2020

SourceCodester Alumni Management System 1.0 is affected by cross-site Scripting (XSS) in /admin/gallery.php. After the a

SourceCodester Alumni Management System 1.0 is affected by SQL injection causing arbitrary remote code execution from GE

Marital - Online Matrimonial Project In PHP version 1.0 suffers from an authenticated file upload vulnerability allowing

CRK Business Platform <= 2019.1 allows reflected XSS via erro.aspx on 'CRK', 'IDContratante', 'Erro', or 'Mod' parameter

CRK Business Platform <= 2019.1 allows can inject SQL statements against the DB on any path using the 'strSessao' parame

IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 could allow local atta

An issue was discovered in Programi Bilanc build 007 release 014 31.01.2020 and possibly below. It relies on broken encr

Bitcoin SV before 0.1.1 allows uncontrolled resource consumption when deserializing transactions.

Bitcoin SV before 0.1.1 allows uncontrolled resource consumption when receiving sendheaders messages.

Bitcoin SV before 0.1.1 allows uncontrolled resource consumption when receiving messages with invalid checksums.

Multiple cross-site scripting (XSS) vulnerabilities in Uncanny Owl Tin Canny LearnDash Reporting before 3.4.4 allows aut

URLs using “javascript:” have the protocol removed when pasted into the address bar to protect users from cross-site scr

Multiple cross-site scripting (XSS) vulnerabilities in Uncanny Groups for LearnDash before v3.7 allow authenticated remo

In Solstice Pod before 3.0.3, the firmware can easily be decompiled/disassembled. The decompiled/disassembled files cont

An issue was discovered in URVE Build 24.03.2020. By using the _internal/pc/vpro.php?mac=0&ip=0&operation=0&usr=0&pass=0

An issue was discovered in URVE Build 24.03.2020. Using the _internal/pc/shutdown.php path, it is possible to shutdown t

An issue was discovered in URVE Build 24.03.2020. The password of an integration user account (used for the connection o

An issue was discovered in Programi Bilanc build 007 release 014 31.01.2020 and possibly below. During the installation,

An issue was discovered in Programi Bilanc build 007 release 014 31.01.2020 and below. Its software-update packages are

In Solstice Pod before 3.3.0 (or Open4.3), the Administrator password can be enumerated using brute-force attacks via th

In Solstice Pod before 3.3.0 (or Open4.3), the screen key can be enumerated using brute-force attacks via the /lookin/in

In Solstice Pod before 3.0.3, the web services allow users to connect to them over unencrypted channels via the Browser

Dolibarr 12.0.3 is vulnerable to authenticated Remote Code Execution. An attacker who has the access the admin dashboard

The built-in WEB server for MOXA NPort IAW5000A-I/O firmware version 2.1 or lower has incorrectly implemented protection

The built-in WEB server for MOXA NPort IAW5000A-I/O firmware version 2.1 or lower allows SSH/Telnet sessions, which may

The built-in WEB server for MOXA NPort IAW5000A-I/O firmware version 2.1 or lower has improper privilege management, whi

The built-in WEB server for MOXA NPort IAW5000A-I/O firmware version 2.1 or lower allows sensitive information to be dis

The built-in WEB server for MOXA NPort IAW5000A-I/O firmware version 2.1 or lower stores and transmits the credentials o

The built-in web service for MOXA NPort IAW5000A-I/O firmware version 2.1 or lower does not require users to have strong

SpamTitan before 7.09 allows attackers to tamper with backups, because backups are not encrypted.

Jaws through 1.8.0 allows remote authenticated administrators to execute arbitrary code via crafted use of UploadTheme t

Jaws through 1.8.0 allows remote authenticated administrators to execute arbitrary code via crafted use of admin.php?req

In Malwarebytes Free 4.1.0.56, a symbolic link may be used delete an arbitrary file on the system by exploiting the loca

Firmware version 4.60 of Zyxel USG devices contains an undocumented account (zyfwp) with an unchangeable password. The p

An issue was discovered in Treck IPv6 before 6.0.1.68. Improper Input Validation in the DHCPv6 client component allows a

An issue was discovered in Treck IPv6 before 6.0.1.68. Improper Input Validation in the IPv6 component allows an unauthe

An issue was discovered in Treck IPv6 before 6.0.1.68. Improper input validation in the IPv6 component when handling a p

A heap-based buffer overflow in the Treck HTTP Server component before 6.0.1.68 allows remote attackers to cause a denia

The affected versions of S+ Operations (version 2.1 SP1 and earlier) used an approach for user authentication which reli

In S+ Operations and S+ Historian, the passwords of internal users (not Windows Users) are encrypted but improperly stor

A S+ Operations and S+ Historian service is subject to a DoS by special crafted messages. An attacker might use this fla

An authenticated user might execute malicious code under the user context and take control of the system. S+ Operations

Vulnerabilities in the S+ Operations and S+ Historian web applications can lead to a possible code execution and privile

In Symphony Plus Operations and Symphony Plus Historian, some services can be vulnerable to privilege escalation attacks

In S+ Operations and S+ History, it is possible that an unauthenticated user could inject values to the Operations Histo

In S+ Operations and S+ Historian, not all client commands correctly check user permission as expected. Authenticated bu

In S+ Operations and S+ Historian, a successful SQL injection exploit can read sensitive data from the database, modify

Vulnerability in the Oracle Cloud Infrastructure Identity and Access Management product of Oracle Cloud Services. Easily

HCL Domino v9, v10, v11 is susceptible to an Information Disclosure vulnerability in XPages due to improper error handli

A denial-of-service vulnerability exists in the asynchronous ioctl functionality of Microsoft Azure Sphere 20.05. A sequ