2022

There is a stack buffer overflow vulnerability in the formSetPPTPServer function of Tenda-AX3 router V16.03.12.10_CN. Th

OS Command Injection in GitHub repository part-db/part-db prior to 0.5.11.

Under certain ldap conditions, Cacti authentication can be bypassed with certain credential types.

In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack whe

Improper Restriction of XML External Entity Reference in GitHub repository hazelcast/hazelcast in 5.1-BETA-1.

A directory traversal vulnerability was found in the ClairCore engine of Clair. An attacker can exploit this by supplyin

MCMS v5.2.4 was discovered to contain a SQL injection vulnerability via search.do in the file /mdiy/dict/listExcludeApp.

MCMS v5.2.5 was discovered to contain a SQL injection vulnerability via search.do in the file /web/MCmsAction.java.

MCMS v5.2.5 was discovered to contain a SQL injection vulnerability via the categoryId parameter in the file IContentDao

OS Command Injection in GitHub repository ljharb/npm-lockfile in v2.0.3 and v2.0.4.

Printix Secure Cloud Print Management through 1.3.1106.0 incorrectly uses Privileged APIs to modify values in HKEY_LOCAL

Bank Management System v1.o was discovered to contain a SQL injection vulnerability via the email parameter.

Simple Mobile Comparison Website v1.0 was discovered to contain a SQL injection vulnerability via the search parameter.

Air Cargo Management System v1.0 was discovered to contain a SQL injection vulnerability via the ref_code parameter.

Simple Real Estate Portal System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter.

Auto Spare Parts Management v1.0 was discovered to contain a SQL injection vulnerability via the user parameter.

Cosmetics and Beauty Product Online Store v1.0 was discovered to contain a SQL injection vulnerability via the search pa

Cosmetics and Beauty Product Online Store v1.0 was discovered to contain multiple reflected cross-site scripting (XSS) a

Medical Store Management System v1.0 was discovered to contain a SQL injection vulnerability via the cid parameter under

Home Owners Collection Management System v1.0 was discovered to contain hardcoded credentials which allows attackers to

Excel-Streaming-Reader is an easy-to-use implementation of a streaming Excel reader using Apache POI. Prior to xlsx-stre

seacms V11.5 is affected by an arbitrary code execution vulnerability in admin_config.php.

Home Owners Collection Management System v1.0 was discovered to contain an arbitrary file upload vulnerability via the c

Zoho ManageEngine SharePoint Manager Plus before 4329 allows account takeover because authorization is mishandled.

Zoho ManageEngine SharePoint Manager Plus before 4329 is vulnerable to a sensitive data leak that leads to privilege esc

The component /rootfs in RageFile of Stepmania v5.1b2 and below allows attackers access to the entire file system.

image_processing is an image processing wrapper for libvips and ImageMagick/GraphicsMagick. Prior to version 1.12.2, usi

wire-avs is the audio visual signaling (AVS) component of Wire, an open-source messenger. A remote format string vulnera

An improper authentication vulnerability in FortiMail before 7.0.1 may allow a remote attacker to efficiently guess one

A command injection vulnerability in the web interface of the Zyxel NWA-1100-NH firmware could allow an attacker to exec

A directory traversal vulnerability in the apoc plugins in Neo4J Graph database before 4.4.0.1 allows attackers to read

Hicos citizen certificate client-side component does not filter special characters for command parameters in specific we

A Remote Code Execution (RCE) vulnerability at /admin/options in Maxsite CMS v180 allows attackers to execute arbitrary

A Remote Code Execution (RCE) vulnerability exists in DataRobot through 2021-10-28 because it allows submission of a Doc

CodeIgniter4 is the 4.x branch of CodeIgniter, a PHP full-stack web framework. Prior to version 4.1.9, an improper input

ARM astcenc 3.2.0 is vulnerable to Buffer Overflow. When the compression function of the astc-encoder project with -cl o

Car Driving School Management System v1.0 is affected by SQL injection in the login page. An attacker can use simple SQL

Server-Side Request Forgery (SSRF) in GitHub repository rudloff/alltube prior to 3.0.2.

The TI WooCommerce Wishlist WordPress plugin before 1.40.1, TI WooCommerce Wishlist Pro WordPress plugin before 1.40.1 d

The Post Snippets WordPress plugin before 3.1.4 does not have CSRF check when importing files, allowing attacker to make

On ICL ScadaFlex II SCADA Controller SC-1 and SC-2 1.03.07 devices, unauthenticated remote attackers can overwrite, dele

Home Owners Collection Management System v1.0 was discovered to contain a SQL injection vulnerability via the id paramet

Home Owners Collection Management System v1.0 allows unauthenticated attackers to compromise user accounts via a crafted

JetBrains TeamCity before 2021.2.3 was vulnerable to OS command injection in the Agent Push feature configuration.

In JetBrains Hub before 2022.1.14434, SAML request takeover was possible.

JetBrains Hub before 2021.1.14276 was vulnerable to blind Server-Side Request Forgery (SSRF).

TP-LINK TL-WR840N(ES)_V6.20_180709 was discovered to contain a remote code execution (RCE) vulnerability via the functio

TP-LINK TL-WR840N(ES)_V6.20_180709 was discovered to contain a command injection vulnerability via the component oal_set

TP-LINK TL-WR840N(ES)_V6.20_180709 was discovered to contain a command injection vulnerability via the component oal_sta

JetBrains YouTrack before 2021.4.40426 was vulnerable to SSTI (Server-Side Template Injection) via FreeMarker templates.