2021

IBM Cognos Analytics 11.1.7 and 11.2.0 does not require that users should have strong passwords by default, which makes

The Kentico Xperience CMS version 13.0 – 13.0.43 is vulnerable to a persistent Cross-Site Scripting (XSS) vulnerability

elgg is vulnerable to Exposure of Private Personal Information to an Unauthorized Actor

matyhtf framework v3.0.5 is affected by a path manipulation vulnerability in Smarty.class.php.

Librenms 21.11.0 is affected by a path manipulation vulnerability in includes/html/pages/device/showconfig.inc.php.

ThinkUp 2.0-beta.10 is affected by a path manipulation vulnerability in Smarty.class.php. NOTE: This vulnerability only

dzzoffice 2.02.1_SC_UTF8 is affected by a Cross Site Scripting (XSS) vulnerability in explorerfile.php. The output of th

showdoc is vulnerable to URL Redirection to Untrusted Site

A reachable assertion vulnerability in Trend Micro Apex One could allow an attacker to crash the program on affected ins

An unnecessary privilege vulnerability in Trend Micro Worry-Free Business Security 10.0 SP1 could allow a local attacker

An unnecessary privilege vulnerability in Trend Micro Worry-Free Business Security 10.0 SP1 could allow a local attacker

An unnecessary privilege vulnerability in Trend Micro Worry-Free Business Security 10.0 SP1 could allow a local attacker

Trend Micro Security 2021 v17.0 (Consumer) contains a vulnerability that allows files inside the protected folder to be

Taocms v2.5Beta5 was discovered to contain a cross-site scripting (XSS) vulnerability via the component Management colum

Taocms v2.5Beta5 was discovered to contain a blind SQL injection vulnerability via the function Edit Article.

Taocms v2.5Beta5 was discovered to contain a blind SQL injection vulnerability via the function Article Search.

Z-BlogPHP v1.6.1.2100 was discovered to contain an arbitrary file deletion vulnerability via \app_del.php.

An arbitrary file upload vulnerability in Z-BlogPHP v1.6.1.2100 allows attackers to execute arbitrary code via a crafted

LibreDWG v0.12.3 was discovered to contain a heap-buffer overflow via decode_preR13.

LibreDWG v0.12.3 was discovered to contain a NULL pointer dereference via out_dxfb.c.

AOM v2.0.1 was discovered to contain a NULL pointer dereference via the component rate_hist.c.

AOM v2.0.1 was discovered to contain a segmentation violation via the component aom_dsp/x86/obmc_sad_avx2.c.

AOM v2.0.1 was discovered to contain a global buffer overflow via the component av1/encoder/partition_search.h.

AOM v2.0.1 was discovered to contain a stack buffer overflow via the component stats/rate_hist.c.

AOM v2.0.1 was discovered to contain a NULL pointer dereference via the component av1/av1_dx_iface.c.

AOM v2.0.1 was discovered to contain a stack buffer overflow via the component src/aom_image.c.

An issue was discovered on Renesas RX65 and RX65N devices. With a VCC glitch, an attacker can extract the security ID ke

CA Network Flow Analysis (NFA) 21.2.1 and earlier contain a SQL injection vulnerability in the NFA web application, due

Missing Handler vulnerability in the proprietary management protocol (port TCP 5558) of Hitachi Energy FOX61x, XCM20 all

Weak Password Requirements vulnerability in Hitachi Energy FOX61x, XCM20 allows an attacker to gain unauthorized access

Armeria is an open source microservice framework. In affected versions an attacker can access an Armeria server's local

The ClickBank Affiliate Ads WordPress plugin through 1.20 does not escape its settings, allowing high privilege users to

The ClickBank Affiliate Ads WordPress plugin through 1.20 does not have CSRF check when saving its settings, allowing at

An issue was discovered in the eGeeTouch 3rd Generation Travel Padlock application for Android. The lock sends a pairing

bookstack is vulnerable to Cross-Site Request Forgery (CSRF)

Installations, where crafter-search is not protected, allow unauthenticated remote attackers to create, view, and delete

Unauthenticated remote attackers can read textual content via FreeMarker including files /scripts/*, /templates/* and so

Authenticated administrators may modify the main YAML configuration file and load a Java class resulting in RCE.

Authenticated administrators may override the system configuration file and cause a denial of service.

Authenticated users with Site roles may inject XSS scripts via file names that will execute in the browser for this and

Authenticated users with Administrator or Developer roles may execute OS commands by Groovy Script which uses Groovy lib

Authenticated users with Administrator or Developer roles may execute OS commands by SPEL Expression in Spring beans. SP

ecshop v2.7.3 is affected by a SQL injection vulnerability in shopex\ecshop\upload\api\client\api.php.

thinkphp-bjyblog (last update Jun 4 2021) is affected by a Cross Site Scripting (XSS) vulnerability in AdminBaseControll

nZEDb v0.4.20 is affected by a Cross Site Scripting (XSS) vulnerability in www/pages/api.php. The exit function will ter

pictshare v1.5 is affected by a Cross Site Scripting (XSS) vulnerability in api/info.php. The exit function will termina

SakuraPanel v1.0.1.1 is affected by a Cross Site Scripting (XSS) vulnerability in /master/core/PostHandler.php. The exit

Buffer overflow vulnerability in function SetFirewall in index.cgi in CIRCUTOR COMPACT DC-S BASIC smart metering concent

Mahavitaran android application 7.50 and prior transmit sensitive information in URL parameters. This may lead to inform

In GNU Mailman before 2.1.38, a list member or moderator can get a CSRF token and craft an admin request (using that tok