2020

An unauthenticated stack-based buffer overflow vulnerability in common.c's handle_PORT in uftpd FTP server versions 2.10

Open Zaak is a modern, open-source data- and services-layer to enable zaakgericht werken, a Dutch approach to case manag

IBM Planning Analytics 2.0 is vulnerable to cross-site request forgery which could allow an attacker to execute maliciou

Host Header Injection in Spiceworks 7.5.7.0 allowing the attacker to render arbitrary links that point to a malicious we

A reflected Cross-site scripting (XSS) vulnerability in Xinuo (formerly SCO) Openserver version 5 and 6 allows remote at

Xinuos (formerly SCO) Openserver v5 and v6 allows attackers to execute arbitrary commands via shell metacharacters in ou

In tangro Business Workflow before 1.18.1, knowing an attachment ID, it is possible to download workitem attachments wit

In tangro Business Workflow before 1.18.1, a user's profile contains some items that are greyed out and thus are not int

An issue was discovered in tangro Business Workflow before 1.18.1. No (or broken) access control checks exist on the /ap

In tangro Business Workflow before 1.18.1, an attacker can manipulate the value of PERSON in requests to /api/profile in

tangro Business Workflow before 1.18.1 requests a list of allowed filetypes from the server and restricts uploads to the

An incorrect access control implementation in Tangro Business Workflow before 1.18.1 allows an attacker to download docu

Every login in tangro Business Workflow before 1.18.1 generates the same JWT token, which allows an attacker to reuse th

In tangro Business Workflow before 1.18.1, the documentId of attachment uploads to /api/document/attachments/upload can

An issue was discovered on LG mobile devices with Android OS 10 software. When a dual-screen configuration is supported,

An issue was discovered on LG mobile devices with Android OS 8.0, 8.1, 9.0, and 10 software. There is a WebView SSL erro

An issue was discovered on Samsung mobile devices with Q(10.0) and R(11.0) (Qualcomm SM8250 chipsets) software. They all

An issue was discovered in the GPS daemon on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) (non-Qualcomm chips

An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) (Exynos chipsets) software. They allo

An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), Q(10.0), and R(11.0) software. Attackers can bypa

An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) software. Any application may establi

An issue was discovered in Finder on Samsung mobile devices with Q(10.0) software. A call to a non-existent provider all

SolarWinds Web Help Desk 12.7.0 allows XSS via the First Name field of a User Account.

SolarWinds Web Help Desk 12.7.0 allows XSS via an uploaded SVG document in a request.

An issue was discovered in MediaWiki before 1.35.1. Missing users (accounts that don't exist) and hidden users (accounts

MediaWiki before 1.35.1 allows XSS via BlockLogFormatter.php. Language::translateBlockExpiry itself does not escape in a

MediaWiki before 1.35.1 allows XSS via BlockLogFormatter.php. MediaWiki:blanknamespace potentially can be output as raw

MediaWiki before 1.35.1 blocks legitimate attempts to hide log entries in some situations. If one sets MediaWiki:Mainpag

In MediaWiki before 1.35.1, the messages userrights-expiry-current and userrights-expiry-none can contain raw HTML. XSS

In MediaWiki before 1.35.1, the combination of Html::rawElement and Message::text leads to XSS because the definition of

The Bluetooth handset of Mitel MiVoice 6940 and 6930 MiNet phones with firmware before 1.5.3 could allow an unauthentica

The Bluetooth handset of Mitel MiVoice 6873i, 6930, and 6940 SIP phones with firmware before 5.1.0.SP6 could allow an un

The online help portal of Mitel MiCollab before 9.2 could allow an attacker to redirect a user to an unauthorized websit

The chat window of Mitel BusinessCTI Enterprise (MBC-E) Client for Windows before 6.4.11 and 7.x before 7.0.3 could allo

The NuPoint Messenger of Mitel MiCollab before 9.2 could allow an attacker with escalated privilege to access user files

The AWV portal of Mitel MiCollab before 9.2 could allow an attacker to gain access to conference information by sending

The AWV component of Mitel MiCollab before 9.2 could allow an attacker to gain access to a web conference due to insuffi

The NuPoint Messenger Portal of Mitel MiCollab before 9.2 could allow an authenticated attacker to execute arbitrary scr

The SAS portal of Mitel MiCollab before 9.2 could allow an attacker to access user credentials due to improper input val

The AWV component of Mitel MiCollab before 9.2 could allow an attacker to view system information by sending arbitrary c

The Ignite portal in Mitel MiContact Center Business before 9.3.0.0 could allow a local attacker to view system informat

A arbitrary code execution vulnerability exists in the way that the Stove client improperly validates input value. An at

An issue was discovered in Legion of the Bouncy Castle BC Java 1.65 and 1.66. The OpenBSDBCrypt.checkPassword utility me

A flaw was found in Linux-Pam in versions prior to 1.5.1 in the way it handle empty passwords for non-existing users. Wh

A vulnerability in the input parameter handling of HCL Notes v9 could potentially be exploited by an authenticated attac

If Apache TomEE 8.0.0-M1 - 8.0.3, 7.1.0 - 7.1.3, 7.0.0-M1 - 7.0.8, 1.0.0 - 1.7.5 is configured to use the embedded Activ

An information disclosure vulnerability exists in the Web Manager and telnet CLI functionality of Lantronix XPort EDGE 3

An authentication bypass vulnerability exists in the Web Manager functionality of Lantronix XPort EDGE 3.0.0.0R11, 3.1.0

An information disclosure vulnerability exists in the WinRing0x64 Driver IRP 0x9c402084 functionality of NZXT CAM 4.8.0.

An information disclosure vulnerability exists in the WinRing0x64 Driver IRP 0x9c406104 functionality of NZXT CAM 4.8.0.