2022

The Project Source Code Download WordPress plugin through 1.0.0 does not protect its backup generation and download func

This issue exists to document that a security improvement in the way that Jira Server and Data Center use templates has

IBM DataPower Gateway 10.0.2.0 through 10.0.4.0, 10.0.1.0 through 10.0.1.8, 10.5.0.0, and 2018.4.1.0 through 2018.4.1.21

IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 could allow a privileged user to elevate their privilege to pl

A vulnerability classified as critical has been found in TEM FLEX-1085 1.6.0. Affected is an unknown function of the fil

IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 contains a vulnerability that could allow IBM tenant credentia

A link following vulnerability in the scanning function of Trend Micro Apex One and Worry-Free Business Security agents

Trend Micro Security 2021 and 2022 (Consumer) is vulnerable to an Out-Of-Bounds Read Information Disclosure Vulnerabilit

Trend Micro VPN Proxy Pro version 5.2.1026 and below contains a vulnerability involving some overly permissive folders i

D-Link DSL-3782 v1.03 and below was discovered to contain a stack overflow via the function getAttrValue.

D-Link DSL-3782 v1.03 and below was discovered to contain a command injection vulnerability via the function byte_4C0160

An inflation issue was discovered in Chia Network CAT1 Standard 1.0.0. Previously minted tokens minted on the Chia block

Improperly Implemented Security Check vulnerability in the SonicWall Hosted Email Security leads to bypass of Capture AT

Improper neutralization of special elements used in a user input allows an authenticated malicious user to perform remot

A maliciously crafted TIFF file when consumed through DesignReview.exe application can be forced to read beyond allocate

A maliciously crafted TGA or PCX file may be used to write beyond the allocated buffer through DesignReview.exe applicat

A Double Free vulnerability allows remote attackers to execute arbitrary code through DesignReview.exe application on PD

Access to external entities when parsing XML documents can lead to XML external entity (XXE) attacks. This flaw allows a

Parsing a maliciously crafted PRT file can force Autodesk AutoCAD 2023 to read beyond allocated boundaries. This vulnera

An attacker can force the victim’s device to perform arbitrary HTTP requests in WAN through a malicious SVG file being p

The Linux kernel before 5.18.13 lacks a certain clear operation for the block starting symbol (.bss). This allows Xen PV

In Eclipse Californium version 2.0.0 to 2.7.2 and 3.0.0-3.5.0 a DTLS resumption handshake falls back to a DTLS full hand

The package github.com/runatlantis/atlantis/server/controllers/events before 0.19.7 are vulnerable to Timing Attack in t

SimpleNetwork TCP Server commit 29bc615f0d9910eb2f59aa8dff1f54f0e3af4496 was discovered to contain a double free vulnera

Barangay Management System v1.0 was discovered to contain a SQL injection vulnerability via the hidden_id parameter at /

IBM QRadar SIEM 7.3, 7.4, and 7.5 is vulnerable to local privilege escalation if this could be combined with other unkno

SDL v1.2 was discovered to contain a use-after-free via the XFree function at /src/video/x11/SDL_x11yuv.c.

Horde Groupware Webmail Edition through 5.2.22 allows a reflection injection attack through which an attacker can instan

Use after free in WebGPU in Google Chrome prior to 100.0.4896.88 allowed a remote attacker to potentially exploit heap c

Realtek rtl819x-SDK before v3.6.1 allows command injection over the web interface.

DPTech VPN v8.1.28.0 was discovered to contain an arbitrary file read vulnerability.

Open Source Point of Sale v3.3.7 was discovered to contain an arbitrary file upload vulnerability via the Update Brandin

In zulip before 1.3.12, deactivated users could access messages if SSO was enabled.

WordPress Plugin mb.miniAudioPlayer-an HTML5 audio player for your mp3 files is prone to multiple vulnerabilities, inclu

Saia Burgess Controls (SBC) PCD through 2022-05-06 allows Authentication bypass. According to FSCT-2022-0062, there is a

Honeywell Experion PKS Safety Manager through 2022-05-06 has Missing Authentication for a Critical Function. According t

An issue has been discovered in GitLab affecting all versions starting from 15.0 before 15.0.1. Missing validation of in

When connecting to Amazon Workspaces, the SHA256 presented by AWS connection provisioner is not fully verified by Zero C

An attacker may use TWinSoft and a malicious source project file (TPG) to extract files on machine executing Ovarro TWin

Ovarro TBox proprietary Modbus file access functions allow attackers to read, alter, or delete the configuration file.

The “ipk” package containing the configuration created by TWinSoft can be uploaded, extracted, and executed in Ovarro TB

Ovarro TBox TWinSoft uses the custom hardcoded user “TWinSoft” with a hardcoded key.

An attacker could use specially crafted invalid Modbus frames to crash the Ovarro TBox system.

An attacker can decrypt the Ovarro TBox login password by communication capture and brute force attacks.

Apache Calcite Avatica JDBC driver creates HTTP client instances based on class names provided via `httpclient_impl` con

Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in webapi component i

Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in cgi component in Synology Audio

Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Syno

Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in task managem

In PHP versions 8.1.x below 8.1.8, when fileinfo functions, such as finfo_buffer, due to incorrect patch applied to the