2022

Totolink A830R V5.9c.4729_B20191112, A3100R V4.1.2cu.5050_B20200504, A950RG V4.1.2cu.5161_B20200903, A800R V4.1.2cu.5137

Totolink X5000R_Firmware v9.1.0u.6118_B20201102 was discovered to contain a command injection vulnerability in the funct

Totolink A830R V5.9c.4729_B20191112, A3100R V4.1.2cu.5050_B20200504, A950RG V4.1.2cu.5161_B20200903, A800R V4.1.2cu.5137

Totolink A830R V5.9c.4729_B20191112, A3100R V4.1.2cu.5050_B20200504, A950RG V4.1.2cu.5161_B20200903, A800R V4.1.2cu.5137

Totolink A830R V5.9c.4729_B20191112, A3100R V4.1.2cu.5050_B20200504, A950RG V4.1.2cu.5161_B20200903, A800R V4.1.2cu.5137

Totolink A830R V5.9c.4729_B20191112, A3100R V4.1.2cu.5050_B20200504, A950RG V4.1.2cu.5161_B20200903, A800R V4.1.2cu.5137

Totolink A830R V5.9c.4729_B20191112, A3100R V4.1.2cu.5050_B20200504, A950RG V4.1.2cu.5161_B20200903, A800R V4.1.2cu.5137

Totolink A830R V5.9c.4729_B20191112, A3100R V4.1.2cu.5050_B20200504, A950RG V4.1.2cu.5161_B20200903, A800R V4.1.2cu.5137

Totolink A830R V5.9c.4729_B20191112, A3100R V4.1.2cu.5050_B20200504, A950RG V4.1.2cu.5161_B20200903, A800R V4.1.2cu.5137

CuppaCMS v1.0 was discovered to contain a remote code execution (RCE) vulnerability via the saveConfigData function in /

The component /jquery_file_upload/server/php/index.php of CuppaCMS v1.0 allows attackers to upload arbitrary files and e

Online Banking System v1.0 was discovered to contain a SQL injection vulnerability via staff_login.php.

HMS v1.0 was discovered to contain a SQL injection vulnerability via the medicineid parameter in ajaxmedicine.php.

HMS v1.0 was discovered to contain a SQL injection vulnerability via the editid parameter in department.php.

Atom CMS v2.0 was discovered to contain a SQL injection vulnerability via the id parameter in /admin/ajax/avatar.php.

Atom CMS v2.0 was discovered to contain a remote code execution (RCE) vulnerability via /admin/uploads.php.

SyliusGridBundle is a package of generic data grids for Symfony applications. Prior to versions 1.10.1 and 1.11-rc2, val

The Rambus SafeZone Basic Crypto Module before 10.4.0, as used in certain Fujifilm (formerly Fuji Xerox) devices before

The CommonsBooking WordPress plugin before 2.6.8 does not sanitise and escape the location parameter of the calendar_dat

The WordPress Zero Spam WordPress plugin before 5.2.11 does not properly sanitise and escape the order and orderby param

The Photo Gallery by 10Web WordPress plugin before 1.6.0 does not validate and escape the bwg_tag_id_bwg_thumbnails_0 pa

The MOLIE WordPress plugin through 0.5 does not validate and escape a post parameter before using in a SQL statement, le

The WPCargo Track & Trace WordPress plugin before 6.9.0 contains a file which could allow unauthenticated attackers to w

With administrator or admin privileges the application can be tricked into overwriting files in app_data/Config folder,

Out-of-bounds Write vulnerability in mod_sed of Apache HTTP Server allows an attacker to overwrite heap memory with poss

If LimitXMLRequestBody is set to allow request bodies larger than 350MB (defaults to 1M) on 32 bit systems an integer ov

Apache HTTP Server 2.4.52 and earlier fails to close inbound connection when errors are encountered discarding the reque

An issue was discovered in PONTON X/P Messenger before 3.11.2. Due to path traversal in private/SchemaSetUpload.do for u

Parse Server is an open source http web server backend. In versions prior to 4.10.7 there is a Remote Code Execution (RC

UUNIVERGE WA 1020 Ver8.2.11 and prior, UNIVERGE WA 1510 Ver8.2.11 and prior, UNIVERGE WA 1511 Ver8.2.11 and prior, UNIVE

The public API error causes for the attacker to be able to bypass API access control.

A Command Injection vulnerability exits in TOTOLINK A3100R <=V4.1.2cu.5050_B20200504 in adm/ntm.asp via the hosTime para

A Server-side Template Injection (SSTI) vulnerability exists in Nystudio107 Seomatic 3.4.12 in src/helpers/UrlHelper.php

Improper Authorization in GitHub repository cobbler/cobbler prior to 3.3.2.

Missing Authorization in GitHub repository gogs/gogs prior to 0.12.5.

The following Yokogawa Electric products hard-code the password for CAMS server applications: CENTUM VP versions from R5

The following Yokogawa Electric products do not change the passwords of the internal Windows accounts from the initial c

In pgjdbc before 42.3.3, an attacker (who controls the jdbc URL or properties) can call java.util.logging.FileHandler to

The TP-240 (aka tp240dvr) component in Mitel MiCollab before 9.4 SP1 FP1 and MiVoice Business Express through 8.1 allows

Power Line Communications PLC4TRUCKS J2497 trailer receivers are susceptible to remote RF induced signals.

SAPCAR - version 7.22, does not contain sufficient input validation on the SAPCAR archive. As a result, the SAPCAR proce

Tenda AX3 v16.03.12.10_CN was discovered to contain a stack overflow in the function fromSetSysTime. This vulnerability

sentcms 4.0.x allows remote attackers to cause arbitrary file uploads through an unauthorized file upload interface, res

sentcms 4.0.x allows remote attackers to cause arbitrary file uploads through an unauthorized file upload interface, res

Luocms v2.0 is affected by an incorrect access control vulnerability. Through /admin/templates/template_manage.php, an a

Luocms v2.0 is affected by SQL Injection in /admin/news/news_ok.php.

Luocms v2.0 is affected by SQL Injection in /admin/news/sort_ok.php.

Luocms v2.0 is affected by SQL Injection in /admin/link/link_ok.php.

Luocms v2.0 is affected by SQL Injection in /admin/link/link_mod.php.

Luocms v2.0 is affected by SQL Injection in /admin/news/sort_mod.php.