2022

An unprivileged write to the file handler flaw in the Linux kernel's control groups and namespaces subsystem was found i

An out-of-bounds read flaw was found in libsndfile's FLAC codec functionality. An attacker who is able to submit a speci

A use-after-free vulnerability was found in the virtio-net device of QEMU. It could occur when the descriptor's address

ALPACA is an application layer protocol content confusion attack, exploiting TLS servers implementing different protocol

An authorization flaw was found in Foreman Ansible. An authenticated attacker with certain permissions to create and run

Rockwell Automation Connected Components Workbench v12.00.00 and prior does not limit the objects that can be deserializ

The parsing mechanism that processes certain file types does not provide input sanitization for file paths. This may all

GE UR bootloader binary Version 7.00, 7.01 and 7.02 included unused hardcoded credentials. Additionally, a user with phy

GE UR firmware versions prior to version 8.1x web server interface is supported on UR over HTTP protocol. It allows sens

Tenda AC10-1200 v15.03.06.23_EN was discovered to contain a buffer overflow in the setSmartPowerManagement function.

Tenda AC10-1200 v15.03.06.23_EN was discovered to contain a buffer overflow via the list parameter in the fromSetIpMacBi

IrfanView 4.59 is vulnerable to buffer overflow via the function at address 0x413c70 (in 32bit version of the binary). T

Sentinel 1.8.2 is vulnerable to Server-side request forgery (SSRF).

An issue was discovered in xiaohuanxiong CMS 5.0.17. There is a CSRF vulnerability that can that can add the administrat

Improper Authentication vulnerability in TLS origin validation of Apache Traffic Server allows an attacker to create a m

Improper Input Validation vulnerability in request line parsing of Apache Traffic Server allows an attacker to send inva

Versions affected: BIND 9.18.0 When a vulnerable version of named receives a series of specific queries, the named proce

ASUS AC68U <=3.0.0.4.385.20852 is affected by a buffer overflow in blocking.cgi, which may cause a denial of service (Do

Unrestricted Upload of File with Dangerous Type in GitHub repository crater-invoice/crater prior to 6.0.6.

A heap buffer overflow flaw was found in IPsec ESP transformation code in net/ipv4/esp4.c and net/ipv6/esp6.c. This flaw

Use After Free in op_is_set_bp in GitHub repository radareorg/radare2 prior to 5.6.6.

CycloneDX BOM Repository Server is a bill of materials (BOM) repository server for distributing CycloneDX BOMs. CycloneD

PJSIP is a free and open source multimedia communication library written in C. Versions 2.12 and prior contain a stack b

Able to create an account with long password leads to memory corruption / Integer Overflow in GitHub repository microweb

When the vulnerability is triggered the BIND process will exit. BIND 9.18.0

GlobalProtect-openconnect versions prior to 2.0.0 (exclusive) are affected by incorrect access control in GPService thro

There is a Unrestricted Upload of File vulnerability in ShowDoc v2.10.3 in GitHub repository star7th/showdoc prior to 2.

A post-auth SQL injection vulnerability in the Mail Manager potentially allows an authenticated attacker to execute code

Bento4 1.6.0-639 has a heap-based buffer over-read in the AP4_HvccAtom class, a different issue than CVE-2018-14531.

idcCMS v1.10 was discovered to contain an issue which allows attackers to arbitrarily delete the install.lock file, resu

PNPM v6.15.1 and below was discovered to contain an untrusted search path which causes the application to behave in unex

A Cross-Site Request Forgery (CSRF) in Chamilo LMS 1.11.14 allows attackers to execute arbitrary commands on victim host

An issue in BigAnt Software BigAnt Server v5.6.06 can lead to a Denial of Service (DoS).

BigAnt Software BigAnt Server v5.6.06 was discovered to contain a Cross-Site Request Forgery (CSRF).

BigAnt Software BigAnt Server v5.6.06 was discovered to be vulnerable to directory traversal attacks.

BigAnt Software BigAnt Server v5.6.06 was discovered to contain incorrect access control issues.

BigAnt Software BigAnt Server v5.6.06 was discovered to contain incorrect access control.

guzzlehttp/psr7 is a PSR-7 HTTP message library. Versions prior to 1.8.4 and 2.1.1 are vulnerable to improper header par

The Amelia WordPress plugin before 1.0.47 stores image blobs into actual files whose extension is controlled by the user

The miniOrange's Google Authenticator WordPress plugin before 5.5 does not have proper authorisation and CSRF checks whe

The Advanced Contact form 7 DB WordPress plugin before 1.8.7 does not have authorisation nor CSRF checks in the acf7_db_

The package ungit before 1.5.20 are vulnerable to Remote Code Execution (RCE) via argument injection. The issue occurs w

The snaptPowered2 component of Snapt Aria v12.8 was discovered to contain a command injection vulnerability. This vulner

A Cross-Site Request Forgery (CSRF) in the management portal of Snapt Aria v12.8 allows attackers to escalate privileges

The IBM Spectrum Protect 8.1.14.000 server could allow a remote attacker to bypass security restrictions, caused by impr

In Dreamacro Clash for Windows v0.11.4, an attacker could embed a malicious iframe in a website with a crafted URL that

Remote Command Execution in uploading repository file in GitHub repository gogs/gogs prior to 0.12.6.

ThinkPHP Framework v5.0.24 was discovered to be configured without the PATHINFO parameter. This allows attackers to acce

The wechat_return function in /controller/Index.php of EyouCms V1.5.4-UTF8-SP3 passes the user's input directly into the

The PluginsUpload function in application/service/PluginsAdminService.php of ShopXO v1.9.0 contains an arbitrary file up