CRITICAL Severity CVEs

Prototype pollution vulnerability in stealjs steal 2.2.4 via the optionName variable in main.js.

Stack-based Buffer Overflow vulnerability in the EZVIZ Motion Detection component as used in camera models CS-CV248, CS-

Prototype pollution vulnerability in function extend in babel.js in stealjs steal 2.2.4 via the key variable in babel.js

Prototype pollution vulnerability in function convertLater in npm-convert.js in stealjs steal 2.2.4 via the requestedVer

An issue was discovered in Airties Smart Wi-Fi before 2020-08-04. It allows attackers to change the main/guest SSID and

ThinkPHP v6.0.13 was discovered to contain a deserialization vulnerability via the component League\Flysystem\Cached\Sto

TOTOLink A700RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the lang parameter

GLPI stands for Gestionnaire Libre de Parc Informatique and is a Free Asset and IT Management Software package, that pro

SmartRG SR506n 2.5.15 and SR510n 2.6.13 routers are vulnerable to Remote Code Execution (RCE) via the ping host feature.

Loan Management System 1.0 is vulnerable to SQL Injection at the login page, which allows unauthorized users to login as

Hospital Information System version 1.0 suffers from a remote SQL injection vulnerability that allows for authentication

OSU Open Source Lab VNCAuthProxy through 1.1.1 is affected by an vncap/vnc/protocol.py VNCServerAuthenticator authentica

Server-Side Request Forgery (SSRF) in GitHub repository ionicabizau/parse-url prior to 8.1.0.

An issue was discovered in Keyfactor PrimeKey EJBCA before 7.9.0, related to possible inconsistencies in DNS identifiers

Incorrect Access Control issue in Yellowfin Business Intelligence 7.3 allows remote attackers to escalate privilege via

The mobile application in Transtek Mojodat FAM (Fixed Asset Management) 2.4.6 allows remote attackers to send SCRIPT tag

The mobile application in Transtek Mojodat FAM (Fixed Asset Management) 2.4.6 allows remote attackers to bypass authoriz

WAPPLES through 6.0 has a hardcoded systemi account. A threat actor could use this account to access the system configur

In NOKIA 1350 OMS R14.2, multiple OS Command Injection vulnerabilities occurs. This vulnerability allow unauthenticated

Hospital Management System v1.0 was discovered to contain multiple SQL injection vulnerabilities via the Username and Pa

Summary:Product: AndroidVersions: Android SoCAndroid ID: A-238257000

Summary:Product: AndroidVersions: Android SoCAndroid ID: A-238257002

Summary:Product: AndroidVersions: Android SoCAndroid ID: A-238257004

Summary:Product: AndroidVersions: Android SoCAndroid ID: A-238227323

Summary:Product: AndroidVersions: Android SoCAndroid ID: A-238227324

Summary:Product: AndroidVersions: Android SoCAndroid ID: A-238227328

a function called 'nla_parse', do not check the len of para, it will check nla_type (which can be controlled by userspac

The path in this case is a little bit convoluted. The end result is that via an ioctl an untrusted app can control the u

Onedev is an open source, self-hosted Git Server with CI/CD and Kanban. When using Docker-based job executors, the Docke

Onedev is an open source, self-hosted Git Server with CI/CD and Kanban. In versions of Onedev prior to 7.3.0 unauthentic

Windows Internet Key Exchange (IKE) Protocol Extensions Remote Code Execution Vulnerability

Windows Internet Key Exchange (IKE) Protocol Extensions Remote Code Execution Vulnerability

Windows TCP/IP Remote Code Execution Vulnerability

Archery v1.4.0 to v1.8.5 was discovered to contain a SQL injection vulnerability via the ThreadIDs parameter in the kill

Archery v1.8.3 to v1.8.5 was discovered to contain multiple SQL injection vulnerabilities via the start_time and stop_ti

Archery v1.4.0 to v1.8.5 was discovered to contain a SQL injection vulnerability via the ThreadIDs parameter in the crea

Archery v1.7.5 to v1.8.5 was discovered to contain a SQL injection vulnerability via the where parameter at /archive/app

Archery v1.7.0 to v1.8.5 was discovered to contain a SQL injection vulnerability via the checksum parameter in the repor

Archery v1.4.5 to v1.8.5 was discovered to contain multiple SQL injection vulnerabilities via the start_file, end_file,

A vulnerability has been identified in Mendix SAML (Mendix 7 compatible) (All versions < V1.17.0), Mendix SAML (Mendix 8

UCMS v1.6.0 contains an authentication bypass vulnerability which is exploited via cookie poisoning.

Cuppa CMS v1.0 was discovered to contain an arbitrary file upload vulnerability via the File Manager.

SLiMS Senayan Library Management System v9.4.2 was discovered to contain multiple Server-Side Request Forgeries via the

The web configuration interface of the TP-Link M7350 V3 with firmware version 190531 is affected by a pre-authentication

A CWE-640: Weak Password Recovery Mechanism for Forgotten Password vulnerability exists that could cause unauthorized ac

Pebble Templates 3.1.5 allows attackers to bypass a protection mechanism and implement arbitrary code execution with spr

In Library Management System 1.0 the /card/in-card.php file id_no parameters are vulnerable to SQL injection.

Apache Calcite 1.22.0 introduced the SQL operators EXISTS_NODE, EXTRACT_XML, XML_TRANSFORM and EXTRACT_VALUE do not rest

Casdoor v1.97.3 was discovered to contain an arbitrary file write vulnerability via the fullFilePath parameter at /api/u

An issue was discovered in Active Intelligent Visualization 5. The Vdc header is used in a SQL query without being sanit