2022

The GiveWP WordPress plugin before 2.21.3 does not properly sanitise and escape the currency settings, which could allow

The Advanced WordPress Reset WordPress plugin before 1.6 does not escape some generated URLs before outputting them back

The Progressive License WordPress plugin through 1.1.0 is lacking any CSRF check when saving its settings, which could a

The Microsoft Advertising Universal Event Tracking (UET) WordPress plugin before 1.0.4 does not sanitise and escape its

The Copyright Proof WordPress plugin through 4.16 does not sanitise and escape a parameter before outputting it back via

The YOP Poll WordPress plugin before 6.4.3 prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOT

Lura and KrakenD-CE versions older than v2.0.2 and KrakenD-EE versions older than v2.0.0 do not sanitize URL parameters

The Event Timeline WordPress plugin through 1.1.5 does not sanitize and escape Timeline Text, which could allow high-pri

The Login with phone number WordPress plugin before 1.3.8 does not sanitise and escape plugin settings which could allow

IBM UrbanCode Deploy (UCD) 6.2.0.0 through 6.2.7.16, 7.0.0.0 through 7.0.5.11, 7.1.0.0 through 7.1.2.7, and 7.2.0.0 thro

IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 could disclose sensitive information due to improper privilege

IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 is vulnerable to insufficiently protected credentials for user

IBM DataPower Gateway 10.0.2.0 through 10.0.4.0, 10.0.1.0 through 10.0.1.8, 10.5.0.0, and 2018.4.1.0 through 2018.4.1.21

IBM DataPower Gateway 10.0.2.0 through 10.0.4.0, 10.0.1.0 through 10.0.1.8, 10.5.0.0, and 2018.4.1.0 through 2018.4.1.21

IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 could allow a user to access information from a tenant of whic

A stack overflow was discovered in the _TIFFVGetField function of Tiffsplit v4.4.0. This vulnerability allows attackers

Authenticated (author or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in PluginlySpeaking Floating

When computing a shared secret or point multiplication on the NIST P-256 curve using a public key with an X coordinate o

When computing a shared secret or point multiplication on the NIST P-256 curve that results in an X coordinate of zero,

When compressing or decompressing a point on the NIST P-256 elliptic curve with an X coordinate of zero, the resulting o

When compressing or decompressing elliptic curve points using the Sweet B library, an incorrect choice of sign bit is us

The Velociraptor GUI contains an editor suggestion feature that can display the description field of a VQL function, plu

On MacOS and Linux, it may be possible to perform a symlink attack by replacing this predictable file name with a symlin

A cross-site scripting (XSS) issue in generating a collection report made it possible for malicious clients to inject Ja

Due to a bug in the handling of the communication between the client and server, it was possible for one client, already

A vulnerability, which was classified as critical, has been found in SourceCodester Garage Management System 1.0. This i

A vulnerability classified as critical was found in SourceCodester Garage Management System 1.0. This vulnerability affe

Incorrect signature trust exists within Google Play services SDK play-services-basement. A debug version of Google Play

png2webp v1.0.4 was discovered to contain an out-of-bounds write via the function w2p. This vulnerability is exploitable

PicoC v3.2.2 was discovered to contain a NULL pointer dereference at variable.c.

Advanced School Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the addr

The Email Viewer in RainLoop through 1.6.0 allows XSS via a crafted email message.

In zulip before 1.3.12, bot API keys were accessible to other users in the same realm.

Possible cross-site scripting vulnerability in libxml after commit 960f0e2.

Saia Burgess Controls (SBC) PCD through 2022-05-06 uses a Broken or Risky Cryptographic Algorithm. According to FSCT-202

Honeywell Experion PKS Safety Manager 5.02 has Insufficient Verification of Data Authenticity. According to FSCT-2022-00

Honeywell Experion PKS Safety Manager 5.02 uses Hard-coded Credentials. According to FSCT-2022-0052, there is a Honeywel

Authenticated (author or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in GS Plugins GS Testimonial

The authfile directive in the booth config file is ignored, preventing use of authentication in communications from node

In kippo-graph before version 1.5.1, there is a cross-site scripting vulnerability in $file_link in class/KippoInput.cla

In kippo-graph before version 1.5.1, there is a cross-site scripting vulnerability in xss_clean() in class/KippoInput.cl

Unauthenticated redirection to a malicious website

Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Syno

Exposure of sensitive information to an unauthorized actor vulnerability in web server in Synology Media Server before 1

Insufficient validation of untrusted input in File in Google Chrome on Android prior to 103.0.5060.134 allowed an attack

An issue was discovered in Veritas NetBackup 8.1.x through 8.1.2, 8.2, 8.3.x through 8.3.0.2, 9.x through 9.0.0.1, and 9

An issue was discovered in Veritas NetBackup 8.1.x through 8.1.2, 8.2, 8.3.x through 8.3.0.2, 9.x through 9.0.0.1, and 9

An issue was discovered in Veritas NetBackup 8.1.x through 8.1.2, 8.2, 8.3.x through 8.3.0.2, 9.x through 9.0.0.1, and 9

An issue was discovered in Veritas NetBackup 8.1.x through 8.1.2, 8.2, 8.3.x through 8.3.0.2, 9.x through 9.0.0.1, and 9

An issue was discovered in Veritas NetBackup 8.1.x through 8.1.2, 8.2, 8.3.x through 8.3.0.2, 9.x through 9.0.0.1, and 9