2021

This affects the package total.js before 3.4.7. The set function can be used to set a value into the object according to

This affects the package total.js before 3.4.7. The issue occurs in the image.pipe and image.stream functions. The type

In Django 2.2 before 2.2.18, 3.0 before 3.0.12, and 3.1 before 3.1.6, the django.utils.archive.extract method (used by "

An issue was discovered in uIP through 1.0, as used in Contiki and Contiki-NG. Domain name parsing lacks bounds checks,

A stack overflow vulnerability in Facebook Hermes 'builtin apply' prior to commit 86543ac47e59c522976b5632b8bf9a2a4583c7

UCOPIA Wi-Fi appliances 6.0.5 allow authenticated remote attackers to escape the restricted administration shell CLI, an

UCOPIA Wi-Fi appliances 6.0.5 allow arbitrary code execution with root privileges using chroothole_client's PHP call, a

UCOPIA Wi-Fi appliances 6.0.5 allow arbitrary code execution with admin user privileges via an escape from a restricted

Affected versions of Atlassian Jira Server and Data Center allow remote attackers to view the metadata of boards they sh

Affected versions of Atlassian Fisheye and Crucible allow remote attackers to view a product's SEN via an Information Di

FortiLogger 4.4.2.2 is affected by Arbitrary File Upload by sending a "Content-Type: image/png" header to Config/SaveUpl

A cross-site scripting (XSS) vulnerability in many forms of Wikindx before 5.7.0 and 6.x through 6.4.0 allows remote att

An issue was discovered on TK-Star Q90 Junior GPS horloge 3.1042.9.8656 devices. Any SIM card used with the device canno

An issue was discovered on TK-Star Q90 Junior GPS horloge 3.1042.9.8656 devices. When using the device at initial setup,

An issue was discovered on TK-Star Q90 Junior GPS horloge 3.1042.9.8656 devices. It performs actions based on certain SM

An issue was discovered in SeTracker2 for TK-Star Q90 Junior GPS horloge 3.1042.9.8656 devices. It has unnecessary permi

This affects the package jinja2 from 0.0.0 and before 2.11.3. The ReDoS vulnerability is mainly due to the `_punctuation

MinIO is a High Performance Object Storage released under Apache License v2.0. In MinIO before version RELEASE.2021-01-3

Sql injection vulnerability in koa2-blog 1.0.0 allows remote attackers to Injecting a malicious SQL statement via the na

Sql injection vulnerability in koa2-blog 1.0.0 allows remote attackers to Injecting a malicious SQL statement via the na

SQL injection vulnerability in the model.increment and model.decrement function in ThinkJS 3.2.10 allows remote attacker

An issue was found in CMSWing project version 1.3.8, Because the rechargeAction function does not check the balance para

An issue was found in CMSWing project version 1.3.8. Because the updateAction function does not check the detail paramet

An issue was found in CMSWing project version 1.3.8. Because the log function does not check the log parameter, maliciou

Directory traversal vulnerability in the yccms 3.3 project. The delete, deletesite, and deleteAll functions' improper ju

Sql injection vulnerability in the yccms 3.3 project. The no_top function's improper judgment of the request parameters,

Unrestricted file upload vulnerability in the yccms 3.3 project. The xhUp function's improper judgment of the request pa

HashiCorp Nomad and Nomad Enterprise up to 0.12.9 exec and java task drivers can access processes associated with other

HashiCorp Vault Enterprise 1.6.0 & 1.6.1 allowed the `remove-peer` raft operator command to be executed against DR secon

HashiCorp Vault and Vault Enterprise disclosed the internal IP address of the Vault node when responding to some invalid

AVideo Platform is an open-source Audio and Video platform. It is similar to a self-hosted YouTube. In AVideo Platform b

All versions of package kill-process-on-port are vulnerable to Command Injection via a.getProcessPortId.

HashiCorp Vault and Vault Enterprise allowed for enumeration of Secrets Engine mount paths via unauthenticated HTTP requ

A cross-site scripting vulnerability exists in the template functionality of phpGACL 3.3.7. A specially crafted HTTP req

A cross-site scripting vulnerability exists in the template functionality of phpGACL 3.3.7. A specially crafted HTTP req

A cross-site scripting vulnerability exists in the template functionality of phpGACL 3.3.7. A specially crafted HTTP req

All versions of package launchpad are vulnerable to Command Injection via stop.

angular-expressions is "angular's nicest part extracted as a standalone module for the browser and node". In angular-exp

Polr is an open source URL shortener. in Polr before version 2.3.0, a vulnerability in the setup process allows attacker

openHAB is a vendor and technology agnostic open source automation software for your home. In openHAB before versions 2.

A CSRF vulnerability was discovered in EasyCMS v1.6 that can add an admin account through index.php?s=/admin/rbacuser/in

ASUS RT-AX86U router firmware below version under 9.0.0.4_386 has a buffer overflow in the blocking_request.cgi function

Variable underflow exists in accel-ppp radius/packet.c when receiving a RADIUS vendor-specific attribute with length fie

deleteaccount.php in the Delete Account plugin 1.4 for MyBB allows XSS via the deletereason parameter.

GNOME Evolution through 3.38.3 produces a "Valid signature" message for an unknown identifier on a previously trusted ke

nbd_add_socket in drivers/block/nbd.c in the Linux kernel through 5.10.12 has an ndb_queue_rq use-after-free that could

Monal before 4.9 does not implement proper sender verification on MAM and Message Carbon (XEP-0280) results. This allows

An issue was discovered on Mofi Network MOFI4500-4GXeLTE 4.1.5-std devices. The authentication function passes untrusted

An issue was discovered on Mofi Network MOFI4500-4GXeLTE 4.1.5-std devices. The authentication function contains undocum

An issue was discovered on Mofi Network MOFI4500-4GXeLTE 4.1.5-std devices. The wireless network password is exposed in