2020

The Media Library Assistant plugin before 2.82 for Wordpress suffers from multiple XSS vulnerabilities in all Settings/M

load_png in loader.c in libsixel.a in libsixel 1.8.6 has an uninitialized pointer leading to an invalid call to free, wh

eten PSG-6528VM 1.1 devices allow XSS via System Contact or System Location.

Open Upload through 0.4.3 allows XSS via index.php?action=u and the filename field.

An issue was discovered in ProVide (formerly zFTPServer) through 13.1. The Admin Web Interface has Multiple Stored and R

An issue was discovered in ProVide (formerly zFTPServer) through 13.1. The User Web Interface has Multiple Stored and Re

VMware Tanzu Application Service for VMs, 2.6.x versions prior to 2.6.18, 2.7.x versions prior to 2.7.11, and 2.8.x vers

An issue was discovered on Samsung mobile devices with KK(4.4) and later software through 2015-06-16. In some cases, HTT

There is an improper authentication vulnerability in several smartphones. Certain function interface in the system does

An issue was discovered in the Linux kernel before 5.2 on the powerpc platform. arch/powerpc/kernel/idle_book3s.S does n

There is an insufficient integrity validation vulnerability in several products. The device does not sufficiently valida

The fix for the Linux kernel in Ubuntu 18.04 LTS for CVE-2019-14615 ("The Linux kernel did not properly clear data struc

Information Exposure vulnerability in eXtplorer makes the /usr/ and /etc/extplorer/ system directories world-accessible

A CSRF token disclosure vulnerability allows a remote attacker, with access to an authenticated Management Center (MC) u

The ASG and ProxySG management consoles are susceptible to a session hijacking vulnerability. A remote attacker, with ac

KVM in the Linux kernel on Power8 processors has a conflicting use of HSTATE_HOST_R1 to store r1 state in kvmppc_hv_entr

X.509 certificates generated by the MongoDB Enterprise Kubernetes Operator may allow an attacker with access to the Kube

In Argo versions prior to v1.5.0-rc1, it was possible for authenticated Argo users to submit API calls to retrieve secre

auth0.js (NPM package auth0-js) greater than version 8.0.0 and before version 9.12.3 has a vulnerability. In the case of

Some products of Dahua have Denial of Service vulnerabilities. After the successful login of the legal account, the atta

Multiple vulnerabilities could allow an attacker with low privileges to perform SQL injection on WebAccess/NMS (versions

An issue was discovered in Castle Rock SNMPc Online 12.10.10 before 2020-01-28. There are multiple persistent (stored) a

A flaw was discovered in the way that the KVM hypervisor handled instruction emulation for an L2 guest when nested virtu

A privilege escalation vulnerability in Juniper Networks Junos OS devices configured with dual Routing Engines (RE), Vir

A race condition vulnerability on Juniper Network Junos OS devices may cause the routing protocol daemon (RPD) process t

Juniper Networks Junos OS uses the 128.0.0.0/2 subnet for internal communications between the RE and PFEs. It was discov

The kernel memory usage represented as "temp" via 'show system virtual-memory' may constantly increase when Integrated R

A local, authenticated user with shell can obtain the hashed values of login passwords and shared secrets via raw objmon

A local, authenticated user with shell can view sensitive configuration information via the ev.ops configuration file. T

A local, authenticated user with shell can obtain the hashed values of login passwords and shared secrets via the EvoSha

A local, authenticated user with shell can obtain the hashed values of login passwords via configd traces. This issue af

A local, authenticated user with shell can obtain the hashed values of login passwords via configd streamer log. This is

A privilege escalation vulnerability in Juniper Networks QFX10K Series, EX9200 Series, MX Series, and PTX Series with Ne

On Juniper Networks EX and QFX Series, an authentication bypass vulnerability may allow a user connected to the console

Due to insufficient server-side login attempt limit enforcement, a vulnerability in the SSH login service of Juniper Net

An unquoted search path vulnerability in the Windows release of Global Protect Agent allows an authenticated local user

Improper input validation vulnerability in Secdo allows an authenticated local user with 'create folders or append data'

TechSupport files generated on Palo Alto Networks VM Series firewalls for Microsoft Azure platform configured with high

GitLab EE/CE 9.0 to 12.9 allows a maintainer to modify other maintainers' pipeline trigger descriptions within the same

GitLab EE/CE 11.10 to 12.9 is leaking information on restricted CI pipelines metrics to unauthorized users.

GitLab EE/CE 8.11 to 12.9 is leaking information on Issues opened in a public project and then moved to a private projec

GitLab EE/CE 8.5 to 12.9 is vulnerable to a an path traversal when moving an issue between projects.

GitLab EE/CE 10.8 to 12.9 is leaking metadata and comments on vulnerabilities to unauthorized users on the vulnerability

A buffer overflow vulnerability in Code::Blocks 17.12 allows an attacker to execute arbitrary code via a crafted project

Fixed in v1.5.1, Argo version v1.5.0 was vulnerable to a user-enumeration vulnerability which allowed attackers to deter

An issue was discovered on XIAOMI XIAOAI speaker Pro LX06 1.52.4. Attackers can get root shell by accessing the UART int

An issue was discovered on XIAOMI XIAOAI speaker Pro LX06 1.58.10. Attackers can activate the failsafe mode during the b

An issue was discovered on Samsung mobile devices with N(7.x) software. A physically proximate attacker wielding a magne

An issue was discovered on Samsung mobile devices with N(7.x) (Exynos8890/8895 chipsets) software. There is information

An issue was discovered on Samsung mobile devices with O(8.0) software. Execution of an application in a locked Secure F