2021

Gerapy is a distributed crawler management framework. Gerapy prior to version 0.9.8 is vulnerable to remote code executi

The use of a hard-coded cryptographic key significantly increases the possibility encrypted data may be recovered from t

The use of a broken or risky cryptographic algorithm is an unnecessary risk that may result in the exposure of sensitive

Patient Information Center iX (PIC iX) Versions C.02 and C.03 receives input or data, but does not validate or incorrect

Hard coded credentials discovered in SolarWinds Web Help Desk product. Through these credentials, the attacker with loca

The standard access path of the IntelliBridge EC 40 and 60 Hub (C.00.04 and prior) requires authentication, but the prod

IntelliBridge EC 40 and 60 Hub (C.00.04 and prior) contains hard-coded credentials, such as a password or a cryptographi

ColorOS pregrant dangerous permissions to apps which are listed in a whitelist xml named default-grant-permissions.But s

ZTE BigVideo analysis product has an input verification vulnerability. Due to the inconsistency between the front and ba

ZTE BigVideo Analysis product has a privilege escalation vulnerability. Due to improper management of the timed task mod

Wiki.js is a wiki app built on Node.js. Wiki.js 2.5.263 and earlier is vulnerable to stored cross-site scripting through

Wiki.js is a wiki app built on node.js. Wiki.js 2.5.263 and earlier is vulnerable to stored cross-site scripting through

PJSIP is a free and open source multimedia communication library. In version 2.11.1 and prior, if incoming RTCP XR messa

IBM OPENBMC OP910 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript c

In Apache APISIX Dashboard before 2.10.1, the Manager API uses two frameworks and introduces framework `droplet` on the

Privilege escalation vulnerability in Avast Antivirus prior to 20.4 allows a local user to gain elevated privileges by "

Multiple privilege escalation vulnerabilities in Avast Antivirus prior to 20.4 allow a local user to gain elevated privi

Privilege escalation vulnerability in the Self-Defense driver of Avast Antivirus prior to 20.8 allows a local user with

Privilege escalation vulnerability in the Sandbox component of Avast Antivirus prior to 20.4 allows a local sandboxed co

Sandbox component in Avast Antivirus prior to 20.4 has an insecure permission which could be abused by local user to con

vim is vulnerable to Use After Free

The Simple JWT Login WordPress plugin before 3.3.0 can be used to create new WordPress user accounts with a randomly gen

The WP Guppy WordPress plugin before 1.3 does not have any authorisation in some of the REST API endpoints, allowing any

The Smart Floating / Sticky Buttons WordPress plugin before 2.5.5 does not sanitise and escape some parameter before out

The WP RSS Aggregator WordPress plugin before 4.19.3 does not sanitise and escape data before outputting it in the Syste

The WPFront User Role Editor WordPress plugin before 3.2.1.11184 does not sanitise and escape the changes-saved paramete

The Gwolle Guestbook WordPress plugin before 4.2.0 does not sanitise and escape the gwolle_gb_user_email parameter befor

The Paid Memberships Pro WordPress plugin before 2.6.6 does not escape the s parameter before outputting it back in an a

The WordPress Download Manager WordPress plugin before 3.2.22 does not sanitise and escape Template data before outputti

The Contact Form & Lead Form Elementor Builder WordPress plugin before 1.6.4 does not sanitise and escape some lead valu

The Typebot | Build beautiful conversational forms WordPress plugin before 1.4.3 does not sanitise and escape the Publis

The Tickera WordPress plugin before 3.4.8.3 does not properly sanitise and escape the Name fields of booked Events befor

The Rich Reviews by Starfish WordPress plugin before 1.9.6 does not properly validate the orderby GET parameter of the p

An issue was discovered in the simple_asn1 crate 0.6.0 before 0.6.1 for Rust. There is a panic if UTCTime data, supplied

An issue was discovered in the tokio crate before 1.8.4, and 1.9.x through 1.13.x before 1.13.1, for Rust. In certain ci

An issue was discovered in the crypto2 crate through 2021-10-08 for Rust. During Chacha20 encryption and decryption, an

An issue was discovered in the abomonation crate through 2021-10-17 for Rust. Because transmute operations are insuffici

An issue was discovered in the nix crate 0.16.0 and later before 0.20.2, 0.21.x before 0.21.2, and 0.22.x before 0.22.2

An issue was discovered in the zeroize_derive crate before 1.1.1 for Rust. Dropped memory is not zeroed out for an enum.

An issue was discovered in the nanorand crate before 0.6.1 for Rust. There can be multiple mutable references to the sam

An issue was discovered in the metrics-util crate before 0.7.0 for Rust. There is a data race and memory corruption beca

An issue was discovered in the tectonic_xdv crate before 0.1.12 for Rust. XdvParser::<T>::process may read from uninitia

An issue was discovered in the tremor-script crate before 0.11.6 for Rust. A merge operation may result in a use-after-f

An issue was discovered in the tremor-script crate before 0.11.6 for Rust. A patch operation may result in a use-after-f

An issue was discovered in the ckb crate before 0.40.0 for Rust. Attackers can cause a denial of service (Nervos CKB blo

An issue was discovered in the ckb crate before 0.40.0 for Rust. Remote attackers may be able to conduct a 51% attack ag

An issue was discovered in the ckb crate before 0.40.0 for Rust. A get_block_template RPC call may fail in situations wh

An issue was discovered in the molecule crate before 0.7.2 for Rust. A FixVec partial read has an incorrect result.

An issue was discovered in the sha2 crate 0.9.7 before 0.9.8 for Rust. Hashes of long messages may be incorrect when the

An issue was discovered in the mopa crate through 2021-06-01 for Rust. It incorrectly relies on Trait memory layout, pos