CRITICAL Severity CVEs

https://gitee.com/mingSoft/MCMS MCMS <=5.2.5 is affected by: RCE. The impact is: execute arbitrary code (remote). The at

This issue affects: Secomea GateManager Version 9.6.621421014 and all prior versions. Improper Limitation of a Pathname

On WatchGuard Firebox and XTM appliances, an unauthenticated user can execute arbitrary code, aka FBX-22786. This vulner

Improper Restriction of XML External Entity Reference in GitHub repository liquibase/liquibase prior to 4.8.0.

Victor CMS v1.0 was discovered to contain a SQL injection vulnerability.

There is a stack buffer overflow vulnerability in the formSetPPTPServer function of Tenda-AX3 router V16.03.12.10_CN. Th

There is a stack buffer overflow vulnerability in the formSetPPTPServer function of Tenda-AX3 router V16.03.12.10_CN. Th

OS Command Injection in GitHub repository part-db/part-db prior to 0.5.11.

Under certain ldap conditions, Cacti authentication can be bypassed with certain credential types.

In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack whe

Improper Restriction of XML External Entity Reference in GitHub repository hazelcast/hazelcast in 5.1-BETA-1.

A directory traversal vulnerability was found in the ClairCore engine of Clair. An attacker can exploit this by supplyin

MCMS v5.2.4 was discovered to contain a SQL injection vulnerability via search.do in the file /mdiy/dict/listExcludeApp.

MCMS v5.2.5 was discovered to contain a SQL injection vulnerability via search.do in the file /web/MCmsAction.java.

MCMS v5.2.5 was discovered to contain a SQL injection vulnerability via the categoryId parameter in the file IContentDao

OS Command Injection in GitHub repository ljharb/npm-lockfile in v2.0.3 and v2.0.4.

Printix Secure Cloud Print Management through 1.3.1106.0 incorrectly uses Privileged APIs to modify values in HKEY_LOCAL

Bank Management System v1.o was discovered to contain a SQL injection vulnerability via the email parameter.

Simple Mobile Comparison Website v1.0 was discovered to contain a SQL injection vulnerability via the search parameter.

Air Cargo Management System v1.0 was discovered to contain a SQL injection vulnerability via the ref_code parameter.

Simple Real Estate Portal System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter.

Auto Spare Parts Management v1.0 was discovered to contain a SQL injection vulnerability via the user parameter.

Cosmetics and Beauty Product Online Store v1.0 was discovered to contain a SQL injection vulnerability via the search pa

Cosmetics and Beauty Product Online Store v1.0 was discovered to contain multiple reflected cross-site scripting (XSS) a

Medical Store Management System v1.0 was discovered to contain a SQL injection vulnerability via the cid parameter under

Home Owners Collection Management System v1.0 was discovered to contain hardcoded credentials which allows attackers to

Excel-Streaming-Reader is an easy-to-use implementation of a streaming Excel reader using Apache POI. Prior to xlsx-stre

seacms V11.5 is affected by an arbitrary code execution vulnerability in admin_config.php.

Home Owners Collection Management System v1.0 was discovered to contain an arbitrary file upload vulnerability via the c

Zoho ManageEngine SharePoint Manager Plus before 4329 allows account takeover because authorization is mishandled.

Zoho ManageEngine SharePoint Manager Plus before 4329 is vulnerable to a sensitive data leak that leads to privilege esc

The component /rootfs in RageFile of Stepmania v5.1b2 and below allows attackers access to the entire file system.

image_processing is an image processing wrapper for libvips and ImageMagick/GraphicsMagick. Prior to version 1.12.2, usi

wire-avs is the audio visual signaling (AVS) component of Wire, an open-source messenger. A remote format string vulnera

An improper authentication vulnerability in FortiMail before 7.0.1 may allow a remote attacker to efficiently guess one

A command injection vulnerability in the web interface of the Zyxel NWA-1100-NH firmware could allow an attacker to exec

A directory traversal vulnerability in the apoc plugins in Neo4J Graph database before 4.4.0.1 allows attackers to read

Hicos citizen certificate client-side component does not filter special characters for command parameters in specific we

A Remote Code Execution (RCE) vulnerability at /admin/options in Maxsite CMS v180 allows attackers to execute arbitrary

A Remote Code Execution (RCE) vulnerability exists in DataRobot through 2021-10-28 because it allows submission of a Doc

CodeIgniter4 is the 4.x branch of CodeIgniter, a PHP full-stack web framework. Prior to version 4.1.9, an improper input

ARM astcenc 3.2.0 is vulnerable to Buffer Overflow. When the compression function of the astc-encoder project with -cl o

Car Driving School Management System v1.0 is affected by SQL injection in the login page. An attacker can use simple SQL

Server-Side Request Forgery (SSRF) in GitHub repository rudloff/alltube prior to 3.0.2.

The TI WooCommerce Wishlist WordPress plugin before 1.40.1, TI WooCommerce Wishlist Pro WordPress plugin before 1.40.1 d

The Post Snippets WordPress plugin before 3.1.4 does not have CSRF check when importing files, allowing attacker to make

On ICL ScadaFlex II SCADA Controller SC-1 and SC-2 1.03.07 devices, unauthenticated remote attackers can overwrite, dele

Home Owners Collection Management System v1.0 was discovered to contain a SQL injection vulnerability via the id paramet

Home Owners Collection Management System v1.0 allows unauthenticated attackers to compromise user accounts via a crafted

JetBrains TeamCity before 2021.2.3 was vulnerable to OS command injection in the Agent Push feature configuration.