2022

A Denial-of-Service (DoS) vulnerability was discovered in F-Secure Linux Security whereby the Fmlib component used in ce

Weak Password Recovery Mechanism for Forgotten Password in GitHub repository microweber/microweber prior to 1.3.

Cross-site Scripting (XSS) - DOM in GitHub repository hakimel/reveal.js prior to 4.3.0.

A command injection vulnerability in the web interface of the Zyxel NWA-1100-NH firmware could allow an attacker to exec

A cleartext storage of information vulnerability in the Zyxel VMG3625-T50B firmware version V5.50(ABTL.0)b2k could allow

Trusted Firmware M 1.4.x through 1.4.1 has a buffer overflow issue in the Firmware Update partition. In the IPC model, a

A cross-site scripting (XSS) vulnerability in Htmly v2.8.1 allows attackers to excute arbitrary web scripts HTML via a c

A cross-site scripting (XSS) vulnerability in Pluxml v5.8.7 allows attackers to execute arbitrary web scripts or HTML vi

Pluxml v5.8.7 was discovered to allow attackers to execute arbitrary code via crafted PHP code inserted into static page

An issue was discovered in Zoho ManageEngine Key Manager Plus 6.1.6. A user, with the level Operator, can see all SSH se

ROG Live Service’s function for deleting temp files created by installation has an improper link resolution before file

An out-of-bounds read vulnerability exists in the GCode::extrude() functionality of Slic3r libslic3r 1.3.0 and Master Co

A memory leakage flaw exists in the class PerimeterGenerator of Slic3r libslic3r 1.3.0 and Master Commit b1a5500. Specia

A Remote Code Execution (RCE) vulnerability exists in Algorithmia MSOL all versions before October 10 2021 of SaaS. User

A directory traversal vulnerability in the apoc plugins in Neo4J Graph database before 4.4.0.1 allows attackers to read

Hicos citizen certificate client-side component does not filter special characters for command parameters in specific we

Cipi 3.1.15 allows Add Server stored XSS via the /api/servers name field.

Maxsite CMS v108 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the parameter f_tags at

Maxsite CMS v180 was discovered to contain multiple arbitrary file deletion vulnerabilities in /admin_page/all-files-upd

A Remote Code Execution (RCE) vulnerability at /admin/options in Maxsite CMS v180 allows attackers to execute arbitrary

Maxsite CMS v180 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the parameter f_file_de

Hospital Management System v1.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the dema

Hospital Management System v1.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the dpas

Hospital Management System v1.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Doct

Home Owners Collection Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via t

CMS Made Simple v2.2.15 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the parameter

CMS Made Simple v2.2.15 was discovered to contain a Remote Command Execution (RCE) vulnerability via the upload avatar f

Cross-site Scripting (XSS) - Stored in GitHub repository getgrav/grav prior to 1.7.31.

A Remote Code Execution (RCE) vulnerability exists in DataRobot through 2021-10-28 because it allows submission of a Doc

Rundeck is an open source automation service with a web console, command line tools and a WebAPI. In versions prior to 3

Rundeck is an open source automation service with a web console, command line tools and a WebAPI. Prior to versions 3.4.

qrcp through 0.8.4, in receive mode, allows ../ Directory Traversal via the file name specified by the uploader.

Dropbox Lepton v1.2.1-185-g2a08b77 was discovered to contain a heap-buffer-overflow in the function aligned_dealloc():sr

Audio File commit 004065d was discovered to contain a heap-buffer overflow in the function fouBytesToInt():AudioFile.h.

A stored cross-site scripting (XSS) vulnerability in Ice Hrm 30.0.0.OS allows attackers to steal cookies via a crafted p

Ice Hrm 30.0.0.OS was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the "m" parameter i

Ice Hrm 30.0.0.OS was discovered to contain multiple reflected cross-site scripting (XSS) vulnerabilities via the "key"

A buffer overflow in Mikrotik RouterOS 6.47 allows unauthenticated attackers to cause a denial of service (DOS) via craf

A buffer overflow in Mikrotik RouterOS 6.47 allows unauthenticated attackers to cause a denial of service (DOS) via craf

David Brackeen ok-file-formats 203defd is vulnerable to Buffer Overflow via function ok_png_transform_scanline() in "/ok

ARM astcenc 3.2.0 is vulnerable to Buffer Overflow in function encode_ise().

An issue was discovered in the web application in Cherwell Service Management (CSM) 10.2.3. It accepts and reflects arbi

An issue was discovered in the web application in Cherwell Service Management (CSM) 10.2.3. The ASP.NET_Sessionid cookie

An issue was discovered in the web application in Cherwell Service Management (CSM) 10.2.3. Injection of a malicious pay

An issue was discovered in the web application in Cherwell Service Management (CSM) 10.2.3. XSS can occur via a payload

CodeIgniter4 is the 4.x branch of CodeIgniter, a PHP full-stack web framework. A vulnerability in versions prior to 4.1.

CodeIgniter4 is the 4.x branch of CodeIgniter, a PHP full-stack web framework. Prior to version 4.1.9, an improper input

David Brackeen ok-file-formats dev version is vulnerable to Buffer Overflow. When the function of the ok-file-formats pr

David Brackeen ok-file-formats 203defd is vulnerable to Buffer Overflow. When the function of the ok-file-formats projec

Obyte (formerly Byteball) Wallet before 3.4.1 allows XSS. A crafted chat message can lead to remote code execution.