2020

An issue was discovered on Samsung mobile devices with Q(10.0) (with ONEUI 2.1) software. In the Lockscreen state, the Q

An issue was discovered on Samsung mobile devices with P(9.0) and Q(10.0) (released in China and India) software. The S

An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) software. The USB driver leaks addres

Platform mechanism AutoIP allows remote attackers to reboot the device via a crafted packet in SICK AG solutions Bulksca

Zyxel VMG5313-B30B router on firmware 5.13(ABCJ.6)b3_1127, and possibly older versions of firmware are affected by shell

An out-of-bounds read/write access flaw was found in the USB emulator of the QEMU in versions before 5.2.0. This issue o

Incorrect Default Permission vulnerability exists in SoMove (V2.8.1) and prior which could cause elevation of privilege

Improper Input Validation vulnerability exists in PowerChute Business Edition (software V9.0.x and earlier) which could

Improper Restriction of Excessive Authentication Attempts vulnerability exists in all hardware versions of spaceLYnk and

Out-of-bounds Write vulnerability exists in Modicon M218 Logic Controller (V5.0.0.7 and prior) which could cause Denial

Improper Privilege Management vulnerability exists in Schneider Electric Modbus Serial Driver (see security notification

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in SFAPV9601 - APC E

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in SFAPV9601 - APC E

controller/controller-comments.php in WP GDPR plugin through 2.1.1 has unauthenticated stored XSS.

The Chamber Dashboard Business Directory plugin 3.2.8 for WordPress allows XSS.

TP-Link TL-WA855RE V5 20200415-rel37464 devices allow an unauthenticated attacker (on the same network) to submit a TDDP

The includes/gateways/stripe/includes/admin/admin-actions.php in GiveWP plugin through 2.5.9 for WordPress allows unauth

lara-google-analytics.php in Lara Google Analytics plugin through 2.0.4 for WordPress allows authenticated stored XSS.

Sliced Invoices plugin for WordPress 3.8.2 and earlier allows unauthenticated information disclosure and authenticated S

Dashboards and progressiveProfileForms in ForgeRock Identity Manager before 7.0.0 are vulnerable to stored XSS. The vuln

Missing access control restrictions in the Hypervisor component of the ACRN Project (v2.0 and v1.6.1) allow a malicious

Dolibarr 11.0.4 is affected by multiple stored Cross-Site Scripting (XSS) vulnerabilities that could allow remote authen

The flash memory readout protection in Gigadevice GD32F103 devices allows physical attackers to extract firmware via the

Apex Microelectronics APM32F103 devices allow physical attackers to execute arbitrary code via a power glitch and a spec

Gigadevice GD32F103 and GD32F130 devices allow physical attackers to extract data via the probing of easily accessible b

The flash memory readout protection in Gigadevice GD32VF103 devices allows physical attackers to extract firmware via th

Gigadevice GD32F130 devices allow physical attackers to escalate their debug interface permissions via fault injection i

The flash memory readout protection in China Key Systems & Integrated Circuit CKS32F103 devices allows physical attacker

STMicroelectronics STM32F103 devices through 2020-05-20 allow physical attackers to execute arbitrary code via a power g

The security protection in Gigadevice GD32F103 devices allows physical attackers to redirect the control flow and execut

The flash memory readout protection in China Key Systems & Integrated Circuit CKS32F103 devices allows physical attacker

The flash memory readout protection in Apex Microelectronics APM32F103 devices allows physical attackers to extract firm

RabbitMQ versions 3.8.x prior to 3.8.7 are prone to a Windows-specific binary planting security vulnerability that allow

An issue was discovered in Zoho ManageEngine Exchange Reporter Plus before build number 5510, AD360 before build number

An issue was discovered in Collabtive 3.0 and later. managefile.php is vulnerable to XSS: when the action parameter is s

The Bluetooth Low Energy (BLE) controller implementation in Espressif ESP-IDF 4.0 through 4.2 (for ESP32 devices) return

The Bluetooth Low Energy (BLE) controller implementation in Espressif ESP-IDF 4.2 and earlier (for ESP32 devices) does n

The Bluetooth Low Energy Secure Manager Protocol (SMP) implementation in Texas Instruments SimpleLink SIMPLELINK-CC2640R

In QEMU through 5.0.0, an integer overflow was found in the SM501 display driver implementation. This flaw occurs in the

OX App Suite 7.10.3 and earlier allows XSS via text/x-javascript, text/rdf, or a PDF document.

OX App Suite 7.10.1 to 7.10.3 has improper input validation for rate limits with a crafted User-Agent header, spoofed va

OX App Suite 7.10.3 and earlier allows SSRF, related to the mail account API and the /folder/list API.

OX App Suite 7.10.3 and earlier has Incorrect Access Control via an /api/subscriptions request for a snippet containing

THOMSON THT741FTA 2.2.1 and Philips DTR3502BFTA DVB-T2 2.2.1 set-top boxes have their TELNET service hardcoded to start

The RSS application on THOMSON THT741FTA 2.2.1 and Philips DTR3502BFTA DVB-T2 2.2.1 set-top boxes doesn't validate the S

In projectworlds Online Book Store 1.0 Use of Hard-coded Credentials in source code leads to admin panel access.

IBM Spectrum Scale V5.0.0.0 through V5.0.4.3 and V4.2.0.0 through V4.2.3.21 could allow a local attacker to cause a deni

An issue was discovered in the Elementor plugin through 2.9.13 for WordPress. An authenticated attacker can achieve stor

The Blubrry subscribe-sidebar (aka Subscribe Sidebar) plugin 1.3.1 for WordPress allows subscribe_sidebar.php&status= re

An issue was discovered in Flask-CORS (aka CORS Middleware for Flask) before 3.0.9. It allows ../ directory traversal to