2022

Use After Free vulnerability in Linux Kernel allows Privilege Escalation. An improper Update of Reference Count in io_ur

Silverstripe silverstripe/framework through 4.11 is vulnerable to XSS by carefully crafting a return URL on a /dev/build

A CWE-269: Improper Privilege Management vulnerability exists that could cause a denial of service of the Ethernet commu

A CWE-191: Integer Underflow (Wrap or Wraparound) vulnerability exists that could cause a denial of service of the contr

A vulnerability exists in the Intelligent Electronic Device (IED) Connectivity Package (ConnPack) credential storage fun

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Airfl

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Airfl

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Airfl

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Airfl

Auth. (subscriber+) Stored Cross-Site Scripting (XSS) in Muffingroup Betheme theme <= 26.6.1 on WordPress.

A vulnerability in NetBatch-Plus software allows unauthorized access to the application.  HPE has provided a workaround

Unrestricted file size limit can lead to DoS in tooljet/tooljet <1.27 by allowing a logged in attacker to upload profile

A flaw in the Zyxel LTE3301-M209 firmware verisons prior to V1.00(ABLG.6)C0 could allow a remote attacker to access the

In libarchive before 3.6.2, the software does not check for an error after calling calloc function that can return with

An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. A stack buffer overflow leads to arbitrary code

CKAN through 2.9.6 account takeovers by unauthenticated users when an existing user id is sent via an HTTP POST request.

Billing System Project v1.0 was discovered to contain a SQL injection vulnerability via the endDate parameter at getOrde

Billing System Project v1.0 was discovered to contain a SQL injection vulnerability via the orderId parameter at printOr

Engine.IO is the implementation of transport-based cross-browser/cross-device bi-directional communication layer for Soc

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. The application

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. The `modificati

The web conferencing component of Mitel MiCollab through 9.6.0.13 could allow an unauthenticated attacker to upload arbi

The Director database component of MiVoice Connect through 19.3 (22.22.6100.0) could allow an authenticated attacker to

ndk design NdkAdvancedCustomizationFields 3.5.0 is vulnerable to Server-side request forgery (SSRF) via rotateimg.php.

A vulnerability in the Edge Gateway component of Mitel MiVoice Connect through 19.3 (22.22.6100.0) could allow an authen

Fusiondirectory 1.3 is vulnerable to Cross Site Scripting (XSS) via /fusiondirectory/index.php?message=[injection], /fus

Fusiondirectory 1.3 suffers from Improper Session Handling.

File upload vulnerability in asith-eranga ISIC tour booking through version published on Feb 13th 2018, allows attackers

MyBB 1.8.31 has a SQL injection vulnerability in the Admin CP's Users module allows remote authenticated users to modify

MyBB 1.8.31 has a (issue 2 of 2) cross-site scripting (XSS) vulnerabilities in the post Attachments interface allow atta

MyBB 1.8.31 has a Cross-site scripting (XSS) vulnerability in the visual MyCode editor (SCEditor) allows remote attacker

An issue was discovered in Appalti & Contratti 9.12.2. It allows Session Fixation. When a user logs in providing a JSESS

An issue was discovered in Appalti & Contratti 9.12.2. The web applications are vulnerable to a Reflected Cross-Site Scr

An issue was discovered in Appalti & Contratti 9.12.2. The target web applications allow Local File Inclusion in any pag

An issue was discovered in Appalti & Contratti 9.12.2. The target web applications are subject to multiple SQL Injection

An issue was discovered in Appalti & Contratti 9.12.2. The target web applications LFS and DL229 expose a set of service

super-xray is a vulnerability scanner (xray) GUI launcher. In version 0.1-beta, the URL is not filtered and directly spl

An issue was discovered in Technitium DNS Server through 8.0.2 that allows variant V2 of unintended domain name resoluti

An issue was discovered in Technitium DNS Server through 8.0.2 that allows variant V1 of unintended domain name resoluti

A cross-site scripting (XSS) vulnerability in Beekeeper Studio v3.6.6 allows attackers to execute arbitrary web scripts

Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via Post content

A vulnerability in the "/admin/wlmultipleap.asp" of optilink OP-XT71000N version: V2.2 could allow an unauthenticated, r

A stored XSS in a kiwi Test Plan can run malicious javascript which could be chained with an HTML injection to perform a

An input validation vulnerability exists in the Monitor Pro interface of MicroSCADA Pro and MicroSCADA X SYS600. An auth

Sourcecodester Event Registration App v1.0 was discovered to contain multiple CSV injection vulnerabilities via the Firs

Tenda AC18 V15.03.05.19 is vulnerable to Buffer Overflow via function formSetWifiGuestBasic.

Tenda AC18 V15.03.05.19 is vulnerable to Buffer Overflow via function addWifiMacFilter.

Tenda AC18 V15.03.05.19 is vulnerable to Buffer Overflow. via function formWifiWpsOOB.

Tenda AC18 V15.03.05.19 is vulnerable to Buffer Overflow via function formWifiWpsStart.

Tenda AC18 V15.03.05.19 is vulnerable to Buffer Overflow via function fromSetRouteStatic.