2022

A vulnerability classified as critical was found in Yunjing CMS. This vulnerability affects unknown code of the file /in

D-Link DIR-846 devices with firmware 100A35 allow remote attackers to execute arbitrary code as root via HNAP1/control/S

ProcessWire v3.0.200 was discovered to contain a Cross-Site Request Forgery (CSRF).

ProcessWire v3.0.200 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities via the Search Users

Prototype pollution vulnerability in function resolveShims in resolve-shims.js in thlorenz browserify-shim 3.8.15 via th

A Regular Expression Denial of Service (ReDoS) flaw was found in kangax html-minifier 4.0.0 because of the reCustomIgnor

A remote, unauthenticated, directory traversal vulnerability was identified within the web interface used by IND780 Adva

Cross-site Scripting (XSS) - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.1.8.

Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.8.

Mail SQR Expert system has a Local File Inclusion vulnerability. An unauthenticated remote attacker can exploit this vul

Mail SQR Expert’s specific function has insufficient filtering for special characters. An unauthenticated remote attacke

Ragic report generation page has insufficient filtering for special characters. A remote attacker with general user priv

U-Office Force Forum function has insufficient filtering for special characters. A remote attacker with general user pri

U-Office Force UserDefault page has insufficient filtering for special characters in the HTTP header fields. A remote at

U-Office Force PrintMessage function has insufficient filtering for special characters. An unauthenticated remote attack

U-Office Force Bulletin function has insufficient filtering for special characters. An unauthenticated remote attacker c

U-Office Force Download function has a path traversal vulnerability. A remote attacker with general user privilege can e

U-Office Force Download function has a path traversal vulnerability. A remote attacker with general user privilege can e

U-Office Force login function has an Open Redirect vulnerability. An unauthenticated remote attacker can exploit this vu

strongSwan before 5.9.8 allows remote attackers to cause a denial of service in the revocation plugin by sending a craft

An issue was discovered in the Linux kernel through 6.0.6. drivers/char/pcmcia/scr24x_cs.c has a race condition and resu

An issue was discovered in the Linux kernel through 6.0.6. drivers/char/pcmcia/cm4040_cs.c has a race condition and resu

An issue was discovered in the Linux kernel through 6.0.6. drivers/char/pcmcia/cm4000_cs.c has a race condition and resu

PwnDoc through 0.5.3 might allow remote attackers to identify disabled user account names by leveraging response message

PwnDoc through 0.5.3 might allow remote attackers to identify valid user account names by leveraging response timings fo

An issue was discovered in OpenStack Sushy-Tools through 0.21.0 and VirtualBMC through 2.2.2. Changing the boot device c

In Total.js 4 before 0e5ace7, /api/common/ping can achieve remote command execution via shell metacharacters in the host

curl before 7.86.0 has a double free. If curl is told to use an HTTP proxy for a transfer with a non-HTTP(S) URL, it set

multipath-tools 0.7.0 through 0.9.x before 0.9.2 allows local users to obtain root access, as exploited alone or in conj

multipath-tools 0.7.7 through 0.9.x before 0.9.2 allows local users to obtain root access, as exploited in conjunction w

Stimulsoft (aka Stimulsoft Reports) 2013.1.1600.0, when Compilation Mode is used, allows an attacker to execute arbitrar

Weak Password Requirements in GitHub repository thorsten/phpmyfaq prior to 3.1.8.

In curl before 7.86.0, the HSTS check could be bypassed to trick it into staying with HTTP. Using its HSTS support, curl

An issue has been discovered in GitLab affecting all versions starting from 10.0 before 12.9.8, all versions starting fr

Nginx NJS v0.7.2 was discovered to contain a heap-use-after-free bug caused by illegal memory copy in the function njs_j

Nginx NJS v0.7.4 was discovered to contain a segmentation violation in njs_promise_reaction_job. NOTE: the vendor disput

Nginx NJS v0.7.2 to v0.7.4 was discovered to contain a segmentation violation via njs_scope_valid_value at njs_scope.h.

wasm2c v1.0.29 was discovered to contain an abort in CWriter::Write.

wasm-interp v1.0.29 was discovered to contain an out-of-bounds read via the component OnReturnCallIndirectExpr->GetRetur

wasm-interp v1.0.29 was discovered to contain a heap overflow via the component std::vector<wabt::Type, std::allocator<w

wasm-interp v1.0.29 was discovered to contain an out-of-bounds read via the component OnReturnCallExpr->GetReturnCallDro

Prototype pollution vulnerability in function resolveShims in resolve-shims.js in thlorenz browserify-shim 3.8.15 via th

The Web Stories plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including 1.24.

The Log HTTP Requests plugin for WordPress is vulnerable to Stored Cross-Site Scripting via logged HTTP requests in vers

The Bricks theme for WordPress is vulnerable to remote code execution due to the theme allowing site editors to include

Canteen Management System v1.0 was discovered to contain a SQL injection vulnerability via the userid parameter at /php_

Canteen Management System v1.0 was discovered to contain a SQL injection vulnerability via the userid parameter at /php_

Canteen Management System v1.0 was discovered to contain an arbitrary file upload vulnerability via /youthappam/manage_w

Simple Cold Storage Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter

Simple Cold Storage Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter