2020

IBM Jazz Team Server based Applications are vulnerable to cross-site scripting. This vulnerability allows users to embed

In Miller (command line utility) using the configuration file support introduced in version 5.9.0, it is possible for an

In Symfony before versions 4.4.13 and 5.1.5, the CachingHttpClient class from the HttpClient Symfony component relies on

The sf_event_mgt (aka Event management and registration) extension before 4.3.1 and 5.x before 5.1.1 for TYPO3 allows In

The l10nmgr (aka Localization Manager) extension before 7.4.0, 8.x before 8.7.0, and 9.x before 9.2.0 for TYPO3 allows I

In KDE Ark before 20.08.1, a crafted TAR archive with symlinks can install files outside the extraction directory, as de

Go before 1.14.8 and 1.15.x before 1.15.1 allows XSS because text/html is the default for CGI/FCGI handlers that lack a

ForLogic Qualiex v1 and v3 has weak token expiration. This allows remote unauthenticated privilege escalation and access

Because of unauthenticated password changes in ForLogic Qualiex v1 and v3, customer and admin permissions and data can b

ForLogic Qualiex v1 and v3 allows any authenticated customer to achieve privilege escalation via user creations, passwor

A Cross-Site Request Forgery (CSRF) vulnerability in changeUsername.php in SourceCodester Stock Management System v1.0 a

An issue was discovered in Squid before 4.13 and 5.x before 5.0.4. Due to incorrect data validation, HTTP Request Splitt

An issue was discovered in Squid before 4.13 and 5.x before 5.0.4. Due to incorrect data validation, HTTP Request Smuggl

Dolibarr before 11.0.5 allows low-privilege users to upload files of dangerous types, leading to arbitrary code executio

Rebar3 versions 3.0.0-beta.3 to 3.13.2 are vulnerable to OS command injection via URL parameter of dependency specificat

The Teamwire application 5.3.0 for Android allows physically proximate attackers to exploit a flaw related to the pass-c

An issue was discovered on D-Link DCS-2530L before 1.06.01 Hotfix and DCS-2670L through 2.02 devices. cgi-bin/ddns_enc.c

An issue was discovered on D-Link DCS-2530L before 1.06.01 Hotfix and DCS-2670L through 2.02 devices. The unauthenticate

A Lucky 13 timing side channel in mbedtls_ssl_decrypt_buf in library/ssl_msg.c in Trusted Firmware Mbed TLS through 2.23

A Reflected XSS vulnerability was discovered in Ignite Realtime Openfire version 4.5.1. The XSS vulnerability allows rem

Ignite Realtime Openfire 4.5.1 has a reflected Cross-site scripting vulnerability which allows an attacker to execute ar

In Ignite Realtime Openfire 4.5.1 a Stored Cross-site Vulnerability allows an attacker to execute an arbitrary malicious

A post-authenticated stored XSS was found in MultiUx v.3.1.12.0 via the /multiux/SaveMailbox LastName field.

Razer Chroma SDK Rest Server through 3.12.17 allows remote attackers to execute arbitrary programs because there is a ra

Zyxel VMG5313-B30B router on firmware 5.13(ABCJ.6)b3_1127, and possibly older versions of firmware are affected by insec

Shadankun Server Security Type (excluding normal blocking method types) Ver.1.5.3 and earlier allows remote attackers to

FreedomBox through 20.13 allows remote attackers to obtain sensitive information from the /server-status page of the Apa

In Lenovo systems, SMM BIOS Write Protection is used to prevent writes to SPI Flash. While this provides sufficient prot

The BIOS tamper detection mechanism was not triggered in Lenovo ThinkPad A285, BIOS versions up to r0xuj70w; A485, BIOS

SUPERAntiSyware Professional X Trial 10.0.1206 is vulnerable to local privilege escalation because it allows unprivilege

A ZTE product is impacted by the cryptographic issues vulnerability. The encryption algorithm is not properly used, so r

A ZTE product has a DoS vulnerability. Because the equipment couldn’t distinguish the attack packets and normal packets

A code execution vulnerability exists in the DICOM parse_dicom_meta_info functionality of Accusoft ImageGear 19.7. A spe

A memory corruption vulnerability exists in the TIFF handle_COMPRESSION_PACKBITS functionality of Accusoft ImageGear 19.

A remote code execution vulnerability exists in the install functionality of OS4Ed openSIS 7.4. The username variable wh

A remote code execution vulnerability exists in the install functionality of OS4Ed openSIS 7.4. The password variable wh

A remote code execution vulnerability exists in the Modules.php functionality of OS4Ed openSIS 7.3. A specially crafted

SQL injection vulnerability exists in the password reset functionality of OS4Ed openSIS 7.3. The password_stf_email para

SQL injection vulnerability exists in the password reset functionality of OS4Ed openSIS 7.3. The username_stf_email para

SQL injection vulnerability exists in the password reset functionality of OS4Ed openSIS 7.3. The uname parameter in the

SQL injection vulnerability exists in the password reset functionality of OS4Ed openSIS 7.3. The password_stf_email para

MAGMI versions prior to 0.7.24 are vulnerable to a remote authentication bypass due to allowing default credentials in t

Currently, all versions of MAGMI are vulnerable to CSRF due to the lack of CSRF tokens. RCE (via phpcli command) is poss

USVN (aka User-friendly SVN) before 1.0.10 allows CSRF, related to the lack of the SameSite Strict feature.

USVN (aka User-friendly SVN) before 1.0.10 allows attackers to execute arbitrary code in the commit view.

The affected product is vulnerable to reflected cross-site scripting, which may allow an attacker to remotely execute ar

The affected product is vulnerable to cross-site request forgery, which may allow an attacker to modify different config

The affected product is vulnerable to stored cross-site scripting, which may allow an attacker to remotely execute arbit

The affected product is vulnerable due to an undocumented interface found on the device, which may allow an attacker to

In Apache Cassandra, all versions prior to 2.1.22, 2.2.18, 3.0.22, 3.11.8 and 4.0-beta2, it is possible for a local atta