2021

A flaw was found in libwebp in versions before 1.0.1. An out-of-bounds read was found in function ChunkAssignData. The h

A flaw was found in libwebp in versions before 1.0.1. An out-of-bounds read was found in function ChunkVerifyAndAssign.

A flaw was found in libwebp in versions before 1.0.1. A use-after-free was found due to a thread being killed too early.

A flaw was found in libwebp in versions before 1.0.1. A heap-based buffer overflow in function WebPDecodeRGBInto is poss

A use of uninitialized value was found in libwebp in versions before 1.0.1 in ReadSymbol().

A heap-based buffer overflow was found in libwebp in versions before 1.0.1 in ShiftBytes().

A heap-based buffer overflow was found in libwebp in versions before 1.0.1 in GetLE24().

A heap-based buffer overflow was found in libwebp in versions before 1.0.1 in PutLE16().

A heap-based buffer overflow was found in libwebp in versions before 1.0.1 in ApplyFilter().

A heap-based buffer overflow was found in libwebp in versions before 1.0.1 in GetLE16().

This vulnerability allows remote attackers to execute arbitrary code on affected installations of SolarWinds Orion Job S

This vulnerability allows remote attackers to execute arbitrary code on affected installations of SolarWinds Network Per

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 10.1.3.37

This vulnerability allows local attackers to escalate privileges on affected installations of Linux Kernel 5.11.15. An a

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Synology Dis

Zope is an open-source web application server. In Zope versions prior to 4.6 and 5.2, users can access untrusted modules

Nordic Semiconductor nRF52840 devices through 2020-10-19 have improper protection against physical side channels. The fl

The elliptic curve cryptography (ECC) hardware accelerator, part of the ARM® TrustZone® CryptoCell 310, contained in the

STMicroelectronics STM32L4 devices through 2021-03-29 have incorrect physical access control.

STMicroelectronics STM32L4 devices through 2020-10-19 have incorrect access control. The flash read-out protection (RDP)

The flash read-out protection (RDP) level is not enforced during the device initialization phase of the SoloKeys Solo 4.

An issue was discovered in Nitrokey FIDO U2F firmware through 1.1. Communication between the microcontroller and the sec

In Trusted Firmware-M through 1.3.0, cleaning up the memory allocated for a multi-part cryptographic operation (in the e

A relative path traversal vulnerability has been reported to affect QNAP NAS running QTS and QuTS hero. If exploited, th

The ECDSA operation of the micro-ecc library 1.0 is vulnerable to simple power analysis attacks which allows an adversar

rxvt-unicode 9.22, rxvt 2.7.10, mrxvt 0.5.4, and Eterm 0.9.7 allow (potentially remote) code execution because of improp

There is a denial of service vulnerability in some versions of ManageOne. There is a logic error in the implementation o

There is a denial of service vulnerability in some versions of ManageOne. In specific scenarios, due to the insufficient

Weak Encoding for Password in DoraCMS v2.1.1 and earlier allows attackers to obtain sensitive information as it does not

In function read_yin_leaf() in libyang <= v1.0.225, it doesn't check whether the value of retval->ext[r] is NULL. In som

In function lys_node_free() in libyang <= v1.0.225, it asserts that the value of node->module can't be NULL. But in some

In function ext_get_plugin() in libyang <= v1.0.225, it doesn't check whether the value of revision is NULL. If revision

A stack overflow in libyang <= v1.0.225 can cause a denial of service through function lyxml_parse_mem(). lyxml_parse_el

In function read_yin_container() in libyang <= v1.0.225, it doesn't check whether the value of retval->ext[r] is NULL. I

Zoho ManageEngine ADSelfService Plus before 6104 allows stored XSS on the /webclient/index.html#/directory-search user s

Admidio is a free, open source user management system for websites of organizations and groups. In Admidio before versio

An issue was discovered in Envoy 1.14.0. There is a remotely exploitable crash for HTTP2 Metadata, because an empty META

An issue was discovered in Envoy through 1.71.1. There is a remotely exploitable NULL pointer dereference and crash in T

An issue was discovered in Envoy through 1.71.1. There is a remotely exploitable integer overflow in which a very large

This affects the package dns-packet before 5.2.2. It creates buffers with allocUnsafe and does not always fill them befo

Cross Site Scripting (XSS) vulnerability in Halo 1.1.3 via post publish components in the manage panel, which lets a rem

Plone CMS until version 5.2.4 has a stored Cross-Site Scripting (XSS) vulnerability in the user fullname property and th

Pajbot is a Twitch chat bot. Pajbot versions prior to 1.52 are vulnerable to cross-site request forgery (CSRF). Hosters

OPC Foundation UA .NET Standard versions prior to 1.4.365.48 and OPC UA .NET Legacy are vulnerable to an uncontrolled re

A local file inclusion vulnerability in the FileServlet in all SearchBlox before 9.2.2 allows remote, unauthenticated us

Directory Traversal vulnerability in FusionPBX 4.5.7, which allows a remote malicious user to delete folders on the syst

Directory Traversal vulnerability exists in FusionPBX 4.5.7, which allows a remote malicious user to create folders via

A Directory Traversal vulnerability exists in FusionPBX 4.5.7 allows malicoius users to rename any file of the system.vi

Cross Site Scripting (XSS) vulnerability in FusionPBX 4.5.7 allows remote malicious users to inject arbitrary web script

IBM Security Identity Manager 7.0.2 could allow a remote attacker to obtain sensitive information, caused by the failure