2022

Planet eStream before 6.72.10.07 discloses sensitive information, related to the ON cookie (findable in HTML source code

GetFile.aspx in Planet eStream before 6.72.10.07 allows ..\ directory traversal to read arbitrary local files.

Planet eStream before 6.72.10.07 allows a low-privileged user to gain access to administrative and high-privileged user

Slixmpp before 1.8.3 lacks SSL Certificate hostname validation in XMLStream, allowing an attacker to pose as any server

Heimdal before 7.7.1 allows remote attackers to execute arbitrary code because of an invalid free in the ASN.1 codec use

Snipe-IT through 6.0.14 allows attackers to check whether a user account exists because of response variations in a /pas

Snipe-IT before 6.0.14 is vulnerable to Cross Site Scripting (XSS) for View Assigned Assets.

An issue was discovered in Simmeth Lieferantenmanager before 5.6. Due to errors in session management, an attacker can l

An issue was discovered in Simmeth Lieferantenmanager before 5.6. An attacker can download arbitrary files from the web

An issue was discovered in Simmeth Lieferantenmanager before 5.6. An attacker can inject raw SQL queries. By activating

An issue was discovered in Simmeth Lieferantenmanager before 5.6. In the design of the API, a user is inherently able to

An issue was discovered in Simmeth Lieferantenmanager before 5.6. An attacker can make various API calls without authent

An issue was discovered in /DS/LM_API/api/SelectionService/InsertQueryWithActiveRelationsReturnId in Simmeth Lieferanten

Certain ZKTeco products (ZEM500-510-560-760, ZEM600-800, ZEM720, ZMM) allow access to sensitive information via direct r

In Planet eStream before 6.72.10.07, multiple Stored Cross-Site Scripting (XSS) vulnerabilities exist: Disclaimer, Searc

Planet eStream before 6.72.10.07 allows attackers to call restricted functions, and perform unauthenticated uploads (Upl

In Planet eStream before 6.72.10.07, a Reflected Cross-Site Scripting (XSS) vulnerability exists via any metadata filter

Planet eStream before 6.72.10.07 allows a remote attacker (who is a publisher or admin) to obtain access to all records

The Nintendo NetworkBuffer class, as used in Animal Crossing: New Horizons before 2.0.6 and other products, allows remot

Brave Browser before 1.43.88 allowed a remote attacker to cause a denial of service in private and guest windows via a c

Brave Browser before 1.42.51 allowed a remote attacker to cause a denial of service via a crafted HTML file that referen

Brave Browser before 1.43.34 allowed a remote attacker to cause a denial of service via a crafted HTML file that mention

JSON5 is an extension to the popular JSON file format that aims to be easier to write and maintain by hand (e.g. for con

A link following vulnerability in the Damage Cleanup Engine component of Trend Micro Apex One and Trend Micro Apex One a

IBM Navigator for i 7.3, 7.4, and 7.5 could allow an authenticated user to obtain sensitive information they are authori

BigFix deployments that have installed the Notification Service on Windows are susceptible to disclosing SMTP BigFix ope

IBM Security Verify Governance, Identity Manager 10.01 could allow a remote attacker to obtain sensitive information whe

An image signature validation bypass vulnerability in Kyverno 1.8.3 and 1.8.4 allows a malicious image registry (or a ma

Typora through 1.3.8 allows XSS if a document containing an SVG element with an attacker-controlled onload attribute is

An issue was discovered in the Linux kernel 5.10.x before 5.10.155. A use-after-free in io_sqpoll_wait_sq in fs/io_uring

The hash functionality in userver before 42059b6319661583b3080cab9b595d4f8ac48128 allows attackers to cause a denial of

Out-of-bounds read was discovered in YDB server. An attacker could construct a query with insert statement that would al

ThinkPHP Framework before 6.0.14 allows local file inclusion via the lang parameter when the language pack feature is en

AVEVA InTouch Access Anywhere versions 2020 R2 and older are vulnerable to a path traversal exploit that could allow an

Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.0.

IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1could allow a non-privileged local user to exploit a vulnerability in the AIX pfcdd k

IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the AIX perfst

IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the rm_rlcache

IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1could allow a non-privileged local user to exploit a vulnerability in the AIX kernel

D-Link DIR-882 DIR882A1_FW130B06, DIR-878 DIR_878_FW1.30B08 was discovered to contain a stack overflow via the Password

D-Link DIR-882 DIR882A1_FW130B06, DIR-878 DIR_878_FW1.30B08 was discovered to contain a stack overflow via the Key param

D-Link DIR-882 DIR882A1_FW130B06, DIR-878 DIR_878_FW1.30B08 was discovered to contain a stack overflow via the AccountPa

D-Link DIR-882 DIR882A1_FW130B06, DIR-878 DIR_878_FW1.30B08 was discovered to contain a stack overflow via the Password

D-Link DIR-882 DIR882A1_FW130B06, DIR-878 DIR_878_FW1.30B08 was discovered to contain a stack overflow via the Password

D-Link DIR-882 DIR882A1_FW130B06, DIR-878 DIR_878_FW1.30B08 was discovered to contain a stack overflow via the PSK param

D-Link DIR-882 DIR882A1_FW130B06, DIR-878 DIR_878_FW1.30B08 was discovered to contain a stack overflow via the Password

D-Link DIR-882 DIR882A1_FW130B06, DIR-878 DIR_878_FW1.30B08 was discovered to contain a stack overflow via the Password

IP-COM M50 V15.11.0.33(10768) was discovered to contain a buffer overflow via the picName parameter in the formDelWewifi

IP-COM M50 V15.11.0.33(10768) was discovered to contain multiple buffer overflows via the ip, mac, and remark parameters

IP-COM M50 V15.11.0.33(10768) was discovered to contain a buffer overflow via the gotoUrl parameter in the formPortalAut