Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullNamespace is true (either by user or a plugin like…

When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g

SnapCenter versions 3.x and 4.x prior to 4.9 are susceptible to a vulnerability which may allow an authenticated unprivileged user to gain access as an admin user

In Eclipse Jetty versions 9.4.0 through 9.4.8, when using the optional Jetty provided FileSessionDataStore for persistent storage of HttpSession details, it is possible for a…

Spring Framework version 5.0.5 when used in combination with any versions of Spring Security contains an authorization bypass when using method security

Due to the formatting logic of the "console.table()" function it was not safe to allow user controlled input to be passed to the "properties" parameter while simultaneously…

A use of incorrectly resolved name vulnerability fixed in 7.83.1 might remove the wrong file when `--no-clobber` is used together with `--remove-on-error`

curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being used when a TLS 1.3 session ticket arrives over a connection

napi_get_value_string_*() allows various kinds of memory corruption in node < 10.21.0, 12.18.0, and < 14.4.0

Vulnerability in the MySQL Connectors component of Oracle MySQL (subcomponent: Connector/Python)

SnapCenter versions 4.8 through 4.9 are susceptible to a vulnerability which may allow an authenticated SnapCenter Server user to become an admin user on a remote system where a…

In Python 3.6 through 3.6.10, 3.7 through 3.7.8, 3.8 through 3.8.4rc1, and 3.9 through 3.9.0b4 on Windows, a Trojan horse python3.dll might be used in cases where CPython is…

A non-privileged user or program can put code and a config file in a known non-privileged path (under C:/usr/local/) that will make curl <= 7.65.1 automatically run the code (as…

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Parser)

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Replication)

In Python (aka CPython) up to 3.10.8, the mailcap module does not add escape characters into commands discovered in the system mailcap file

A vulnerability exists in curl <7.87.0 HSTS check that could be bypassed to trick it to keep using HTTP

SnapCenter versions prior to 4.7 shipped without Content Security Policy (CSP) implemented which could allow certain types of attacks that otherwise would be prevented

In Eclipse Jetty HTTP/2 server implementation, when encountering an invalid HTTP/2 request, the error handling has a bug that can wind up not properly cleaning up the active…

Internally libssl in OpenSSL calls X509_verify_cert() on the client side to verify a certificate supplied by a server

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Windows)

A user can tell curl >= 7.20.0 and <= 7.78.0 to require a successful upgrade to TLS when speaking to an IMAP, POP3 or FTP server (`--ssl-reqd` on the command line…

libcurl-using applications can ask for a specific client certificate to be used in a transfer

ec_verify in kdc/kdc_preauth_ec.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.18.4 and 1.19.x before 1.19.2 allows remote attackers to cause a NULL…

In Eclipse Jetty 7.2.2 to 9.4.38, 10.0.0.alpha0 to 10.0.1, and 11.0.0.alpha0 to 11.0.1, CPU usage can reach 100% upon receiving a large invalid TLS frame

The Data::Validate::IP module through 0.29 for Perl does not properly consider extraneous zero characters at the beginning of an IP address string, which (in some situations)…

Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to DNS rebinding attacks as the whitelist includes “localhost6”

The jQuery Validation Plugin provides drop-in validation for your existing forms

MIT Kerberos 5 (aka krb5) before 1.17.2 and 1.18.x before 1.18.3 allows unbounded recursion via an ASN.1-encoded Kerberos message because the lib/krb5/asn.1/asn1_encode.c support…

Segmentation fault in SSL_check_chain

RFD Attack via "Content-Disposition" Header Sourced from Request Input by Spring MVC or Spring WebFlux Application

dom4j version prior to version 2.1.1 contains a CWE-91: XML Injection vulnerability in Class: Element

Out-of-bounds Write vulnerability in Apache Commons Configuration.This issue affects Apache Commons Configuration: from 2.0 before 2.10.1

The c_rehash script allows command injection

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Parser)

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML)

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges)

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges)

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges)

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer)

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Replication)

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: InnoDB)

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server : Partition)

In Eclipse Jetty versions 1.0 thru 9.4.32.v20200930, 10.0.0.alpha1 thru 10.0.0.beta2, and 11.0.0.alpha1 thru 11.0.0.beta2O, on Unix like systems, the system's temporary directory…