2020

content/content.blueprintsevents.php in Symphony CMS 3.0.0 allows XSS via fields['name'] to appendSubheading.

The WinRing0.sys and WinRing0x64.sys drivers 1.2.0 in EVGA Precision X1 through 1.0.6 allow local users, including low i

A function in the Teradici PCoIP Standard Agent for Windows and Graphics Agent for Windows prior to version 20.04.1 does

The support bundler in Teradici PCoIP Standard Agent for Windows and Graphics Agent for Windows versions prior to 20.04.

The Management Interface of the Teradici Cloud Access Connector and Cloud Access Connector Legacy for releases prior to

The Management Interface of the Teradici Cloud Access Connector and Cloud Access Connector Legacy for releases prior to

The web server in the Teradici Managament console versions 20.04 and 20.01.1 did not properly set the X-Frame-Options HT

Turcom TRCwifiZone through 2020-08-10 allows authentication bypass by visiting manage/control.php and ignoring 302 Redir

Telegram Desktop through 2.1.13 allows a spoofed file type to bypass the Dangerous File Type Execution protection mechan

Firejail through 0.9.62 mishandles shell metacharacters during use of the --output or --output-stderr option, which may

Firejail through 0.9.62 does not honor the -- end-of-options indicator after the --output option, which may lead to comm

In QEMU through 5.0.0, an assertion failure can occur in the network packet processing. This issue affects the e1000e an

SOPlanning 1.46.01 allows persistent XSS via the Project Name, Statutes Comment, Places Comment, or Resources Comment fi

SABnzbd 2.3.9 and 3.0.0Alpha2 has a command injection vulnerability in the web configuration interface that permits an a

An elevation of privilege vulnerability exists in ManageEngine ADSelfService Plus before build 6003 because it does not

A high severity vulnerability was found in all active versions of Red Hat CloudForms before 5.11.7.0. The out of band OS

An information disclosure vulnerability was found in Red Hat Quay in versions before 3.3.1. This flaw allows an attacker

Red Hat CloudForms 4.7 and 5 was vulnerable to Server-Side Request Forgery (SSRF) flaw. With the access to add Ansible T

Red Hat CloudForms 4.7 and 5 is affected by CSV Injection flaw, a crafted payload stays dormant till a victim export as

Red Hat CloudForms before 5.11.7.0 was vulnerable to the User Impersonation authorization flaw which allows malicious at

Red Hat CloudForms 4.7 and 5 is affected by a role-based privilege escalation flaw. An attacker with EVM-Operator group

Red Hat CloudForms 4.7 and 5 leads to insecure direct object references (IDOR) and functional level access control bypas

In Red Hat CloudForms 4.7 and 5, the read only widgets can be edited by inspecting the forms and dropping the disabled a

A cross-site scripting flaw was found in Report Menu feature of Red Hat CloudForms 4.7 and 5. An attacker could use this

IBM QRadar 7.2.0 thorugh 7.2.9 could allow an authenticated user to overwrite or delete arbitrary files due to a flaw af

IBM QRadar 7.2.0 through 7.2.9 could allow an authenticated user to disable the Wincollect service which could aid an at

FusionSphere OpenStack 8.0.0 have a protection mechanism failure vulnerability. The product incorrectly uses a protectio

A cross-site scripting (XSS) vulnerability in the Permissions component in SAINT Security Suite 8.0 through 9.8.20 could

An SQL injection vulnerability in the Analytics component of SAINT Security Suite 8.0 through 9.8.20 allows a remote, au

An SQL injection vulnerability in the Assets component of SAINT Security Suite 8.0 through 9.8.20 allows a remote, authe

A cross-site scripting (XSS) vulnerability in the Credential Manager component in SAINT Security Suite 8.0 through 9.8.2

In MyBB before version 1.8.24, the custom MyCode (BBCode) for the visual editor doesn't escape input properly when rende

HUAWEI P30 versions Versions earlier than 10.1.0.160(C00E160R2P11);HUAWEI P30 Pro versions Versions earlier than 10.1.0.

HUAWEI Mate 30 with versions earlier than 10.1.0.150(C00E136R5P3) have a denial of service vulnerability. The system doe

FusionCompute 8.0.0 have local privilege escalation vulnerability. A local, authenticated attacker could perform specifi

TinyMCE before 4.9.7 and 5.x before 5.1.4 allows XSS in the core parser, the paste plugin, and the visualchars plugin by

jpv (aka Json Pattern Validator) before 2.2.2 does not properly validate input, as demonstrated by a corrupted array.

ECDSA/EC/Point.pm in Crypt::Perl before 0.33 does not properly consider timing attacks against the EC point multiplicati

A rogue webpage could override the injected WKUserScript used by the download feature, this exploit could result in the

A rogue webpage could override the injected WKUserScript used by the logins autofill, this exploit could result in leaki

Mozilla developers and community members reported memory safety bugs present in Firefox 78 and Firefox ESR 78.0. Some of

The code for downloading files did not properly take care of special characters, which led to an attacker being able to

Firefox could be made to load attacker-supplied DLL files from the installation directory. This required an attacker tha

JIT optimizations involving the Javascript arguments object could confuse later optimizations. This risk was already mit

A redirected HTTP request which is observed or modified through a web extension could bypass existing CORS checks, leadi

When in an endless loop, a website specifying a custom cursor using CSS could make it look like the user is interacting

An iframe sandbox element with the allow-popups flag could be bypassed when using noopener links. This could have led to

By observing the stack trace for JavaScript errors in web workers, it was possible to leak the result of a cross-origin

A unicode RTL order character in the downloaded file name can be used to change the file's name during the download UI f

Given an installed malicious file picker application, an attacker was able to overwrite local files and thus overwrite F