2022

An issue was discovered in Joomla! 4.0.0 through 4.2.3. Sites with publicly enabled debug mode exposed data of previous

The collection remote for pulp_ansible stores tokens in plaintext instead of using pulp's encrypted field and exposes th

A vulnerability in the MiCollab Client API of Mitel MiCollab through 9.5.0.101 could allow an authenticated attacker to

A vulnerability in the MiCollab Client API of Mitel MiCollab 9.1.3 through 9.5.0.101 could allow an authenticated attack

A vulnerability in the MiCollab Client server component of Mitel MiCollab through 9.5.0.101 could allow an authenticated

A vulnerability in Batik of Apache XML Graphics allows an attacker to run Java code from untrusted SVG via JavaScript. T

A vulnerability in Batik of Apache XML Graphics allows an attacker to run untrusted Java code from an SVG. This issue af

The WP All Export Pro WordPress plugin before 1.7.9 uses the contents of the cc_sql POST parameter directly as a databas

The WP All Export Pro WordPress plugin before 1.7.9 does not limit some functionality during exports only to users with

The Post to CSV by BestWebSoft WordPress plugin through 1.4.0 does not properly escape fields when exporting data as CSV

The WP Humans.txt WordPress plugin through 1.0.6 does not sanitise and escape some of its settings, which could allow hi

The Retain Live Chat WordPress plugin through 0.1 does not sanitise and escape some of its settings, which could allow h

The Contact Bank WordPress plugin through 3.0.30 does not sanitise and escape some of its Form settings, which could all

A flaw was found in the KVM's AMD nested virtualization (SVM). A malicious L1 guest could purposely fail to intercept th

The Kadence WooCommerce Email Designer WordPress plugin before 1.5.7 unserialises the content of an imported file, which

The Spam protection, AntiSpam, FireWall by CleanTalk WordPress plugin before 5.185.1 does not validate ids before using

The Form Maker by 10Web WordPress plugin before 1.15.6 does not properly sanitise and escape a parameter before using it

The Blog2Social: Social Media Auto Post & Scheduler WordPress plugin before 6.9.10 does not have authorisation in an AJA

The Blog2Social: Social Media Auto Post & Scheduler WordPress plugin before 6.9.10 does not properly sanitise and escape

The Plugin LBstopattack WordPress plugin before 1.1.3 does not use nonces when saving its settings, making it possible f

An issue was discovered in Connected Vehicle Systems Alliance (COVESA) dlt-daemon through 2.18.8. Due to a faulty DLT fi

An issue was discovered in Connected Vehicle Systems Alliance (COVESA) dlt-daemon through 2.18.8. Due to a faulty DLT fi

Dependency-Track is a Component Analysis platform that allows organizations to identify and reduce risk in the software

@dependencytrack/frontend is a Single Page Application (SPA) used in Dependency-Track, an open source Component Analysis

The Tasks.org Android app is an open-source app for to-do lists and reminders. The Tasks.org app uses the activity `Shar

Gin-vue-admin is a backstage management system based on vue and gin, which separates the front and rear of the full stac

OpenFGA is an authorization/permission engine. Versions prior to version 0.2.4 are vulnerable to authorization bypass un

OpenFGA is an authorization/permission engine. Versions prior to version 0.2.4 are vulnerable to authorization bypass un

OpenFGA is an authorization/permission engine. Prior to version 0.2.4, the `streamed-list-objects` endpoint was not vali

Azure CLI is the command-line interface for Microsoft Azure. In versions previous to 2.40.0, Azure CLI contains a vulner

kartverket/github-workflows are shared reusable workflows for GitHub Actions. Prior to version 2.7.5, all users of the `

@keystone-6/core is a core package for Keystone 6, a content management system for Node.js. Starting with version 2.2.0

GitHub Actions Runner is the application that runs a job from a GitHub Actions workflow. The actions runner invokes the

Kirby is a Content Management System. Prior to versions 3.5.8.2, 3.6.6.2, 3.7.5.1, and 3.8.1, a user enumeration vulnera

Dataease is an open source data visualization analysis tool. Dataease prior to 1.15.2 has a deserialization vulnerabilit

Free5gc v3.2.1 is vulnerable to Information disclosure.

Zalando Skipper v0.13.236 is vulnerable to Server-Side Request Forgery (SSRF).

Adobe Illustrator versions 26.4 (and earlier) and 25.4.7 (and earlier) are affected by an out-of-bounds read vulnerabili

Adobe Illustrator versions 26.4 (and earlier) and 25.4.7 (and earlier) are affected by an Improper Input Validation vuln

A cross site scripting vulnerability exists in some map service configurations of ArcGIS Server versions 10.8.1 and 10.7

A remote file download issue can occur in some capabilities of Esri ArcGIS Server web services that may in some edge cas

There is a reflected cross site scripting issue in the Esri ArcGIS Server services directory versions 10.9.1 and below t

Esri ArcGIS Server versions 10.9.1 and below have an unvalidated redirect issue that may allow a remote, unauthenticated

Esri ArcGIS Server versions 10.9.1 and prior have a path traversal vulnerability that may result in a denial of service

There is as reflected cross site scripting issue in Esri ArcGIS Server versions 10.9.1 and below which may allow a remot

AlgoSec – FireFlow Reflected Cross-Site-Scripting (RXSS) A malicious user injects JavaScript code into a parameter calle

Four format string injection vulnerabilities exist in the web interface /action/wirelessConnect functionality of Abode S

Four format string injection vulnerabilities exist in the web interface /action/wirelessConnect functionality of Abode S

Four format string injection vulnerabilities exist in the web interface /action/wirelessConnect functionality of Abode S

Four format string injection vulnerabilities exist in the web interface /action/wirelessConnect functionality of Abode S