MEDIUM Severity CVEs

Use-After-Free (UAF) vulnerability in the display module Impact: Successful exploitation of this vulnerability may cause

Out-of-bounds array read vulnerability in the FFRT module Impact: Successful exploitation of this vulnerability may caus

Vulnerability of improper log information control in the UI framework module Impact: Successful exploitation of this vul

Arbitrary write vulnerability in the Gallery module Impact: Successful exploitation of this vulnerability may affect se

Permission verification vulnerability in the media library module Impact: Successful exploitation of this vulnerability

Identity verification vulnerability in the ParamWatcher module Impact: Successful exploitation of this vulnerability may

Apache James server JMAP HTML to text plain implementation in versions below 3.8.2 and 3.7.6 is subject to unbounded mem

The Post and Page Builder by BoldGrid – Visual Drag and Drop Editor plugin for WordPress is vulnerable to Path Traversal

Improper neutralization of argument delimiters in a command ('Argument Injection') issue exists in Defense Platform Home

NULL pointer dereference vulnerability exists in Defense Platform Home Edition Ver.3.9.51.x and earlier. If an attacker

The LikeBot WordPress plugin through 0.85 does not have CSRF check in some places, and is missing sanitisation as well

IBM App Connect enterprise 12.0.1.0 through 12.0.12.10 and 13.0.1.0 through 13.0.2.1 could allow an authenticated user t

IBM ApplinX 11.1 stores sensitive information in cleartext in memory that could be obtained by an authenticated user.

IBM ApplinX 11.1 could allow a remote attacker to obtain sensitive information when a detailed technical error message i

IBM ApplinX 11.1 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable

IBM ApplinX 11.1 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to vi

IBM ApplinX 11.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unau

IBM ApplinX 11.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unau

IBM ApplinX 11.1 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitra

IBM ApplinX 11.1 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitra

IBM ApplinX 11.1 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitra

IBM Aspera Shares 1.9.0 through 1.10.0 PL6 could allow an attacker to spoof their IP address, which is written to log f

IBM Aspera Shares 1.9.0 through 1.10.0 PL6 is vulnerable to stored cross-site scripting. This vulnerability allows auth

IBM Aspera Shares 1.9.0 through 1.10.0 PL6 is vulnerable to server-side request forgery (SSRF). This may allow an authe

IBM Aspera Shares 1.9.0 through 1.10.0 PL6 is vulnerable to server-side request forgery (SSRF). This may allow an authe

IBM Aspera Shares 1.9.0 through 1.10.0 PL6 is vulnerable to HTML injection. A remote attacker could inject malicious HTM

IBM Aspera Shares 1.9.0 through 1.10.0 PL6 is vulnerable to cross-site scripting. This vulnerability allows a privilege

IBM Aspera Shares 1.9.0 through 1.10.0 PL6 does not properly rate limit the frequency that an authenticated user can sen

A floating point exception (divide-by-zero) vulnerability was discovered in Bento4 1.6.0-641 in function AP4_TfraAtom()

A prototype pollution in the lib.createUploader function of @rpldy/uploader v1.8.1 allows attackers to cause a Denial of

A Stored Cross-Site Scripting (XSS) vulnerability was identified affecting Skybox Change Manager versions 13.2.170 and e

Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malw

Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malw

Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malw

When BIG-IP Next Central Manager is running, undisclosed requests to the BIG-IP Next Central Manager API can cause the B

When multiple server blocks are configured to share the same IP address and port, an attacker can use session resumption

When users log in through the webUI or API using local authentication, BIG-IP Next Central Manager may log sensitive inf

Proposed Generic UDP Encapsulation (GUE) (IETF Draft) do not validate or verify the source of a network packet allowing

GRE and GRE6 Protocols (RFC2784) do not validate or verify the source of a network packet allowing an attacker to spoof

A vulnerability in Simple Network Management Protocol (SNMP) polling for Cisco Secure Email and Web Manager, Cisco Secur

Multiple vulnerabilities in the web-based management interface of Cisco Identity Services Engine (ISE) guest portals cou

Multiple vulnerabilities in the web-based management interface of Cisco Identity Services Engine (ISE) guest portals cou

A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email Gateway and Cisco

A vulnerability in a policy-based Cisco Application Visibility and Control (AVC) implementation of Cisco AsyncOS Softwar

A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email and Web Manager a

A vulnerability in the web-based management interface of Cisco Expressway Series could allow an unauthenticated, remote

HCL iAutomate is affected by a session fixation vulnerability.  An attacker could hijack a victim's session ID from thei

Dell Avamar, version 19.4 or later, contains an access token reuse vulnerability in the AUI. A low privileged local atta

IBM Cloud Pak for Business Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21

IBM Cloud Pak for Business Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21