2020

The SolarWinds Orion API is vulnerable to an authentication bypass that could allow a remote attacker to execute API com

An XSS issue was discovered in Roundcube Webmail before 1.2.13, 1.3.x before 1.3.16, and 1.4.x before 1.4.10. The attack

Firmware version 4.60 of Zyxel USG devices contains an undocumented account (zyfwp) with an unchangeable password. The p

An SQL injection vulnerability in the WebAdmin of Cyberoam OS through 2020-12-04 allows unauthenticated attackers to exe

Forced OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution. Affected

Microsoft Exchange Remote Code Execution Vulnerability

A memory initialization issue was addressed. This issue is fixed in macOS Big Sur 11.0.1, watchOS 7.1, iOS 12.4.9, watch

A type confusion issue was addressed with improved state handling. This issue is fixed in macOS Big Sur 11.0.1, watchOS

A memory corruption issue was addressed with improved input validation. This issue is fixed in macOS Big Sur 11.0.1, wat

VMware Workspace One Access, Access Connector, Identity Manager, and Identity Manager Connector address have a command i

Drupal core does not properly sanitize certain filenames on uploaded files, which can lead to files being interpreted as

Archive_Tar through 1.4.10 has :// filename sanitization only to address phar attacks, and thus any other stream-wrapper

Windows Kernel Local Elevation of Privilege Vulnerability

The previous default setting for Airflow's Experimental API was to allow all API requests without authentication, but th

An issue was discovered in SaltStack Salt through 3002. Sending crafted web requests to the Salt API, with the SSH clien

Heap buffer overflow in UI in Google Chrome on Android prior to 86.0.4240.185 allowed a remote attacker who had compromi

Inappropriate implementation in V8 in Google Chrome prior to 86.0.4240.183 allowed a remote attacker to potentially expl

Heap buffer overflow in Freetype in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploi

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions

If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. QNAP has al

If exploited, this command injection vulnerability could allow remote attackers to run arbitrary commands. QNAP has alre

If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. QNAP has al

A vulnerability in the Pulse Connect Secure < 9.1R9 admin web interface could allow an authenticated attacker to perform

Multiple vulnerabilities in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Fir

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions

Vulnerability in the Oracle Solaris product of Oracle Systems (component: Pluggable authentication module). Supported ve

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Ins

OpenSLP as used in VMware ESXi (7.0 before ESXi_7.0.1-0.0.16850804, 6.7 before ESXi670-202010401-SG, 6.5 before ESXi650-

An issue existed in the handling of environment variables. This issue was addressed with improved validation. This issue

A memory corruption issue was addressed by removing the vulnerable code. This issue is fixed in iOS 13.6 and iPadOS 13.6

A buffer overflow vulnerability in SonicOS allows a remote attacker to cause Denial of Service (DoS) and potentially exe

NETGEAR JGS516PE devices before 2.6.0.43 are affected by lack of access control at the function level.

A vulnerability in the Pulse Connect Secure < 9.1R8.2 admin web interface could allow an authenticated attacker to uploa

A remote code execution vulnerability exists in the WebAdmin of Sophos SG UTM before v9.705 MR5, v9.607 MR7, and v9.511

Multiple vulnerabilities in the Distance Vector Multicast Routing Protocol (DVMRP) feature of Cisco IOS XR Software coul

<p>A remote code execution vulnerability exists in the way that Microsoft browsers access objects in memory. The vulnera

The File Manager (wp-file-manager) plugin before 6.9 for WordPress allows remote attackers to upload and execute arbitra

An issue was discovered on D-Link DCS-2530L before 1.06.01 Hotfix and DCS-2670L through 2.02 devices. cgi-bin/ddns_enc.c

An issue was discovered on D-Link DCS-2530L before 1.06.01 Hotfix and DCS-2670L through 2.02 devices. The unauthenticate

A vulnerability in Trend Micro Apex One and Worry-Free Business Security 10.0 SP1 on Microsoft Windows may allow an atta

TP-Link TL-WA855RE V5 20200415-rel37464 devices allow an unauthenticated attacker (on the same network) to submit a TDDP

A vulnerability in the Distance Vector Multicast Routing Protocol (DVMRP) feature of Cisco IOS XR Software could allow a

Adobe Acrobat and Reader versions 2020.009.20074 and earlier, 2020.001.30002, 2017.011.30171 and earlier, and 2015.006.3

An elevation of privilege vulnerability exists when an attacker establishes a vulnerable Netlogon secure channel connect

A spoofing vulnerability exists when Windows incorrectly validates file signatures. An attacker who successfully exploit

A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet

A vulnerability in the interprocess communication (IPC) channel of Cisco AnyConnect Secure Mobility Client for Windows c

A Default Configuration vulnerability in FortiOS may allow an unauthenticated attacker on the same subnet to intercept s

FUEL CMS 1.4.7 allows SQL Injection via the col parameter to /pages/items, /permissions/items, or /navigation/items.