2020

A vulnerability in the web UI of the Cisco SD-WAN vManage software could allow an authenticated, remote attacker to cond

In the __d2b function of the newlib libc library, all versions prior to 3.3.0 (see newlib/libc/stdlib/mprec.c), Balloc i

In the __mdiff function of the newlib libc library, all versions prior to 3.3.0 (see newlib/libc/stdlib/mprec.c), Balloc

In the __lshift function of the newlib libc library, all versions prior to 3.3.0 (see newlib/libc/stdlib/mprec.c), Ballo

In the __multiply function of the newlib libc library, all versions prior to 3.3.0 (see newlib/libc/stdlib/mprec.c), Bal

In the __i2b function of the newlib libc library, all versions prior to 3.3.0 (see newlib/libc/stdlib/mprec.c), Balloc i

In the __multadd function of the newlib libc library, prior to versions 3.3.0 (see newlib/libc/stdlib/mprec.c), Balloc i

we got reports for 2 injection attacks against the DeltaSpike windowhandler.js. This is only active if a developer selec

IBM DataPower Gateway 2018.4.1.0 through 2018.4.1.8 could allow an authenticated user to bypass security restrictions, a

IBM DataPower Gateway 2018.4.1.0 through 2018.4.1.8 could potentially disclose highly sensitive information to a privile

Ignite Realtime Openfire 4.4.1 allows XSS via the setup/setup-datasource-standard.jsp serverURL parameter.

ilchCMS 2.1.23 allows XSS via the index.php/partner/index Banner parameter.

ilchCMS 2.1.23 allows XSS via the index.php/partner/index Name parameter.

ilchCMS 2.1.23 allows XSS via the index.php/partner/index Link parameter.

A cross-site scripting vulnerability was reported in the oVirt-engine's OAuth authorization endpoint before version 4.3.

The _dtoa_r function of the newlib libc library, prior to version 3.3.0, performs multiple memory allocations without ch

qemu/qemu_driver.c in libvirt before 6.0.0 mishandles the holding of a monitor job during a query to a guest agent, whic

arxes-tolina 3.0.0 allows User Enumeration.

LogicalDoc before 8.3.3 allows SQL Injection. LogicalDoc populates the list of available documents by querying the datab

Cross site scripting vulnerability in McAfee Network Security Management (NSM) Prior to 9.1 update 6 Mar 2020 Update all

Cross site scripting vulnerability in McAfee Network Security Management (NSM) Prior to 9.1 update 6 Mar 2020 Update all

Docker Desktop allows local privilege escalation to NT AUTHORITY\SYSTEM because it mishandles the collection of diagnost

Ignite Realtime Openfire 4.4.1 allows XSS via the setup/setup-datasource-standard.jsp username parameter.

Open edX Ironwood.1 allows support/certificates?course_id= reflected XSS.

ERPNext 11.1.47 allows blog?blog_category= Frame Injection.

In GraphicsMagick before 1.3.32, the text filename component allows remote attackers to read arbitrary files via a craft

The Spark application through 2.0.2 for Android allows XSS via an event attribute and arbitrary file loading via a src a

The TypeApp application through 1.9.5.35 for Android allows XSS via an event attribute and arbitrary file loading via a

The Edison Mail application through 1.7.1 for Android allows XSS via an event attribute and arbitrary file loading via a

The BlueMail application through 1.9.5.36 for Android allows XSS via an event attribute and arbitrary file loading via a

The Nine application through 4.5.3a for Android allows XSS via an event attribute and arbitrary file loading via a src a

The Newton application through 10.0.23 for Android allows XSS via an event attribute and arbitrary file loading via a sr

An issue was discovered in ONAP Portal through Dublin. By executing a call to ONAPPORTAL/portalApi/loggedinUser, an atta

During installation of an OpenShift 4 cluster, the `openshift-install` command line tool creates an `auth` directory, wi

The REENT_CHECK macro (see newlib/libc/include/sys/reent.h) as used by REENT_CHECK_TM, REENT_CHECK_MISC, REENT_CHECK_MP

It was found that the Token Processing Service (TPS) did not properly sanitize the Token IDs from the "Activity" page, e

A Reflected Cross Site Scripting flaw was found in all pki-core 10.x.x versions module from the pki-core server due to t

Aquaforest TIFF Server 4.0 allows Unauthenticated File and Directory Enumeration via tiffserver/tssp.aspx.

Delta Industrial Automation CNCSoft ScreenEditor, v1.00.96 and prior. An out-of-bounds read overflow can be exploited wh

IBM Tivoli Netcool/OMNIbus 8.1.0 is vulnerable to cross-site request forgery which could allow an attacker to execute ma

Zulip Desktop before 4.0.3 loaded untrusted content in an Electron webview with web security disabled, which can be expl

A vulnerability was found in Moodle 3.7 before 3.73, 3.6 before 3.6.7 and 3.5 before 3.5.9, where a reflected XSS possib

A vulnerability was found in Moodle 3.6 before 3.6.7 and 3.7 before 3.7.3, where tokens used to fetch inline atachments

A vulnerability was found in Moodle 3.7 to 3.7.3, 3.6 to 3.6.7, 3.5 to 3.5.9 and earlier where an open redirect existed

A vulnerability was found in moodle 3.7 before 3.7.3, where there is blind XSS reflected in some locations where user em

Entrust Entelligence Security Provider (ESP) before 10.0.60 on Windows mishandles errors during SSL Certificate Validati

OpenCart 3.0.3.2 allows remote authenticated users to conduct XSS attacks via a crafted filename in the users' image upl

cPanel before 84.0.20 allows a webmail or demo account to delete arbitrary files (SEC-547).

cPanel before 84.0.20 allows attackers to bypass intended restrictions on features and demo accounts via WebDisk UAPI ca

cPanel before 84.0.20 allows stored self-XSS via the HTML file editor (SEC-535).