2022

telnetd in GNU Inetutils through 2.3, MIT krb5-appl through 1.0.3, and derivative works has a NULL pointer dereference v

OAKlouds Portal website’s Meeting Room has insufficient validation for user input. A remote attacker with general user p

The package org.yaml:snakeyaml from 0 and before 1.31 are vulnerable to Denial of Service (DoS) due missing to nested de

Xpdf prior to 4.04 lacked an integer overflow check in JPXStream.cc.

In Xpdf prior to 4.04, the DCT (JPEG) decoder was incorrectly allowing the 'interleaved' flag to be changed after the fi

Poppler prior to and including 22.08.0 contains an integer overflow in the JBIG2 decoder (JBIG2Stream::readTextRegionSeg

Patlite NH-FB v1.46 and below was discovered to contain insufficient firmware validation during the upgrade firmware fil

Hitachi Kokusai Electric Newtork products for monitoring system (Camera, Decoder and Encoder) and below allows attckers

An improper authentication for critical function issue in Hitachi Kokusai Electric Network products for monitoring syste

Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, and OpUtils

HireVue Hiring Platform V1.0 suffers from Use of a Broken or Risky Cryptographic Algorithm. NOTE: this is disputed by th

In oauth2-server (aka node-oauth2-server) through 3.1.1, the value of the redirect_uri parameter received during the aut

The Fluent Support WordPress plugin before 1.5.8 does not properly sanitise, validate and escape various parameters befo

The WPIDE WordPress plugin before 3.0 does not sanitize and validate the filename parameter before using it in a require

The Leaflet Maps Marker (Google Maps, OpenStreetMap, Bing Maps) WordPress plugin before 3.12.5 does not properly sanitiz

nitrado.js is a type safe wrapper for the Nitrado API. Possible ReDoS with lib input of `{{` and with many repetitions o

HCL iNotes is susceptible to a Reflected Cross-site Scripting (XSS) vulnerability caused by improper validation of user-

In FiberHome VDSL2 Modem HG150-Ub_V3.0, Credentials of Admin are submitted in URL, which can be logged/sniffed.

Zulip is an open source team chat and Zulip Mobile is an app for iOS and Andriod users. In Zulip Mobile through version

A use-after-free flaw was found in the Linux kernel’s PLP Rose functionality in the way a user triggers a race condition

A flaw was found in the Linux kernel. This flaw allows an attacker to crash the Linux kernel by simulating amateur radio

A vulnerability was found in fapolicyd. The vulnerability occurs due to an assumption on how glibc names the runtime lin

A flaw was found in the Linux kernel’s io_uring implementation. This flaw allows an attacker with a local account to cor

A single-byte, non-arbitrary write/use-after-free flaw was found in dnsmasq. This flaw allows an attacker who sends a cr

A vulnerability was found in linux kernel, where an information leak occurs via ext4_extent_header to userspace.

A vulnerbiility was found in Openscad, where a .scad file with no trailing newline could cause an out-of-bounds read dur

An out-of-bounds read vulnerability was discovered in linux kernel in the smc protocol stack, causing remote dos.

A heap-based buffer overflow flaw was found in libmodbus in function modbus_reply() in src/modbus.c.

A flaw was found in the QEMU virtio-fs shared file system daemon (virtiofsd) implementation. This flaw is strictly relat

The Samba AD DC includes checks when adding service principals names (SPNs) to an account to ensure that SPNs do not ali

A heap-based-buffer-over-read flaw was found in ImageMagick's GetPixelAlpha() function of 'pixel-accessor.h'. This vulne

Ingredients Stock Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at

Ingredients Stock Management System v1.0 was discovered to contain a SQL injection vulnerability via the month parameter

Ingredients Stock Management System v1.0 was discovered to contain a SQL injection vulnerability via the month parameter

Ingredients Stock Management System v1.0 was discovered to contain a SQL injection vulnerability via the month parameter

The forgot password token basically just makes us capable of taking over the account of whoever comment in an app that w

All versions of package morgan-json are vulnerable to Arbitrary Code Execution due to missing sanitization of input pass

Foxit PDF Reader before 11.1 and PDF Editor before 11.1, and PhantomPDF before 10.1.6, allow attackers to trigger a use-

Foxit PDF Reader before 11.1 and PDF Editor before 11.1, and PhantomPDF before 10.1.6, allow attackers to trigger a use-

Foxit PDF Reader before 11.1 and PDF Editor before 11.1, and PhantomPDF before 10.1.6, allow attackers to trigger a use-

Foxit PDF Reader before 11.1 and PDF Editor before 11.1, and PhantomPDF before 10.1.6, allow attackers to trigger a use-

Foxit PDF Reader before 11.1 and PDF Editor before 11.1, and PhantomPDF before 10.1.6, allow attackers to trigger a use-

Foxit PDF Reader before 11.1 and PDF Editor before 11.1, and PhantomPDF before 10.1.6, allow attackers to trigger a use-

TOTOLINK A810R V5.9c.4050_B20190424 was discovered to contain a command injection vulnerability via the component downlo

Tenda_TX9pro V22.03.02.10 was discovered to contain a buffer overflow via the component httpd/SetNetControlList.

TOTOLINK A810R V4.1.2cu.5182_B20201026 and V5.9c.4050_B20190424 was discovered to contain a hardcoded password for root

TOTOLINK A3000RU V4.1.2cu.5185_B20201128 was discovered to contain a hardcoded password for root at /etc/shadow.sample.

TOTOLINK A860R V4.1.2cu.5182_B20201027 was discovered to contain a hardcoded password for root at /etc/shadow.sample.

TOTOLINK N600R V4.3.0cu.7647_B20210106 was discovered to contain a hardcoded password for root at /etc/shadow.sample.

TOTOLINK A950RG V4.1.2cu.5204_B20210112 was discovered to contain a hardcoded password for root at /etc/shadow.sample.