2020

An out-of-bounds memory corruption vulnerability exists in the way Pixar OpenUSD 20.05 uses SPECS data from binary USD f

A XSS vulnerability was discovered in python-lxml's clean module. The module's parser didn't properly imitate browsers,

A flaw was found in ImageMagick in coders/hdr.c. An attacker who submits a crafted file that is processed by ImageMagick

In `GammaImage()` of /MagickCore/enhance.c, depending on the `gamma` value, it's possible to trigger a divide-by-zero co

A flaw was found in infinispan 10 REST API, where authorization permissions are not checked while performing some server

Jenkins Chaos Monkey Plugin 0.4 and earlier does not perform permission checks in an HTTP endpoint, allowing attackers w

OpenClinic version 0.8.2 is affected by a stored XSS vulnerability in lib/Check.php that allows users of the application

A flaw was found in the way samba handled file and directory permissions. An authenticated user could use this flaw to g

Improper restriction of rendered UI layers or frames in EC-CUBE versions from 3.0.0 to 3.0.18 leads to clickjacking atta

Stored cross-site scripting vulnerability in GROWI v3.8.1 and earlier allows remote attackers to inject arbitrary script

Reflected cross-site scripting vulnerability in GROWI v4.0.0 and earlier allows remote attackers to inject arbitrary scr

Cross-site scripting vulnerability in desknet's NEO (desknet's NEO Small License V5.5 R1.5 and earlier, and desknet's NE

Python oic is a Python OpenID Connect implementation. In Python oic before version 1.2.1, there are several related cryp

An issue was discovered in Bitrix24 Bitrix Framework (1c site management) 20.0. An "User enumeration and Improper Restri

An exploitable vulnerability exists in the way Pixar OpenUSD 20.05 handles parses certain encoded types. A specially cra

An exploitable vulnerability exists in the way Pixar OpenUSD 20.05 handles parses certain encoded types. A specially cra

An exploitable vulnerability exists in the way Pixar OpenUSD 20.05 handles parses certain encoded types. A specially cra

A heap overflow vulnerability exists in the Pixar OpenUSD 20.05 parsing of compressed string tokens in binary USD files.

Lepton-CMS 4.7.0 is affected by cross-site scripting (XSS). An attacker can inject the XSS payload in the URL field of t

Online Birth Certificate System Project V 1.0 is affected by cross-site scripting (XSS). This vulnerability can result i

AppImage appimaged before 1.0.3 does not properly check whether a downloaded file is a valid appimage. For example, it w

AppImage libappimage before 1.0.3 allows attackers to trigger an overwrite of a system-installed .desktop file by provid

Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request U

This release fixes a Cross Site Request Forgery vulnerability was found in Red Hat CloudForms which forces end users to

Multiple cross-site scripting (XSS) vulnerabilities in Papermerge before 1.5.2 allow remote attackers to inject arbitrar

Editors/LogViewerController.cs in Umbraco through 8.9.1 allows a user to visit a logviewer endpoint even if they lack Ap

HCL Notes is susceptible to a Buffer Overflow vulnerability in DXL due to improper validation of user input. A successfu

The elasticsearch-operator does not validate the namespace where kibana logging resource is created and due to that it i

A flaw memory leak in the Linux kernel performance monitoring subsystem was found in the way if using PERF_EVENT_IOC_SET

A flaw was found in the Linux kernel. A use-after-free was found in the way the console subsystem was using ioctls KDGKB

A flaw was found in samba's DNS server. An authenticated user could use this flaw to the RPC server to crash. This RPC s

software-properties was vulnerable to a person-in-the-middle attack due to incorrect TLS certificate validation in softw

OAuthenticator is an OAuth login mechanism for JupyterHub. In oauthenticator from version 0.12.0 and before 0.12.2, the

An improper access control information disclosure vulnerability in Trend Micro Apex One and OfficeScan XG SP1 could allo

An improper access control information disclosure vulnerability in Trend Micro Apex One and OfficeScan XG SP1 could allo

An improper access control information disclosure vulnerability in Trend Micro Apex One and OfficeScan XG SP1 could allo

An improper access control information disclosure vulnerability in Trend Micro Apex One and OfficeScan XG SP1 could allo

A heap-based buffer overflow privilege escalation vulnerability in Trend Micro ServerProtect for Linux 3.0 may allow an

An improper access control information disclosure vulnerability in Trend Micro Apex One and OfficeScan XG SP1 could allo

Cross-site Scripting (XSS) vulnerability in SolarWinds Web Help Desk 12.7.0 allows attacker to inject arbitrary web scri

ThinkAdmin version v1 v6 has a stored XSS vulnerability which allows remote attackers to inject an arbitrary web script

A CWE-79: Improper Neutralization of Input During Web Page Generation vulnerability exists in EcoStruxureª and SmartStru

HCL Domino is susceptible to a lockout policy bypass vulnerability in the ID Vault service. An unauthenticated attacker

containerd is an industry-standard container runtime and is available as a daemon for Linux and Windows. In containerd b

HCL Domino is susceptible to a lockout policy bypass vulnerability in the LDAP service. An unauthenticated attacker coul

HCL iNotes is susceptible to a sensitive cookie exposure vulnerability. This can allow an unauthenticated remote attacke

Affected versions of Automation for Jira - Server allowed remote attackers to read and render files as mustache template

HCL Domino is susceptible to a Login CSRF vulnerability. With a valid credential, an attacker could trick a user into ac

Tesla Model X vehicles before 2020-11-23 do not perform certificate validation during an attempt to pair a new key fob w

Tesla Model X vehicles before 2020-11-23 have key fobs that rely on five VIN digits for the authentication needed for a