2020

An issue was discovered in Selesta Visual Access Manager (VAM) 4.15.0 through 4.29. An attacker without authentication i

Improper neutralization of directives in dynamically evaluated code in Druva inSync Mac OS Client 6.5.0 allows a local,

VDSM and libvirt in Red Hat Enterprise Virtualization Hypervisor (aka RHEV-H) 7-7.x before 7-7.2-20151119.0 and 6-6.x be

An issue was discovered in the pricing-table-by-supsystic plugin before 1.8.2 for WordPress. It allows CSRF.

An issue was discovered in Gurux GXDLMS Director through 8.5.1905.1301. When downloading OBIS codes, it does not verify

Gurux GXDLMS Director prior to 8.5.1905.1301 downloads updates to add-ins and OBIS code over an unencrypted HTTP connect

Improper neutralization of special elements used in an OS command in Druva inSync Windows Client 6.5.0 allows a local, u

LiteCart through 2.2.1 allows CSV injection via a customer's profile.

An issue was discovered in the Linux kernel 3.16 through 5.5.6. set_fdc in drivers/block/floppy.c leads to a wait_til_re

An exploitable authentication bypass vulnerability exists in the hostname processing of the Moxa AWK-3131A firmware vers

An exploitable improper access control vulnerability exists in the iw_webs account settings functionality of the Moxa AW

An exploitable remote code execution vulnerability exists in the iw_webs configuration parsing functionality of the Moxa

An exploitable denial-of-service vulnerability exists in ServiceAgent functionality of the Moxa AWK-3131A, firmware vers

An exploitable format string vulnerability exists in the iw_console conio_writestr functionality of the Moxa AWK-3131A f

An exploitable command injection vulnerability exists in the hostname functionality of the Moxa AWK-3131A firmware versi

An exploitable command injection vulnerability exists in the iw_webs functionality of the Moxa AWK-3131A firmware versio

An exploitable command injection vulnerability exists in the iwwebs functionality of the Moxa AWK-3131A firmware version

An exploitable use of hard-coded credentials vulnerability exists in multiple iw_* utilities of the Moxa AWK-3131A firmw

The usage of hard-coded cryptographic keys within the ServiceAgent binary allows for the decryption of captured traffic

An exploitable privilege escalation vulnerability exists in the iw_console functionality of the Moxa AWK-3131A firmware

IBM Qradar Advisor 1.1 through 2.5 with Watson uses weaker than expected cryptographic algorithms that could allow an at

An issue was discovered in the CardGate Payments plugin through 3.1.15 for WooCommerce. Lack of origin authentication in

An issue was discovered in the CardGate Payments plugin through 2.0.30 for Magento 2. Lack of origin authentication in t

A NULL Pointer Dereference exists in libzint in Zint 2.7.1 because multiple + characters are mishandled in add_on in upc

controllers/admin.js in Total.js CMS 13 allows remote attackers to execute arbitrary code via a POST to the /admin/api/w

Kylin has some restful apis which will concatenate SQLs with the user input string, a user is likely to be able to run m

Sympa 6.2.38 through 6.2.52 allows remote attackers to cause a denial of service (disk consumption from temporary files,

Dropwizard-Validation before 1.3.19, and 2.0.2 may allow arbitrary code execution on the host system, with the privilege

In BuddyPress before 5.1.2, requests to a certain REST API endpoint can result in private user data getting exposed. Aut

compile-sass prior to 1.0.5 allows execution of arbritary commands. The function "setupCleanupOnExit(cssPath)" within "d

Hash collision attack vulnerability in Jenkins before 1.447, Jenkins LTS before 1.424.2, and Jenkins Enterprise by Cloud

An issue was discovered in Pure-FTPd 1.0.49. An out-of-bounds (OOB) read has been detected in the pure_strcmp function i

The Sophos AV parsing engine before 2020-01-14 allows virus-detection bypass via a crafted ZIP archive. This affects End

The Quick Heal AV parsing engine (November 2019) allows virus-detection bypass via a crafted GPFLAG in a ZIP archive. Th

Arbitrary filesystem write vulnerability in Yarn before 1.22.0 allows attackers to write to any path on the filesystem a

DNN (formerly DotNetNuke) through 9.4.4 allows Path Traversal (issue 2 of 2).

In MIELE XGW 3000 ZigBee Gateway before 2.4.0, a malicious website visited by an authenticated admin user or a malicious

add_password in pam_radius_auth.c in pam_radius 1.4.0 does not correctly check the length of the input password, and is

In Zsh before 5.8, attackers able to execute commands can regain privileges dropped by the --no-PRIVILEGED option. Zsh f

An issue was discovered in Centreon Web through 19.04.3. When a user changes his password on his profile page, the conta

Remote Code Execution vulnerability in the web interface in McAfee Web Advisor (WA) 8.0.34745 and earlier allows remote

An issue was discovered in SmartClient 12.0. The Remote Procedure Call (RPC) saveFile provided by the console functional

An issue was discovered in SmartClient 12.0. The Remote Procedure Call (RPC) loadFile provided by the console functional

CandidATS 2.1.0 is vulnerable to CSRF that allows for an administrator account to be added via the index.php?m=settings&

fauzantrif eLection 2.0 has SQL Injection via the admin/ajax/op_kandidat.php id parameter.

graph_realtime.php in Cacti 1.2.8 allows remote attackers to execute arbitrary OS commands via shell metacharacters in a

This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DAP-26

This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DAP-13

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Samsung Galaxy S10 Fir

Certain Xerox WorkCentre printers before 073.xxx.000.02300 do not require the user to reenter or validate LDAP bind cred