2021

MyBB before 1.8.28 allows stored XSS because the displayed Template Name value in the Admin CP's theme management is not

Privilege escalation vulnerability in the Windows trial installer of McAfee Total Protection (MTP) prior to 16.0.34_x ma

A cross site scripting (XSS) vulnerability in the Insert Video function of Froala WYSIWYG Editor 3.1.0 allows attackers

HHVM supports the use of an "admin" server which accepts administrative requests over HTTP. One of those request handler

The Web Reporting component of TIBCO Software Inc.'s TIBCO Nimbus contains easily exploitable Stored Cross Site Scriptin

Shopware is open source e-commerce software. Versions prior to 5.7.6 contain a cross-site scripting vulnerability. This

Mycodo is an environmental monitoring and regulation system. An exploit in versions prior to 8.12.7 allows anyone with a

jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the `of` option

jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of various `*Text`

jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the `altField`

Pi-hole's Web interface (based on AdminLTE) provides a central location to manage one's Pi-hole and review the statistic

Go Ethereum is the official Golang implementation of the Ethereum protocol. Prior to version 1.10.9, a vulnerable node i

AS_Redis is an AntSword plugin for Redis. The Redis Manage plugin for AntSword prior to version 0.5 is vulnerable to Sel

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to

OpenClinic GA 5.194.18 is affected by Insecure Permissions. By default the Authenticated Users group has the modify perm

An Insecure Permissions issue exists in Gestionale Open 11.00.00. A low privilege account is able to rename the mysqld.e

Nameko through 2.13.0 can be tricked into performing arbitrary code execution when deserializing the config file.

Online Student Admission System 1.0 is affected by an insecure file upload vulnerability. A low privileged user can uplo

Online Student Admission System 1.0 is affected by an unauthenticated SQL injection bypass vulnerability in /admin/login

A vulnerability was found in Mangboard(WordPress plugin). A SQL-Injection vulnerability was found in order_type paramete

An Improper input validation in execDefaultBrowser method of NEXACRO17 allows a remote attacker to execute arbitrary com

caml-light <= 0.75 uses mktemp() insecurely, and also does unsafe things in /tmp during make install.

A flaw was found in WebSVN 2.3.2. Without prior authentication, if the 'allowDownload' option is enabled in config.php,

Penguin Aurora TV Box 41502 is a high-end network HD set-top box produced by Tencent Video and Skyworth Digital. An unau

An issue was discovered in the Dask distributed package before 2021.10.0 for Python. Single machine Dask clusters starte

An issue was discovered in Nagios XI 5.8.5. In the Manage Dashlets section of the Admin panel, an administrator can uplo

An issue was discovered in Nagios XI 5.8.5. In the Custom Includes section of the Admin panel, an administrator can uplo

An issue was discovered in Nagios XI 5.8.5. Insecure file permissions on the nagios_unbundler.py file allow the nagios u

Cross-site scripting vulnerability in Movable Type Movable Type Premium 1.37 and earlier and Movable Type Premium Advanc

A crafted request may cause a read access to an uninitialized pointer in CODESYS V2 Runtime Toolkit 32 Bit full and PLCW

A crafted request with invalid offsets may cause an out-of-bounds read or write access in CODESYS V2 Runtime Toolkit 32

In CODESYS V2 Runtime Toolkit 32 Bit full and PLCWinNT prior to versions V2.4.7.56 unauthenticated crafted invalid reque

In the CODESYS V2 web server prior to V1.1.9.22 crafted web server requests may cause a Null pointer dereference in the

In the CODESYS V2 web server prior to V1.1.9.22 crafted web server requests can trigger a parser error. Since the parser

Crafted web server requests can be utilised to read partial stack or heap memory or may trigger a denial-of- service con

Crafted web server requests may cause a heap-based buffer overflow and could therefore trigger a denial-of- service cond

Movable Type 7 r.5002 and earlier (Movable Type 7 Series), Movable Type 6.8.2 and earlier (Movable Type 6 Series), Movab

Affected versions of Atlassian Jira Server and Data Center allow authenticated yet non-administrator remote attackers to

Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to view the names of p

Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to view private project and

Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to view the names of private

Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to inject arbitrary HTML or

Nextcloud is an open-source, self-hosted productivity platform. Prior to Nextcloud Server versions 20.0.13, 21.0.5, and

Nextcloud is an open-source, self-hosted productivity platform. Prior to versions 20.0.13, 21.0.5, and 22.2.0, a file tr

Nextcloud is an open-source, self-hosted productivity platform. Prior to versions 20.0.13, 21.0.5, and 22.2.0, Nextcloud

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to

Nextcloud is an open-source, self-hosted productivity platform. A missing permission check in Nextcloud Deck before 1.2.

Nextcloud is an open-source, self-hosted productivity platform. The Nextcloud OfficeOnline application prior to version