2022

A vulnerability, which was classified as problematic, was found in lanyulei ferry. This affects an unknown part of the f

A vulnerability, which was classified as critical, has been found in lanyulei ferry. Affected by this issue is some unkn

Arches is a web platform for creating, managing, & visualizing geospatial data. Versions prior to 6.1.2, 6.2.1, and 7.1.

Contiki-NG is an open-source, cross-platform operating system for Next-Generation IoT devices. Versions prior to 4.9 are

DexLoader function get_stringidx_fromdex() in Redex prior to commit 3b44c64 can load an out of bound address when loadin

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. In versions prio

Improper input validation in the firmware for some Intel(R) Server Board M10JNP Family before version 7.216 may allow a

Broken Access Control vulnerability leading to Stored Cross-Site Scripting (XSS) in Traffic Manager plugin <= 1.4.5 on W

All versions of ETIC Telecom Remote Access Server (RAS) 4.5.0 and prior’s application programmable interface (API) is vu

All versions of ETIC Telecom Remote Access Server (RAS) 4.5.0 and prior is vulnerable to malicious file upload. An attac

A vulnerability has been identified in SIPLUS TIM 1531 IRC (6AG1543-1MX00-7XE0) (All versions < V2.4.8), TIM 1531 IRC (6

All versions of ETIC Telecom Remote Access Server (RAS) 4.5.0 and prior’s web portal is vulnerable to accepting maliciou

The Docker image of ownCloud Server through 10.11 contains a misconfiguration that renders the trusted_domains config us

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. In versions prio

ezplatform-graphql is a GraphQL server implementation for Ibexa DXP and Ibexa Open Source. Versions prior to 2.3.12 and

Tauri is a framework for building binaries for all major desktop platforms. In versions prior to 1.0.7 and 1.1.2, Tauri

dotCMS before 22.06 allows remote attackers to bypass intended access control and obtain sensitive information by using

An issue was discovered in BMC Remedy before 22.1. Email-based Incident Forwarding allows remote authenticated users to

AyaCMS v3.1.2 was discovered to contain an arbitrary file upload vulnerability via the component /admin/fst_upload.inc.p

Unmarshal can panic on some inputs, possibly allowing for denial of service attacks.

Wasmtime is a standalone runtime for WebAssembly. Prior to version 2.0.2, there is a bug in Wasmtime's C API implementat

Wasmtime is a standalone runtime for WebAssembly. Prior to versions 2.0.2 and 1.0.2, there is a bug in Wasmtime's implem

Wasmtime is a standalone runtime for WebAssembly. Prior to version 2.0.2, there is a bug in Wasmtime's implementation of

Istio is an open platform to connect, manage, and secure microservices. In versions on the 1.15.x branch prior to 1.15.3

Vela is a Pipeline Automation (CI/CD) framework built on Linux container technology written in Golang. In Vela Server an

Deeplearning4J is a suite of tools for deploying and training deep learning models using the JVM. Packages org.deeplearn

mm-wki v0.2.1 is vulnerable to Cross Site Scripting (XSS).

xpdfreader 4.03 is vulnerable to Buffer Overflow.

The EU Cookie Law GDPR (Banner + Blocker) module before 2.1.3 for PrestaShop allows SQL Injection via a cookie ( lgcooki

xterm before 375 allows code execution via font ops, e.g., because an OSC 50 response may have Ctrl-g and therefore lead

NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where a local user wi

ESPCMS P8.21120101 was discovered to contain a remote code execution (RCE) vulnerability in the component IS_GETCACHE.

ESPCMS P8.21120101 was discovered to contain a remote code execution (RCE) vulnerability in the component INPUT_ISDESCRI

ESPCMS P8.21120101 was discovered to contain a remote code execution (RCE) vulnerability in the component UPFILE_PIC_ZOO

An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in spacewalk/Uyuni

A Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in spacewalk/Uyuni of SUS

Agentflow BPM enterprise management system has improper authentication. A remote attacker with general user privilege ca

Agentflow BPM file download function has a path traversal vulnerability. An unauthenticated remote attacker can exploit

The file upload function of Agentflow BPM has insufficient filtering for special characters in URLs. An unauthenticated

UPSMON PRO transmits sensitive data in cleartext over HTTP protocol. An unauthenticated remote attacker can exploit this

UPSMON PRO configuration file stores user password in plaintext under public user directory. A remote attacker with gene

UPSMON PRO’s has a path traversal vulnerability. A remote attacker with general user privilege can exploit this vulnerab

UPSMON Pro login function has insufficient authentication. An unauthenticated remote attacker can exploit this vulnerabi

An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in spacewalk/Uyuni of SU

Multiple W&T products of the Comserver Series use a small number space for allocating sessions ids. After login of an us

Multiple W&T Products of the ComServer Series are prone to an XSS attack. An authenticated remote Attacker can execute a

Plesk Obsidian allows a CSRF attack, e.g., via the /api/v2/cli/commands REST API to change an Admin password. NOTE: Obsi

Payara before 2022-11-04, when deployed to the root context, allows attackers to visit META-INF and WEB-INF, a different

HashiCorp Nomad and Nomad Enterprise 1.4.0 up to 1.4.1 event stream subscribers using a token with TTL receive updates u

HashiCorp Nomad and Nomad Enterprise 1.4.0 up to 1.4.1 workload identity token can list non-sensitive metadata for paths