2020

Jenkins Logstash Plugin 2.3.1 and earlier transmits configured credentials in plain text as part of its global Jenkins c

A missing permission check in Jenkins P4 Plugin 1.10.10 and earlier allows attackers with Overall/Read permission to tri

A cross-site request forgery vulnerability in Jenkins P4 Plugin 1.10.10 and earlier allows attackers to trigger builds o

Jenkins Audit Trail Plugin 3.2 and earlier does not escape the error message for the URL Patterns field form validation,

An arbitrary file write vulnerability in Jenkins Cobertura Plugin 1.15 and earlier allows attackers able to control the

Jenkins Timestamper Plugin 1.11.1 and earlier does not sanitize HTML formatting of its output, resulting in a stored XSS

Jenkins Git Plugin 4.2.0 and earlier does not escape the error message for the repository URL for Microsoft TFS field fo

An issue was discovered in Froxlor through 0.10.15. The installer wrote configuration parameters including passwords int

An issue was discovered in Froxlor before 0.10.14. It created files with static names in /tmp during installation if the

vega-util prior to 1.13.1 allows manipulation of object prototype. The 'vega.mergeConfig' method within vega-util could

In Mahara 18.10 before 18.10.5, 19.04 before 19.04.4, and 19.10 before 19.10.2, certain personal information is discover

nwbc_ext2int in SAP NetWeaver Application Server before Security Note 2183189 allows XXE attacks for local file inclusio

HikaShop Joomla Component before 2.6.0 has XSS via an injected payload[/caption].

JNews Joomla Component before 8.5.0 has XSS via the mailingsearch parameter.

A cross-site scripting (XSS) vulnerability in the HTML Data Processor for CKEditor 4.0 before 4.14 allows remote attacke

Monstra CMS through 3.0.4 allows remote authenticated users to take over arbitrary user accounts via a modified login pa

Various Lexmark products have stored XSS in the embedded web server used in older generation Lexmark devices. Affected p

Various Lexmark products have reflected XSS in the embedded web server used in older generation Lexmark devices. Affecte

Citrix Gateway 11.1, 12.0, and 12.1 allows Cache Poisoning. NOTE: Citrix disputes this as not a vulnerability. By defaul

Citrix Gateway 11.1, 12.0, and 12.1 allows Information Exposure Through Caching. NOTE: Citrix disputes this as not a vul

usrsctp before 2019-12-20 has out-of-bounds reads in sctp_load_addresses_from_init.

The RegistrationMagic plugin through 4.6.0.3 for WordPress allows remote authenticated users (with minimal privileges) t

An issue was discovered on Xiaomi MIUI V11.0.5.0.QFAEUXM devices. The export component of GetApps(com.xiaomi.mipicks) mi

Spring Cloud Config, versions 2.2.x prior to 2.2.2, versions 2.1.x prior to 2.1.7, and older unsupported versions allow

HCL Connections 6.5 is vulnerable to possible information leakage. Connections could disclose sensitive information via

The HCL Connections 5.5 help system is vulnerable to cross-site scripting, caused by improper validation of user-supplie

A vulnerability was found in business-central, as shipped in rhdm-7.5.1 and rhpam-7.5.1, where encoded passwords are sto

An issue was discovered on XIAOMI AI speaker MDZ-25-DT 1.34.36, and 1.40.14. Attackers can get root shell by accessing t

PHPGurukul Daily Expense Tracker System 1.0 is vulnerable to stored XSS, as demonstrated by the ExpenseItem or ExpenseCo

Possibility of null pointer access if the SPDM commands are executed in the non-standard way in TZ. in Snapdragon Auto,

An issue was discovered in Zammad 3.0 through 3.2. It returns source code of static resources when submitting an OPTIONS

An issue was discovered in Zammad 3.0 through 3.2. After authentication, it transmits sensitive information to the user

An XSS issue was discovered in Zammad 3.0 through 3.2. Malicious code can be provided by a low-privileged user through t

An issue was discovered in Zammad 3.0 through 3.2. The Forgot Password functionality is implemented in a way that would

An issue was discovered in Zammad 3.0 through 3.2. It allows for users to view ticket customer details associated with s

An XSS issue was discovered in Zammad 3.0 through 3.2. Malicious code can be provided by a low-privileged user through t

An XSS issue was discovered in Zammad 3.0 through 3.2. Malicious code can be provided by a low-privileged user through t

An issue was discovered in Zammad 3.0 through 3.2. It may respond with verbose error messages that disclose internal app

CNCF Envoy through 1.13.0 TLS inspector bypass. TLS inspector could have been bypassed (not recognized as a TLS client)

CNCF Envoy through 1.13.0 has incorrect Access Control when using SDS with Combined Validation Context. Using the same s

Stored XSS exists in the Appointment Booking Calendar plugin before 1.3.35 for WordPress. In the cpabc_appointments.php

A vulnerability in the web-based management interface of Cisco Prime Collaboration Provisioning could allow an unauthent

A vulnerability in the web-based management interface of Cisco Prime Collaboration Provisioning could allow an unauthent

A vulnerability in the IPsec packet processor of Cisco IOS XR Software could allow an unauthenticated remote attacker to

A vulnerability in the web-based management interface of Cisco TelePresence Management Suite (TMS) could allow an authen

A vulnerability in the multicast DNS (mDNS) protocol configuration of Cisco Webex Meetings Client for MacOS could allow

A vulnerability in the malware detection functionality in Cisco Advanced Malware Protection (AMP) in Cisco AsyncOS Softw

A vulnerability in Cisco Remote PHY Device Software could allow an authenticated, local attacker to execute commands on

A vulnerability in the web-based management interface of Cisco AsyncOS for Cisco Email Security Appliance (ESA), Cisco W

A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticat