2020

eSOMS versions 4.0 to 6.0.3 do not enforce password complexity settings, potentially resulting in lower access security

For ABB eSOMS versions 4.0 to 6.0.3, HTTPS responses contain comments with sensitive information about the application.

For ABB eSOMS versions 4.0 to 6.0.3, the X-Content-Type-Options Header is missing in the HTTP response, potentially caus

For ABB eSOMS versions 4.0 to 6.0.2, the HTTPOnly flag is not set. This can allow Javascript to access the cookie conten

For ABB eSOMS versions 4.0 to 6.0.2, the X-XSS-Protection HTTP response header is not set in responses from the web serv

For ABB eSOMS versions 4.0 to 6.0.2, the X-Frame-Options header is not configured in HTTP response. This can potentially

For ABB eSOMS 4.0 to 6.0.3, the Cache-Control and Pragma HTTP header(s) have not been properly configured within the app

ini-parser through 0.0.2 is vulnerable to Prototype Pollution.The library could be tricked into adding or modifying prop

Microstrategy Web 10.4 is vulnerable to Server-Side Request Forgery in the Test Web Service functionality exposed throug

Microstrategy Web 10.4 includes functionality to allow users to import files or data from external resources such as URL

codeBeamer before 9.5.0-RC3 does not properly restrict the ability to execute custom Java code and access the Java class

The IBM Process Federation Server 18.0.0.1, 18.0.0.2, 19.0.0.1, 19.0.0.2, and 19.0.0.3 Global Teams REST API does not pr

IBM WebSphere Application Server - Liberty 17.0.0.3 through 20.0.0.3 is vulnerable to cross-site scripting. This vulnera

IBM WebSphere Application Server - Liberty 17.0.0.3 through 20.0.0.3 is vulnerable to cross-site scripting. This vulnera

Microstrategy Web 10.4 is vulnerable to Stored XSS in the HTML Container and Insert Text features in the window, allowin

A Race Condition Enabling Link Following vulnerability in the cron job shipped with texlive-filesystem of SUSE Linux Ent

A Race Condition Enabling Link Following vulnerability in the packaging of texlive-filesystem of SUSE Linux Enterprise M

Monitoring::Logs in Zen Load Balancer 3.10.1 allows remote authenticated admins to conduct absolute path traversal attac

app/Model/feed.php in MISP before 2.4.124 allows administrators to choose arbitrary files that should be ingested by MIS

In Apache HTTP Server 2.4.0 to 2.4.41, redirects configured with mod_rewrite that were intended to be self-referential m

The UniFi Video Server (Windows) web interface configuration restore functionality at the “backup” and “wizard” endpoint

When LDAP authentication is enabled in Apache Druid 0.17.0, callers of Druid APIs with a valid set of LDAP credentials c

In Apache Solr, the cluster can be partitioned into multiple collections and only a subset of nodes actually host any gi

There is an Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in php webpages

Apache CXF has the ability to integrate with JMX by registering an InstrumentationManager extension with the CXF bus. If

An issue was discovered in Deskpro before 2019.8.0. The /api/tickets endpoint failed to properly validate a user's privi

An issue was discovered in Deskpro before 2019.8.0. The /api/people endpoint failed to properly validate a user's privil

In BD Pyxis MedStation ES System v1.6.1 and Pyxis Anesthesia (PAS) ES System v1.6.1, a restricted desktop environment es

The Kubernetes API Server component in versions 1.1-1.14, and versions prior to 1.15.10, 1.16.7 and 1.17.3 allows an aut

In RedpwnCTF before version 2.3, there is a session fixation vulnerability in exploitable through the `#token=$ssid` has

In Apache HTTP Server 2.4.0 to 2.4.41, mod_proxy_ftp may use uninitialized memory when proxying to a malicious FTP serve

Scripts in Sling CMS before 0.16.0 do not property escape the Sling Selector from URLs when generating navigational elem

Data sent with contentId to /control/stream is not sanitized, allowing XSS attacks in Apache OFBiz 16.11.01 to 16.11.07.

Sonatype Nexus Repository before 3.21.2 allows XSS.

A logic issue was addressed with improved restrictions. This issue is fixed in Safari 13.1. A malicious iframe may use a

The issue was addressed by clearing website permission prompts after navigation. This issue is fixed in iOS 13.4 and iPa

An issue existed in the selection of video file by Mail. The issue was fixed by selecting the latest version of a video.

An issue existed in the handling of tabs displaying picture in picture video. The issue was corrected with improved stat

A logic issue was addressed with improved state management. This issue is fixed in iOS 13.4 and iPadOS 13.4. An attacker

This issue was addressed with a new entitlement. This issue is fixed in iOS 13.4 and iPadOS 13.4, tvOS 13.4, watchOS 6.2

An access issue was addressed with additional sandbox restrictions. This issue is fixed in iOS 13.4 and iPadOS 13.4, wat

A memory initialization issue was addressed with improved memory handling. This issue is fixed in iOS 13.4 and iPadOS 13

An input validation issue was addressed with improved input validation. This issue is fixed in iOS 13.4 and iPadOS 13.4,

The issue was addressed with improved deletion. This issue is fixed in iOS 13.4 and iPadOS 13.4. Deleted messages groups

A logic issue was addressed with improved state management. This issue is fixed in macOS Catalina 10.15.4. A local user

A logic issue was addressed with improved restrictions. This issue is fixed in iOS 13.4 and iPadOS 13.4. A maliciously c

A logic issue was addressed with improved restrictions. This issue is fixed in iOS 13.4 and iPadOS 13.4, tvOS 13.4, Safa

A logic issue was addressed with improved restrictions. This issue is fixed in iOS 13.4 and iPadOS 13.4, tvOS 13.4, Safa

An injection issue was addressed with improved validation. This issue is fixed in macOS Catalina 10.15.4. A remote attac

A logic issue was addressed with improved state management. This issue is fixed in macOS Catalina 10.15.4. A local user