2020

An Unsafe Search Path vulnerability in FortiClient EMS online installer 6.2.1 and below may allow a local attacker with

In Bluetooth, there is a possible out of bounds read due to a missing bounds check. This could lead to remote informatio

In Bluetooth, there is a possible out of bounds read due to a missing bounds check. This could lead to remote informatio

In overlay notifications, there is a possible hidden notification due to improper input validation. This could lead to a

In app uninstallation, there is a possible set of permissions that may not be removed from a shared app ID. This could l

An issue was discovered in Walmart Labs Concord before 1.44.0. CORS Access-Control-Allow-Origin headers have a potential

v2rayL 2.1.3 allows local users to achieve root access because /etc/v2rayL/config.json is owned by a low-privileged user

v2rayL 2.1.3 allows local users to achieve root access because /etc/v2rayL/add.sh and /etc/v2rayL/remove.sh are owned by

The dot package v1.1.2 uses Function() to compile templates. This can be exploited by the attacker if they can control t

antiX and MX Linux allow local users to achieve root access via "persist-config --command /bin/sh" because of the Sudo c

An arbitrary file read vulnerability exists in system/controller/backend/template.php in QCMS v3.0.1.

An issue was discovered in Janus through 0.9.1. janus_audiobridge.c has a double mutex unlock when listing private rooms

The sitepress-multilingual-cms (WPML) plugin before 4.3.7-b.2 for WordPress has CSRF due to a loose comparison. This lea

grub2-bhyve, as used in FreeBSD bhyve before revision 525916 2020-02-12, mishandles font loading by a guest through a gr

grub2-bhyve, as used in FreeBSD bhyve before revision 525916 2020-02-12, does not validate the address provided as part

In wagtail-2fa before 1.4.1, any user with access to the CMS can view and delete other users 2FA devices by going to the

In Administrate (rubygem) before version 0.13.0, when sorting by attributes on a dashboard, the direction parameter was

An issue was discovered in DEVOME GRR before 3.4.1c. admin_edit_room.php mishandles file uploads.

An issue was discovered in Halvotec RaQuest 10.23.10801.0. One of the exposed web services allows an anonymous user to a

Ricoh SP C250DN 1.05 devices have a fixed password. FTP service credential were found to be hardcoded within the printer

Ricoh SP C250DN 1.05 devices allow denial of service (issue 1 of 3). Some Ricoh printers were affected by a wrong LPD se

Some Kyocera printers (such as the ECOSYS M5526cdw 2R7_2000.001.701) were affected by a buffer overflow vulnerability in

The web application of some Kyocera printers (such as the ECOSYS M5526cdw 2R7_2000.001.701) was vulnerable to path trave

Some Brother printers (such as the HL-L8360CDW v1.20) were affected by different information disclosure vulnerabilities

Some Brother printers (such as the HL-L8360CDW v1.20) were affected by a stack buffer overflow vulnerability as the web

Some Xerox printers (such as the Phaser 3320 V53.006.16.000) did not implement account lockout. Local account credential

GitLab EE 12.4.2 through 12.8.1 allows Denial of Service. It was internally discovered that a potential denial of servic

The Voo branded NETGEAR CG3700b custom firmware V2.02.03 allows CSRF against all /goform/ URIs. An attacker can modify a

The Voo branded NETGEAR CG3700b custom firmware V2.02.03 uses the same default 8 character passphrase for the administra

Some Kyocera printers (such as the ECOSYS M5526cdw 2R7_2000.001.701) were affected by a buffer overflow vulnerability in

All configuration parameters of certain Kyocera printers (such as the ECOSYS M5526cdw 2R7_2000.001.701) were accessible

Some Kyocera printers (such as the ECOSYS M5526cdw 2R7_2000.001.701) were affected by an integer overflow vulnerability

GitLab 8.11 through 12.8.1 allows a Denial of Service when using several features to recursively request eachother,

GitLab 12.5 through 12.8.1 has Insecure Permissions. Depending on particular group settings, it was possible for invited

GitLab before 12.8.2 allows Information Disclosure. Badge images were not being proxied, causing mixed content warnings

StorageGRID (formerly StorageGRID Webscale) versions 10.0.0 through 11.3 prior to 11.2.0.8 and 11.3.0.4 are susceptible

An internal product security audit of Lenovo XClarity Administrator (LXCA) discovered Windows OS credentials, used to pe

Untis WebUntis before 2020.9.6 allows CSRF for certain combinations of rights and modules.

Trend Micro Password Manager for Windows version 5.0 is affected by a DLL hijacking vulnerability would could potentiall

Huawei USG6000V with versions V500R001C20SPC300, V500R003C00SPC100, and V500R005C00SPC100 have an out-of-bounds read vul

A Cross-Site Request Forgery (CSRF) vulnerability in the user interface of Fortinet FortiSIEM 5.2.5 could allow a remote

Improper access control in the subsystem for Intel(R) Smart Sound Technology may allow an authenticated user to potentia

Uncontrolled search path in Intel(R) Graphics Drivers before version 26.20.100.7158 may allow an authenticated user to p

Improper access control in subsystem for BlueZ before version 5.54 may allow an unauthenticated user to potentially enab

Unquoted service path in Intel(R) Optane(TM) DC Persistent Memory Module Management Software before version 1.0.0.3461 m

Improper buffer restrictions in firmware for Intel(R) NUC may allow an authenticated user to potentially enable escalati

An issue was discovered in Poly (formerly Polycom) HDX 3.1.13. A feature exists that allows the creation of a server / c

bitcoind and Bitcoin-Qt prior to 0.10.2 allow attackers to cause a denial of service (disabled functionality such as a c

Path traversal in igdkmd64.sys for Intel(R) Graphics Drivers before versions 15.45.30.5103, 15.40.44.5107, 15.36.38.5117

Improper access control for Intel(R) Graphics Drivers before versions 15.33.49.5100 and 15.36.38.5117 may allow an authe