2022

An authorization flaw was found in openstack-barbican. The default policy rules for the secret metadata API allowed any

The x/crypto/ssh package before 0.0.0-20211202192323-5770296d904e of golang.org/x/crypto allows an attacker to panic an

TOTOLINK A3002R TOTOLINK-A3002R-He-V1.1.1-B20200824.0128 is vulnerable Buffer Overflow via the hostname parameter in bin

TOTOLINK A3002R TOTOLINK-A3002R-He-V1.1.1-B20200824.0128 is vulnerable to Buffer Overflow via /bin/boa.

In TOTOLINK A860R V4.1.2cu.5182_B20201027 there is a hard coded password for root in /etc/shadow.sample.

Indy Node is the server portion of a distributed ledger purpose-built for decentralized identity. In versions 1.12.4 and

Improper Authorization in GitHub repository chatwoot/chatwoot prior to 2.8.

OS Command Injection vulnerability in Hitachi RAID Manager Storage Replication Adapter allows remote authenticated users

A privileged attacker in GeoNetwork before 3.12.0 and 4.x before 4.0.4 can use the directory harvester before-script to

Systematic FIX Adapter (ALFAFX) 2.4.0.25 13/09/2017 allows remote file inclusion via a UNC share pathname, and also allo

The User-Defined Functions (UDF) feature in TigerGraph 3.6.0 allows installation of a query (in the GSQL query language)

The Simple Payment Donations & Subscriptions WordPress plugin before 4.2.1 does not sanitise and escape user input given

The Simple Single Sign On WordPress plugin through 4.1.0 leaks its OAuth client_secret, which could be used by attackers

Deserialization of Untrusted Data vulnerability in the message processing component of Bitdefender GravityZone Console a

Apache IoTDB grafana-connector version 0.13.0 contains an interface without authorization, which may expose the internal

Apache IoTDB version 0.13.0 is vulnerable by session id attack. Users should upgrade to version 0.13.1 which addresses t

The tinygltf library uses the C library function wordexp() to perform file path expansion on untrusted paths that are pr

A vulnerability classified as critical was found in SourceCodester Clinics Patient Management System. Affected by this v

123elf Lotus 1-2-3 before 1.0.0rc3 for Linux, and Lotus 1-2-3 R3 for UNIX and other platforms through 9.8.2, allow attac

An issue was discovered in PSPP 1.6.2. There is a heap-based buffer overflow at the function read_string in utilities/ps

An issue was discovered in PSPP 1.6.2. There is a heap-based buffer overflow at the function read_bytes_internal in util

sign_pFwInfo in Samsung mTower through 0.3.0 has a missing check on the return value of EC_KEY_set_public_key_affine_coo

There is a NULL pointer dereference in aes256_encrypt in Samsung mTower through 0.3.0 due to a missing check on the retu

sign_pFwInfo in Samsung mTower through 0.3.0 has a missing check on the return value of EC_KEY_set_private_key, leading

Server-side JavaScript injection in Appsmith through 1.7.14 allows remote attackers to execute arbitrary JavaScript code

A vulnerability was found in Sourcecodehero ERP System Project. It has been rated as critical. This issue affects some u

Use After Free in GitHub repository vim/vim prior to 9.0.0360.

Expense Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /Home/deb

libvncclient v0.9.13 was discovered to contain a memory leak via the function rfbClientCleanup().

Grafana Image Renderer is a Grafana backend plugin that handles rendering of panels & dashboards to PNGs using a headles

Databasir is a database metadata management platform. Databasir <= 1.06 has Server-Side Request Forgery (SSRF) vulnerabi

Improper Access Control in GitHub repository jgraph/drawio prior to 20.2.8.

SFTPGo is configurable SFTP server with optional HTTP/S, FTP/S and WebDAV support. SFTPGo WebAdmin and WebClient support

Dell Command Update, Dell Update and Alienware Update versions prior to 4.6.0 contains a Local Privilege Escalation Vuln

Dell PowerScale OneFS, versions 9.0.0 up to and including 9.1.0.19, 9.2.1.12, 9.3.0.6, and 9.4.0.3, contain an unprotect

Dell PowerScale OneFS, versions 9.0.0 up to and including 9.1.0.20, 9.2.1.13, 9.3.0.6, and 9.4.0.3 , contain an insertio

Binary provides encoding/decoding in Borsh and other formats. The vulnerability is a memory allocation vulnerability tha

NodeBB Forum Software is powered by Node.js and supports either Redis, MongoDB, or a PostgreSQL database. Due to an unne

Discourse through 2.8.7 allows admins to send invitations to arbitrary email addresses at an unlimited rate.

Memory corruption in multimedia due to buffer overflow while processing count variable from client in Snapdragon Auto

Memory corruption in video driver due to double free while parsing ASF clip in Snapdragon Auto, Snapdragon Compute, Snap

Memory corruption due to buffer overflow while parsing MKV clips with invalid bitmap size in Snapdragon Auto, Snapdragon

Memory corruption due to incorrect pointer arithmetic when attempting to change the endianness in video parser function

Memory corruption due to buffer overflow occurs while processing invalid MKV clip which has invalid seek header in Snapd

Memory corruption in multimedia due to improper length check while copying the data in Snapdragon Auto

Memory corruption in multimedia due to improper check on the messages received. in Snapdragon Auto

Memory corruption in multimedia due to incorrect type conversion while adding data in Snapdragon Auto

Memory corruption in multimedia due to improper check on received export descriptors in Snapdragon Auto

Memory corruption in multimedia due to improper validation of array index in Snapdragon Auto

Memory corruption in multimedia driver due to untrusted pointer dereference while reading data from socket in Snapdragon