2020

cPanel before 84.0.20 allows self XSS via a temporary character-set specification (SEC-515).

cPanel before 82.0.18 allows stored XSS via WHM Backup Restoration (SEC-533).

cPanel before 82.0.18 allows attackers to conduct arbitrary chown operations as root during log processing (SEC-532).

cPanel before 82.0.18 allows attackers to read an arbitrary database via MySQL dump streaming (SEC-531).

cPanel before 82.0.18 allows self-XSS because JSON string escaping is mishandled (SEC-520).

The Hustle (aka wordpress-popup) plugin through 6.0.5 for WordPress allows Directory Traversal to obtain a directory lis

An improper neutralization of input vulnerability in FortiWeb allows a remote authenticated attacker to perform a stored

The ConfigureBambooRelease resource in Jira Software and Jira Software Data Center before version 8.6.1 allows authentic

The EditApplinkServlet resource in the Atlassian Application Links plugin before version 5.4.20, from version 6.0.0 befo

Citrix SD-WAN 10.2.x before 10.2.6 and 11.0.x before 11.0.3 has Missing SSL Certificate Validation.

cPanel before 82.0.18 allows attackers to leverage virtual mail accounts in order to bypass account suspensions (SEC-508

An XSS Injection vulnerability exists in Sangoma FreePBX and PBXact 13, 14, and 15 within the Call Event Logging report

Multiple XSS vulnerabilities exist in the Backup & Restore module \ v14.0.10.2 through v14.0.10.7 for FreePBX, as shown

An issue was discovered in Halvotec RaQuest 10.23.10801.0. The login page of the admin application is vulnerable to an O

An issue was discovered in Halvotec RaQuest 10.23.10801.0. Several features of the application allow stored Cross-site S

An issue was discovered in Halvotec RaQuest 10.23.10801.0. It allows session fixation. Fixed in Release 24.2020.20608.0.

Umbraco CMS 8.5.3 allows an authenticated file upload (and consequently Remote Code Execution) via the Install Package f

yargs-parser could be tricked into adding or modifying properties of Object.prototype using a "__proto__" payload.

Post-authentication Stored XSS in Team Password Manager through 7.93.204 allows attackers to steal other users' credenti

A potential security vulnerability has been identified for certain HP Printers and All-in-Ones that would allow bypassin

be_teacher in class-lp-admin-ajax.php in the LearnPress plugin 3.2.6.5 and earlier for WordPress allows any registered u

The API in Dradis Pro 3.4.1 allows any user to extract the content of a project, even if this user is not part of the pr

Nagios Log Server 2.1.3 allows XSS by visiting /profile and entering a crafted name field that is mishandled on the /adm

Nagios Log Server 2.1.3 has Incorrect Access Control.

A flaw was found in the Ansible Engine when the fetch module is used. An attacker could intercept the module, inject a n

An issue was discovered in Joomla! before 3.9.16. Inadequate handling of CSS selectors in the Protostar and Beez3 JavaSc

An issue was discovered in Joomla! before 3.9.16. Missing length checks in the user table can lead to the creation of us

IBM MQ and IBM MQ Appliance 7.1, 7.5, 8.0, 9.0 LTS, 9.1 LTS, and 9.1 CD could allow a local attacker to obtain sensitive

IBM MQ and IBM MQ Appliance 7.1, 7.5, 8.0, 9.0 LTS, 9.1 LTS, and 9.1 CD is vulnerable to a denial of service attack that

IBM MQ and IBM MQ Appliance 7.1, 7.5, 8.0, 9.0 LTS, 9.1 LTS, and 9.1 CD could allow a local attacker to obtain sensitive

IBM Cloud Automation Manager 3.2.1.0 does not renew a session variable after a successful authentication which could lea

Missing hostname validation in Swisscom Centro Grande before 6.16.12 allows a remote attacker to inject its local IP add

An XSS Injection vulnerability exists in Sangoma FreePBX and PBXact 13, 14, and 15 within the Debug/Test page of the Sup

A security flaw was found in Ansible Engine, all Ansible 2.7.x versions prior to 2.7.17, all Ansible 2.8.x versions prio

Dolibarr ERP/CRM before 10.0.3 has an Insufficient Filtering issue that can lead to user/card.php XSS.

Dolibarr ERP/CRM before 10.0.3 allows XSS because uploaded HTML documents are served as text/html despite being renamed

LimeSurvey 3.17.7+190627 has XSS via Boxes in application/extensions/PanelBoxWidget/views/box.php or a label title in ap

Easy!Appointments 1.3.0 has a Guessable CAPTCHA issue.

Contao before 4.5.7 has XSS in the system log.

Login filter can access configuration files vulnerability in Micro Focus Service Manager (Web Tier), affecting versions

HTTP methods reveled in Web services vulnerability in Micro Focus Service manager (server), affecting versions 9.40, 9.4

An improper input validation vulnerability in FortiOS 6.2.1, 6.2.0, 6.0.8 and below until 5.4.0 under admin webUI may al

A system command injection vulnerability in the FortiAP-S/W2 6.2.1, 6.2.0, 6.0.5 and below, FortiAP 6.0.5 and below and

In parseTrackFragmentRun of MPEG4Extractor.cpp, there is possible resource exhaustion due to improper input validation.

In StatsService, there is a possible out of bounds read. This could lead to local information disclosure if UBSAN were n

In libAACdec, there is a possible out of bounds read. This could lead to remote information disclosure, with no addition

The package integrity validation in yarn < 1.19.0 contains a TOCTOU vulnerability where the hash is computed before writ

An issue was discovered in Janus through 0.9.1. janus.c has multiple concurrent threads that misuse the source property

An issue was discovered in Janus through 0.9.1. plugins/janus_voicemail.c in the VoiceMail plugin has a race condition t

An issue was discovered in Janus through 0.9.1. plugins/janus_videocall.c in the VideoCall plugin mishandles session man