, DELETE, TRACE, and PUT

This vulnerability occurs when a web server fails to correctly process the Content-Length of POST requests. This can lea

This vulnerability discloses build and services versions in the server response header.

Stored Cross-site Scripting (XSS) exists in the Amasty Blog Pro 2.10.3 and 2.10.4 plugin for Magento 2 because of the du

The application fails to prevent users from connecting to it over unencrypted connections. An attacker able to modify a

Automotive Shop Management System v1.0 is vulnerable to Delete any file via /asms/classes/Master.php?f=delete_img.

Sanitization Management System v1.0 is vulnerable to SQL Injection via /php-sms/admin/?page=user/manage_user&id=.

TOTOLINK LR350 V9.3.5u.6369_B20220309 contains a post-authentication buffer overflow via parameter sPort/ePort in the se