2020

Given an installed malicious file picker application, an attacker was able to steal and upload local files of their choo

Using object or embed tags, it was possible to frame other websites, even if they disallowed framing using the X-Frame-O

A Content Provider in Firefox for Android allowed local files accessible by the browser to be read by a remote webpage,

Mibew Messenger before 3.2.7 allows XSS via a crafted user name.

Firmware developed by Shenzhen Hichip Vision Technology (V6 through V20), as used by many different vendors in millions

Firmware developed by Shenzhen Hichip Vision Technology (V6 through V20), as used by many different vendors in millions

Firmware developed by Shenzhen Hichip Vision Technology (V6 through V20, after 2018-08-09 through 2020), as used by many

CS2 Network P2P through 3.x, as used in millions of Internet of Things devices, suffers from an information exposure fla

CS2 Network P2P through 3.x, as used in millions of Internet of Things devices, suffers from an authentication flaw that

A memory leak in the OCUtil.dll library used by Nextcloud Desktop Client 2.6.4 can lead to a DoS against the host system

A code injection in Nextcloud Desktop Client 2.6.4 allowed to load arbitrary code when placing a malicious OpenSSL confi

An SQL injection vulnerability exists in the frappe.desk.reportview.get functionality of ERPNext 11.1.38. A specially cr

An exploitable code execution vulnerability exists in the file system checking functionality of fsck.f2fs 1.12.0. A spec

For GitLab Runner before 13.0.12, 13.1.6, 13.2.3, by replacing dockerd with a malicious server, the Shared Runner is sus

In GitLab before 13.0.12, 13.1.6 and 13.2.3, access grants were not revoked when a user revoked access to an application

In GitLab before 13.0.12, 13.1.6 and 13.2.3 using a branch with a hexadecimal name could override an existing hash.

In GitLab before 13.0.12, 13.1.6 and 13.2.3, it is possible to bypass E-mail verification which is required for OAuth Fl

IBM Jazz Reporting Service 7.0 and 7.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed

IBM Jazz Reporting Service 6.0.2, 6.0.6, 6.0.6.1, 7.0, and 7.0.1 is vulnerable to cross-site scripting. This vulnerabili

IBM Jazz Reporting Service 6.0.6, 6.0.6.1, and 7.0 is vulnerable to cross-site scripting. This vulnerability allows user

Combodo iTop contains a cross-site request forgery (CSRF) vulnerability, attackers can execute specific commands via mal

A security misconfiguration exists in Combodo iTop, which can expose sensitive information.

Combodo iTop contains a stored Cross-site Scripting vulnerability, which can be attacked by uploading file with maliciou

Combodo iTop does not validate inputted parameters, attackers can inject malicious commands and launch XSS attack.

A function in Combodo iTop contains a vulnerability of Broken Access Control, which allows unauthorized attacker to inje

flatCore before 1.5.7 allows upload and execution of a .php file by an admin.

flatCore before 1.5.7 allows XSS by an admin via the acp/acp.php?tn=pages&sub=edit&editpage=1 page_linkname, page_title,

Prometheus Blackbox Exporter through 0.17.0 allows /probe?target= SSRF. NOTE: follow-on discussion suggests that this mi

JetBrains TeamCity before 2019.2.3 is vulnerable to reflected XSS in the administration UI.

JetBrains TeamCity before 2019.2.3 is vulnerable to stored XSS in the administration UI.

In JetBrains TeamCity before 2019.2.3, password parameters could be disclosed via build logs.

In JetBrains TeamCity before 2020.1.1, project parameter values can be retrieved by a user without appropriate permissio

In JetBrains ToolBox version 1.17 before 1.17.6856, the set of signature verifications omitted the jetbrains-toolbox.exe

In JetBrains TeamCity before 2020.1, users are able to assign more permissions than they have.

In JetBrains TeamCity before 2020.1, users with the Modify Group permission can elevate other users' privileges.

In JetBrains Kotlin from 1.4-M1 to 1.4-RC (as Kotlin 1.3.7x is not affected by the issue. Fixed version is 1.4.0) there

JetBrains YouTrack before 2020.2.8873 is vulnerable to SSRF in the Workflow component.

In JetBrains YouTrack before 2020.2.6881, a user without permission is able to create an article draft.

In JetBrains YouTrack before 2020.2.6881, the markdown parser could disclose hidden file existence.

JetBrains YouTrack before 2020.2.10643 was vulnerable to SSRF that allowed scanning internal ports.

In JetBrains YouTrack before 2020.2.8527, the subtasks workflow could disclose issue existence.

In JetBrains YouTrack before 2020.1.1331, an external user could execute commands against arbitrary issues.

In JetBrains Upsource before 2020.1, information disclosure is possible because of an incorrect user matching algorithm.

DIGITUS DA-70254 4-Port Gigabit Network Hub 2.073.000.E0008 devices allow an attacker on the same network to denial-of-s

DIGITUS DA-70254 4-Port Gigabit Network Hub 2.073.000.E0008 devices allow an attacker on the same network to conduct per

DIGITUS DA-70254 4-Port Gigabit Network Hub 2.073.000.E0008 devices allow an attacker on the same network to bypass auth

DIGITUS DA-70254 4-Port Gigabit Network Hub 2.073.000.E0008 devices allow an attacker on the same network to elevate pri

Lindy 42633 4-Port USB 2.0 Gigabit Network Server 2.078.000 devices allow an attacker on the same network to denial-of-s

Lindy 42633 4-Port USB 2.0 Gigabit Network Server 2.078.000 devices allow an attacker on the same network to conduct per

Lindy 42633 4-Port USB 2.0 Gigabit Network Server 2.078.000 devices allow an attacker on the same network to bypass auth