2020

GitLab EE 11.0 and later through 12.7.2 allows XSS.

GitLab EE 8.0 through 12.7.2 has Insecure Permissions (issue 1 of 2).

IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to obtain sensitive information ca

GitLab EE 8.9 and later through 12.7.2 has Insecure Permission

In cloud-init through 19.4, rand_user_password in cloudinit/config/cc_set_passwords.py has a small default pwlen value,

cloud-init through 19.4 relies on Mersenne Twister for a random password, which makes it easier for attackers to predict

A CSRF vulnerability in the Tutor LMS plugin before 1.5.3 for WordPress can result in an attacker approving themselves a

Insufficient validation and sanitization of user input exists in url-parse npm package version 1.4.4 and earlier may all

A denial of service exists in strapi v3.0.0-beta.18.3 and earlier that can be abused in the admin console using admin ri

A missing check in Nextcloud Server 14.0.3 could give recipient the possibility to extend the expiration date of a share

A reflected Cross-Site Scripting vulnerability in Nextcloud Server 16.0.1 was discovered in the svg generation.

Improper authorization in Nextcloud server 17.0.0 causes leaking of previews and files when a file-drop share link is op

An authenticated server-side request forgery in Nextcloud server 16.0.1 allowed to detect local and remote services when

Improper preservation of permissions in Nextcloud Server 14.0.3 causes the event details to be leaked when sharing a non

A reflected XSS vulnerability has been discovered in the publicly accessible afr.php delivery script of Revive Adserver

Improper Input Validation in Nextcloud Server 15.0.7 allows group admins to create users with IDs of system folders.

Exposure of Private Information in Nextcloud Server 16.0.1 causes the server to send it's domain and user IDs to the Nex

Improper permissions preservation in Nextcloud Server 16.0.1 causes sharees to be able to reshare with write permissions

Improper neutralization of file names, conversation names and board names in Nextcloud Server 16.0.3, Nextcloud Talk 6.0

Missing escaping of HTML in the Updater of Nextcloud 15.0.5 allowed a reflected XSS when starting the updater from a mal

A missing check in Nextcloud Server 17.0.0 allowed an attacker to set up a new second factor when trying to login.

Dangling remote share attempts in Nextcloud 16 allow a DNS pollution when running long.

A wrong check for the system time in the Android App 3.9.0 causes a bypass of the lock protection when changing the time

Missing sanitization in the iOS App 2.24.4 causes an XSS when opening malicious HTML files.

A bug in Nextcloud Server 15.0.2 causes pending 2FA logins to not be correctly expired when the password of the user is

Violation of Secure Design Principles in the iOS App 2.23.0 causes the app to leak its login and token to other Nextclou

Improper authorization in the Circles app 0.17.7 causes retaining access when an email address was removed from a circle

A Cross-site Scripting (XSS) vulnerability exists in FortiManager 5.2.1 and earlier and 5.0.10 and earlier via an unspec

IBM Security Identity Manager 7.0.1 could allow a remote attacker to traverse directories on the system. An attacker cou

IBM Security Directory Server 6.4.0 stores sensitive information in URLs. This may lead to information disclosure if una

IBM Security Directory Server 6.4.0 does not perform an authentication check for a critical resource or functionality al

IBM Security Directory Server 6.4.0 is deployed with active debugging code that can create unintended entry points. IBM

IBM Security Directory Server 6.4.0 could allow a remote attacker to hijack the clicking action of the victim. By persua

IBM Security Identity Manager 6.0.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbi

PandoraFMS 742 suffers from multiple XSS vulnerabilities, affecting the Agent Management, Report Builder, and Graph Buil

D-Link DIR-100 4.03B07: cli.cgi XSS

webcalendar before 1.2.7 shows the reason for a failed login (e.g., "no such user").

Joomla! com_mailto 1.5.x through 1.5.13 has an automated mail timeout bypass.

SysJust Syuan-Gu-Da-Shih, versions before 20191223, contain vulnerability of Cross-Site Scripting(XSS), personal informa

Waitress version 1.4.2 allows a DOS attack When waitress receives a header that contains invalid characters. When a head

There is a potentially exploitable out of memory condition In Nanopb before 0.4.1, 0.3.9.5, and 0.2.9.4. When nanopb is

Auth0 Lock before 11.21.0 allows XSS when additionalSignUpFields is used with an untrusted placeholder.

Bromium client version 4.0.3.2060 and prior to 4.1.7 Update 1 has an out of bound read results in race condition causing

Brother MFC-9970CDW 1.10 firmware L devices contain a security bypass vulnerability which allows physically proximate at

Stored XSS in the Strong Testimonials plugin before 2.40.1 for WordPress can result in an attacker performing malicious

massCode 1.0.0-alpha.6 allows XSS via crafted Markdown text, with resultant remote code execution (because nodeIntegrati

The J-BusinessDirectory extension before 5.2.9 for Joomla! allows Reverse Tabnabbing. In some configurations, the link t

IBM StoredIQ 7.6.0.17 through 7.6.0.20 could disclose sensitive information to a local user due to data in certain direc

IBM SDK, Java Technology Edition Version 7.0.0.0 through 7.0.10.55, 7.1.0.0 through 7.1.4.55, and 8.0.0.0 through 8.0.6.

The Kubernetes kubectl cp command in versions 1.1-1.12, and versions prior to 1.13.11, 1.14.7, and 1.15.4 allows a combi