2020

Improper access control in Citrix XenMobile Server 10.12 before RP2, Citrix XenMobile Server 10.11 before RP4, Citrix Xe

Improper input validation in Citrix XenMobile Server 10.12 before RP1, Citrix XenMobile Server 10.11 before RP4, Citrix

The novish command-line interface, included in NoviFlow NoviWare before NW500.2.12 and deployed on NoviSwitch devices, i

FusionCompute 8.0.0 have a command injection vulnerability. The software does not sufficiently validate certain paramete

HUAWEI Mate 20 smartphones with 9.0.0.205(C00E205R2P1) have a logic error vulnerability. In a special scenario, the syst

All versions of package nis-utils are vulnerable to Prototype Pollution via the setValue function.

All versions of package templ8 are vulnerable to Prototype Pollution via the parse function.

An issue was discovered in DB Soft SGLAC before 20.05.001. The ProcedimientoGenerico method in the SVCManejador.svc webs

IBM Spectrum Virtualize 8.3.1 could allow a remote user authenticated via LDAP to escalate their privileges and perform

Reported in SOLR-14515 (private) and fixed in SOLR-14561 (public), released in Solr version 8.6.0. The Replication handl

php/qmn_options_questions_tab.php in the quiz-master-next plugin before 4.7.9 for WordPress allows CSRF, with resultant

SNMPTT before 1.4.2 allows attackers to execute shell code via EXEC, PREXEC, or unknown_trap_exec.

Lack of authentication in the network relays used in MEGVII Koala 2.9.1-c3s allows attackers to grant physical access to

A token-reuse vulnerability in ZKTeco FaceDepot 7B 1.0.213 and ZKBiosecurity Server 1.0.0_20190723 allows an attacker to

Lack of mutual authentication in ZKTeco FaceDepot 7B 1.0.213 and ZKBiosecurity Server 1.0.0_20190723 allows an attacker

In Nim 1.2.4, the standard library httpClient fails to properly validate the server response. For example, httpClient.ge

In Nim 1.2.4, the standard library httpClient is vulnerable to a CR-LF injection in the target URL. An injection is poss

In Nim 1.2.4, the standard library browsers mishandles the URL argument to browsers.openDefaultBrowser. This argument ca

In Textpattern 4.5.7, the password-reset feature does not securely tether a hash to a user account.

In Textpattern 4.5.7, an unprivileged author can change an article's markup setting.

A vulnerability related to Dynamic-link Library (“DLL”) loading in the Zoom Sharing Service would allow an attacker who

The resolveRepositoryPath function doesn't properly validate user input and a malicious user may traverse to any valid G

In Composer-Setup for Windows before version 6.0.0, if the developer's computer is shared with other users, a local atta

In openapi-python-client before version 0.5.3, clients generated with a maliciously crafted OpenAPI Document can generat

In openapi-python-client before version 0.5.3, there is a path traversal vulnerability. If a user generated a client usi

A vulnerability has been identified in Automation License Manager 5 (All versions), Automation License Manager 6 (All ve

Rapid Software LLC Rapid SCADA 5.8.0 is affected by a local privilege escalation vulnerability in the ScadaAgentSvc.exe

A File Upload Vulnerability in PNotes - Andrey Gruber PNotes.NET v3.8.1.2 allows a local attacker to execute arbitrary c

A vulnerability has been identified in SICAM WEB firmware for SICAM A8000 RTUs (All versions < V05.30). The login screen

A vulnerability has been identified in Desigo CC (V4.x), Desigo CC (V3.x), Desigo CC Compact (V4.x), Desigo CC Compact (

A Default Configuration vulnerability in FortiOS may allow an unauthenticated attacker on the same subnet to intercept s

FusionCompute 8.0.0 has an information disclosure vulnerability. Due to the properly protection of certain information,

FusionCompute 8.0.0 has an information disclosure vulnerability. Due to the properly protection of certain information,

madlib-object-utils before 0.1.7 is vulnerable to Prototype Pollution via setValue.

All versions of phpjs are vulnerable to Prototype Pollution via parse_str.

CMS Made Simple 2.2.14 allows Authenticated Arbitrary File Upload because the File Manager does not block .ptar files, a

ise smart connect KNX Vaillant 1.2.839 contain a Denial of Service.

Using a specially crafted URL command, a remote authenticated user can execute commands as root on the G-Cam and G-Code

A cross-site scripting (XSS) vulnerability in TinyMCE 5.2.1 and earlier allows remote attackers to inject arbitrary web

There is stored cross site scripting (XSS) in Galileo CMS v0.042. Remote authenticated users could inject arbitrary web

A Cross-site scripting (XSS) vulnerability in /inc/class-search.php in the Sell Media plugin v2.4.1 for WordPress allows

IBM Event Streams 10.0.0 could allow an authenticated user to perform tasks to a schema due to improper authentication v

ABBYY network license server in ABBYY FineReader 15 before Release 4 (aka 15.0.112.2130) allows escalation of privileges

An Uncontrolled Search Path Element (CWE-427) vulnerability in SmartControl version 4.3.15 and versions released before

njs through 0.4.3, used in NGINX, allows control-flow hijack in njs_value_property in njs_value.c. NOTE: the vendor cons

njs through 0.4.3, used in NGINX, has an out-of-bounds read in njs_json_stringify_iterator in njs_json.c.

njs through 0.4.3, used in NGINX, has an out-of-bounds read in njs_lvlhsh_level_find in njs_lvlhsh.c.

njs through 0.4.3, used in NGINX, has a use-after-free in njs_json_parse_iterator_call in njs_json.c.

JerryScript through 2.3.0 allows stack consumption via function a(){new new Proxy(a,{})}JSON.parse("[]",a). NOTE: the ve

JerryScript through 2.3.0 has a (function({a=arguments}){const arguments}) buffer over-read.