2022

A vulnerability in web-based management interface of the of Cisco Email Security Appliance and Cisco Secure Email and We

A vulnerability in Cisco Email Security Appliance (ESA) and Cisco Secure Email and Web Manager could allow an unauthenti

diplib v3.0.0 is vulnerable to Double Free.

jhead 3.06 is vulnerable to Buffer Overflow via exif.c in function Put16u.

The Foundry Magritte plugin osisoft-pi-web-connector versions 0.15.0 - 0.43.0 was found to be logging in a manner that c

A CWE-89: Improper Neutralization of Special Elements used in SQL Command (‘SQL Injection’) vulnerability exists that al

A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in the SGI

A CWE-347: Improper Verification of Cryptographic Signature vulnerability exists in the SGIUtility component that allows

Code Injection in GitHub repository froxlor/froxlor prior to 0.10.39.

A CWE-704: Incorrect Project Conversion vulnerability exists that allows adversaries with local user privileges to load

A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that allow

XML External Entity (XXE) vulnerability in Trellix IPS Manager prior to 10.1 M8 allows a remote authenticated administra

Use of Externally-Controlled Format String in GitHub repository pingcap/tidb prior to 6.4.0, 6.1.3.

Incorrect access control in the anti-virus driver wsdkd.sys of Watchdog Antivirus v1.4.158 allows attackers to write arb

The Apache Pulsar C++ Client does not verify peer TLS certificates when making HTTPS calls for the OAuth2.0 Client Crede

The Handy Tip macro in Stiltsoft Handy Macros for Confluence Server/Data Center 3.x before 3.5.5 allows remote attackers

A CWE-347: Improper Verification of Cryptographic Signature vulnerability exists that allows adversaries with local user

In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can execute arbitrary code through t

In Splunk Enterprise versions below 8.1.12, 8.2.9, and 9.0.2, a remote user that holds the “power” Splunk role can store

Broken Access Control in User Authentication in Avaya Scopia Pathfinder 10 and 20 PTS version 8.3.7.0.4 allows remote un

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in JumpDEMAND Inc. 4ECPS Web Forms plugin <= 0.2.17 on Wo

Cross-Site Request Forgery (CSRF) vulnerability in David Cole Simple SEO plugin <= 1.8.12 on WordPress allows attackers

"IBM Robotic Process Automation 21.0.1, 21.0.2, 21.0.3, 21.0.4, and 21.0.5 is vulnerable to incorrect permission assignm

OpenHarmony-v3.1.2 and prior versions had a DOS vulnerability in distributedhardware_device_manager when joining a netwo

OpenHarmony-v3.1.2 and prior versions had an Multiple path traversal vulnerability in appspawn and nwebspawn services. L

OpenHarmony-v3.1.2 and prior versions had an Arbitrary file read vulnerability via download_server. Local attackers can

Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the id paramete

Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the id paramete

Online Tours & Travels Management System v1.0 was discovered to contain an arbitrary file upload vulnerability in the co

CandidATS version 3.0.0 on 'page' of the 'ajax.php' resource, allows an external attacker to steal the cookie of arbitra

CandidATS version 3.0.0 on 'sortDirection' of the 'ajax.php' resource, allows an external attacker to steal the cookie o

CandidATS version 3.0.0 on 'sortBy' of the 'ajax.php' resource, allows an external attacker to steal the cookie of arbit

CandidATS version 3.0.0 on 'indexFile' of the 'ajax.php' resource, allows an external attacker to steal the cookie of ar

CandidATS version 3.0.0 allows an external attacker to read arbitrary files from the server. This is possible because th

CandidATS version 3.0.0 allows an external attacker to perform CRUD operations on the application databases. This is pos

deep-parse-json version 1.0.2 allows an external attacker to edit or add new properties to an object. This is possible b

IBM Robotic Process Automation for Cloud Pak 21.0.1, 21.0.2, 21.0.3, 21.0.4, and 21.0.5 is vulnerable to exposure of th

fastest-json-copy version 1.0.1 allows an external attacker to edit or add new properties to an object. This is possible

deep-object-diff version 1.1.0 allows an external attacker to edit or add new properties to an object. This is possible

Markdownify version 1.4.1 allows an external attacker to remotely obtain arbitrary local files on any client that attemp

"IBM InfoSphere Information Server 11.7 is vulnerable to an XML External Entity Injection (XXE) attack when processing X

Zettlr version 2.3.0 allows an external attacker to remotely obtain arbitrary local files on any client that attempts to

"IBM InfoSphere Information Server 11.7 could allow a user to cause a denial of service by removing the ability to run j

"IBM MQ Appliance 9.2 CD, 9.2 LTS, 9.3 CD, and LTS 9.3 does not invalidate session after logout which could allow an aut

Cross-Site Request Forgery (CSRF) vulnerability in a3rev Software Page View Count plugin <= 2.5.5 on WordPress allows an

"IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 Web services could allow a man-in-the-middle attacker to conduc

IBM Robotic Process Automation 21.0.1 and 21.0.2 could disclose sensitive version to an unauthorized control sphere info

Auth. (admin+) Cross-Site Scripting (XSS) vulnerability in Stage Rock Convert plugin <= 2.11.0 on WordPress.

Missing Authorization, Cross-Site Request Forgery (CSRF) vulnerability in David Cole Simple SEO (WordPress plugin) plugi

"IBM InfoSphere Information Server 11.7 could allow a locally authenticated attacker to execute arbitrary commands on th