2022

Improper input validation and output encoding in all comments fields, in M-Files Hubshare before 3.3.10.9 allows auth

Javascript injection in PDFtron in M-Files Hubshare before 3.3.10.9 allows authenticated attackers to perform an accoun

There is a vulnerability on Forma LMS version 3.1.0 and earlier that could allow an authenticated attacker (with the rol

Forma LMS on its 3.1.0 version and earlier is vulnerable to a SQL injection vulnerability. The exploitation of this vuln

Forma LMS on its 3.1.0 version and earlier is vulnerable to a SQL injection vulnerability. The exploitation of this vuln

Delta Electronics InfraSuite Device Master versions 00.00.01a and prior deserialize network packets without proper veri

Delta Electronics InfraSuite Device Master versions 00.00.01a and prior allow unauthenticated users to trigger the Writ

Delta Electronics InfraSuite Device Master Versions 00.00.01a and prior mishandle .ZIP archives containing characters u

Delta Electronics InfraSuite Device Master versions 00.00.01a and prior lack proper authentication for functions that c

There is a vulnerability on Forma LMS version 3.1.0 and earlier that could allow an authenticated attacker (with the rol

Forma LMS on its 3.1.0 version and earlier is vulnerable to a SQL injection vulnerability. The exploitation of this vuln

Forma LMS version 3.1.0 and earlier are affected by an Cross-Site scripting vulnerability, that could allow a remote att

Delta Electronics InfraSuite Device Master Versions 00.00.01a and prior allow attacker provided data already serialized

Delta Electronics InfraSuite Device Master versions 00.00.01a and prior lacks authentication for a function that chan

Delta Electronics InfraSuite Device Master versions 00.00.01a and prior allow unauthenticated users to access the aprun

The database backup function in Delta Electronics InfraSuite Device Master Versions 00.00.01a and prior lacks proper au

An authenticated attacker could utilize the identical agent and cluster node linking keys to potentially allow for a sce

Delta Electronics InfraSuite Device Master versions 00.00.01a and prior deserialize user-supplied data provided through

Spring Security, versions 5.7 prior to 5.7.5 and 5.6 prior to 5.6.9 could be susceptible to authorization rules bypass v

Spring Security, versions 5.7 prior to 5.7.5, and 5.6 prior to 5.6.9, and older unsupported versions could be susceptibl

The Zoom Client for Meetings (for Android, iOS, Linux, macOS, and Windows) before version 5.12.2 is susceptible to a URL

A remote unprivileged attacker can interact with the configuration interface of a Flexi-Compact FLX3-CPUC1 or FLX3-CPUC2

Lodepng v20220717 was discovered to contain a segmentation fault via the function pngdetail.

pycdc commit 44a730f3a889503014fec94ae6e62d8401cb75e5 was discovered to contain a stack overflow via the component __san

tsMuxer v2.6.16 was discovered to contain a heap overflow via the function BitStreamWriter::flushBits() at /tsMuxer/bitS

timg v1.4.4 was discovered to contain a memory leak via the function timg::QueryBackgroundColor() at /timg/src/term-quer

rtf2html v0.2.0 was discovered to contain a heap overflow in the component /rtf2html/./rtf_tools.h.

conduit-hyper integrates a conduit application with the hyper server. Prior to version 0.4.2, `conduit-hyper` did not ch

The denial-of-service can be triggered by transmitting a carefully crafted CAN frame on the same CAN network as the vuln

Remote Code Execution in Clinic's Patient Management System v 1.0 allows Attacker to Upload arbitrary php webshell via p

A vulnerability was found in SourceCodester Train Scheduler App 1.0 and classified as critical. Affected by this issue i

The Rock Convert WordPress plugin before 2.11.0 does not sanitise and escape some of its settings, which could allow hig

The Rock Convert WordPress plugin before 2.11.0 does not sanitise and escape an URL before outputting it back in an attr

The Official Integration for Billingo WordPress plugin before 3.4.0 does not sanitise and escape some of its settings, w

The Automatic User Roles Switcher WordPress plugin before 1.1.2 does not have authorisation and proper CSRF checks, allo

The WP Word Count WordPress plugin through 3.2.3 does not sanitise and escape some of its settings, which could allow hi

The Customizer Export/Import WordPress plugin before 0.9.5 unserializes the content of an imported file, which could lea

The Ocean Extra WordPress plugin before 2.0.5 unserialises the content of an imported file, which could lead to PHP obje

The PublishPress Capabilities WordPress plugin before 2.5.2, PublishPress Capabilities Pro WordPress plugin before 2.5.2

The LearnPress WordPress plugin before 4.1.7.2 unserialises user input in a REST API endpoint available to unauthenticat

The Smart Slider 3 WordPress plugin before 3.5.1.11 unserialises the content of an imported file, which could lead to PH

The Easy WP SMTP WordPress plugin before 1.5.0 unserialises the content of an imported file, which could lead to PHP obj

The WordPress Classifieds Plugin WordPress plugin before 4.3 does not properly sanitise and escape some parameters befor

The WP Contact Slider WordPress plugin before 2.4.8 does not sanitize and escape its settings, allowing high privilege u

The WP Total Hacks WordPress plugin through 4.7.2 does not prevent low privilege users from modifying the plugin's setti

The Newspaper WordPress theme before 12 does not sanitise a parameter before outputting it back in an HTML attribute via

The Gallery Plugin for WordPress plugin before 1.8.4.7 does not escape the $_SERVER['REQUEST_URI'] parameter before outp

The Newspaper WordPress theme before 12 does not sanitise a parameter before outputting it back in an HTML attribute via

xfig 3.2.7 is vulnerable to Buffer Overflow.

A vulnerability, which was classified as critical, has been found in easyii CMS. This issue affects the function file of