2022

Improper Restriction of Excessive Authentication Attempts in GitHub repository kareadita/kavita prior to 0.6.0.3.

IBM CICS TX 11.1 Standard and Advanced could allow a remote attacker to bypass security restrictions, caused by a rever

IBM CICS TX 11.7 could allow an attacker to obtain sensitive information from HTTP response headers. IBM X-Force ID: 22

IBM CICS TX 11.7 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensi

IBM CICS TX 11.1 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to

IBM CICS TX 11.1 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID:

A malformed packet causes a stack overflow in the Ember ZNet stack. This causes an assert which leads to a reset, immed

Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Silicon Labs Ember ZNet allows

A heap buffer overflow in image_set_mask function of HTMLDOC before 1.9.15 allows an attacker to write outside the buffe

Concrete CMS is vulnerable to CSRF due to the lack of "State" parameter for external Concrete authentication service for

A vulnerability classified as problematic was found in SourceCodester Sanitization Management System. Affected by this v

IBM MQ Internet Pass-Thru 2.1, 9.2 LTS and 9.2 CD stores potentially sensitive information in trace files that could be

There is a vulnerability in DHCPv6 packet parsing code that could be explored by remote attacker to craft a packet that

Apache Jena SDB 3.17.0 and earlier is vulnerable to a JDBC Deserialisation attack if the attacker is able to control the

A stored cross-site scripting (XSS) vulnerability in the Add function of Eramba GRC Software c2.8.1 allows attackers to

OP5 Monitor 8.3.1, 8.3.2, and OP5 8.3.3 are vulnerable to Cross Site Scripting (XSS).

Rukovoditel v3.2.1 was discovered to contain a SQL injection vulnerability via the order_by parameter at /rukovoditel/in

The OAuth Client by DigitialPixies WordPress plugin through 1.1.0 does not have CSRF checks in some places, which could

The OAuth Client by DigitialPixies WordPress plugin through 1.1.0 does not sanitize and escapes some of its settings, wh

The ProfileGrid WordPress plugin before 5.1.1 does not sanitise and escape a parameter before outputting it back in the

The WPForms Pro WordPress plugin before 1.7.7 does not validate its form data when generating the exported CSV, which co

The Testimonials WordPress plugin before 2.7, super-testimonial-pro WordPress plugin before 1.0.8 do not sanitize and es

The Webmaster Tools Verification WordPress plugin through 1.2 does not have authorisation and CSRF checks when disabling

The WPB Show Core WordPress plugin does not sanitize and escape a parameter before outputting it back in the page, leadi

The tagDiv Composer WordPress plugin before 3.5, required by the Newspaper WordPress theme before 12.1 and Newsmag WordP

The WP Attachments WordPress plugin before 5.0.5 does not sanitize and escapes some of its settings, which could allow h

The Chat Bubble WordPress plugin before 2.3 does not sanitise and escape some contact parameters, which could allow unau

The reSmush.it : the only free Image Optimizer & compress plugin WordPress plugin before 0.4.4 lacks authorization in va

The reSmush.it : the only free Image Optimizer & compress plugin WordPress plugin before 0.4.4 does not perform CSRF che

In the default configuration of Apache SOAP, an RPCRouterServlet is available without authentication. This gives an atta

A vulnerability was found in Frappe. It has been rated as problematic. Affected by this issue is some unknown functional

A vulnerability in Example Dags of Apache Airflow allows an attacker with UI access who can trigger DAGs, to execute arb

A vulnerability in UI of Apache Airflow allows an attacker to view unmasked secrets in rendered template values for task

The Web Server in Ironman Software PowerShell Universal v3.x and v2.x allows for directory traversal outside of the conf

Escalation of privileges in the Web Server in Ironman Software PowerShell Universal 2.x and 3.x allows an attacker with

GNOME Nautilus 42.2 allows a NULL pointer dereference and get_basename application crash via a pasted ZIP archive.

Pillow before 9.3.0 allows denial of service via SAMPLESPERPIXEL.

Pillow before 9.2.0 performs Improper Handling of Highly Compressed GIF Data (Data Amplification).

In PHP versions prior to 7.4.33, 8.0.25 and 8.1.12, when using imageloadfont() function in gd extension, it is possible

Xiongmai Camera XM-JPR2-LX V4.02.R12.A6420987.10002.147502.00000 is vulnerable to plain-text traffic sniffing.

Xiongmai Camera XM-JPR2-LX V4.02.R12.A6420987.10002.147502.00000 is vulnerable to account takeover.

A vulnerability was found in NagVis up to 1.9.33 and classified as problematic. This issue affects the function checkAut

A vulnerability, which was classified as problematic, was found in NodeBB up to 2.5.7. This affects an unknown part of t

A vulnerability has been found in MZ Automation libiec61850 up to 1.4 and classified as critical. This vulnerability aff

A vulnerability, which was classified as problematic, has been found in NukeViet CMS. Affected by this issue is the func

A vulnerability classified as critical was found in Axiomatic Bento4. Affected by this vulnerability is the function AP4

A vulnerability classified as critical has been found in Pingkon HMS-PHP. Affected is an unknown function of the file /a

A vulnerability was found in Pingkon HMS-PHP. It has been rated as critical. This issue affects some unknown processing

A vulnerability was found in matrix-appservice-irc up to 0.35.1. It has been declared as critical. This vulnerability af

A vulnerability was found in LibTIFF. It has been classified as critical. This affects the function TIFFReadRGBATileExt