2020

Lightning Network Daemon (lnd) before 0.7 allows attackers to trigger loss of funds because of Incorrect Access Control.

c-lightning before 0.7.1 allows attackers to trigger loss of funds because of Incorrect Access Control. NOTE: README.md

A vulnerability exists in the Aruba AirWave Management Platform 8.x prior to 8.2 in the management interface of an under

Buffer overflow in Media Player Classic - Home Cinema (MPC-HC) before 1.7.0 allows remote attackers to execute arbitrary

Stack-based buffer overflow in Media Player Classic - Home Cinema (MPC-HC) before 1.7.0.7858 allows remote attackers to

The Batch::BatchRun module 1.03 for Perl does not properly handle temporary files.

Parallel::ForkManager module before 1.0.0 for Perl does not properly handle temporary files.

ABRT might allow attackers to obtain sensitive information from crash reports.

IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to a denial of service, caused by sending a specia

Evernote prior to 5.5.1 has insecure password change

Remote Authentication Bypass in Senior Rubiweb 6.2.34.28 and 6.2.34.37 allows admin access to sensitive information of a

NetApp OnCommand System Manager 2.1 and earlier allows remote attackers to inject arbitrary commands in the Halt/Reboot

In JetBrains IntelliJ IDEA 2019.2, an XSLT debugger plugin misconfiguration allows arbitrary file read operations over t

HashiCorp Consul and Consul Enterprise up to 1.6.2 HTTP/RPC services allowed unbounded resource usage, and were suscepti

HashiCorp Nomad and Nonad Enterprise up to 0.10.2 HTTP/RPC services allowed unbounded resource usage, and were susceptib

A user who owns an ENS domain can set a trapdoor, allowing them to transfer ownership to another user, and later regain

In Kronos Web Time and Attendance (webTA) 3.8.x and later 3.x versions before 4.0, the com.threeis.webta.H491delegate se

In Kronos Web Time and Attendance (webTA) 3.8.x and later 3.x versions before 4.0, the com.threeis.webta.H402editUser se

In Opencast before 7.6 and 8.1, using a remember-me cookie with an arbitrary username can cause Opencast to assume prope

Opencast before 8.1 and 7.6 allows almost arbitrary identifiers for media packages and elements to be used. This can be

Trend Micro Anti-Threat Toolkit (ATTK) versions 1.62.0.1218 and below have a vulnerability that may allow an attacker to

node-uuid before 1.4.4 uses insufficiently random data to create a GUID, which could make it easier for attackers to hav

The System Management Mode (SMM) implementation in Dell Latitude E6430 BIOS Revision A09, HP EliteBook 850 G1 BIOS revis

Opencast before 8.1 stores passwords using the rather outdated and cryptographically insecure MD5 hash algorithm. Furthe

Opencast before 8.1 and 7.6 allows unauthorized public access to all media and metadata by default via OAI-PMH. OAI-PMH

A vulnerability in the web UI of Cisco Small Business Switches could allow an unauthenticated, remote attacker to cause

In JetBrains TeamCity before 2019.1.5, some server-stored passwords could be shown via the web UI.

In JetBrains Rider versions 2019.3 EAP2 through 2019.3 EAP7, there were unsigned binaries provided by the Windows instal

Ports listened to by JetBrains IntelliJ IDEA before 2019.3 were exposed to the network.

In JetBrains IntelliJ IDEA before 2019.3, some Maven repositories were accessed via HTTP instead of HTTPS.

A command execution issue was found in Apache SpamAssassin prior to 3.4.3. Carefully crafted nefarious Configuration (.c

A command execution issue was found in Apache SpamAssassin prior to 3.4.3. Carefully crafted nefarious rule configuratio

Verax NMS prior to 2.1.0 uses an encryption key that is hardcoded in a JAR archive.

ERDAS ER Viewer 13.0 has dwmapi.dll and irml.dll libraries arbitrary code execution vulnerabilities

NextGEN Gallery Plugin for WordPress 1.9.10 and 1.9.11 has a Path Disclosure Vulnerability

In OSSEC-HIDS 2.7 through 3.5.0, the server component responsible for log analysis (ossec-analysisd) is vulnerable to a

Ruckus ZoneFlex R500 104.0.0.0.1347 devices allow an authenticated attacker to execute arbitrary OS commands via the hid

NetApp OnCommand System Manager 2.1 and earlier allows remote attackers to include arbitrary files through specially cra

Magento versions 2.3.3 and earlier, 2.2.10 and earlier, 1.14.4.3 and earlier, and 1.9.4.3 and earlier have an sql inject

Adobe Illustrator CC versions 24.0 and earlier have a memory corruption vulnerability. Successful exploitation could lea

Adobe Illustrator CC versions 24.0 and earlier have a memory corruption vulnerability. Successful exploitation could lea

Adobe Illustrator CC versions 24.0 and earlier have a memory corruption vulnerability. Successful exploitation could lea

Adobe Illustrator CC versions 24.0 and earlier have a memory corruption vulnerability. Successful exploitation could lea

Adobe Illustrator CC versions 24.0 and earlier have a memory corruption vulnerability. Successful exploitation could lea

An Access vulnerability exists in FOSCAM IP Camera FI8620 due to insufficient access restrictions in the /tmpfs/ and /lo

A Security Bypass vulnerability exists in TP-LINK IP Cameras TL-SC 3130, TL-SC 3130G, 3171G, 4171G, and 3130 1.6.18P12 d

In Sudo before 1.8.26, if pwfeedback is enabled in /etc/sudoers, users can trigger a stack-based buffer overflow in the

A Security Bypass vulnerability exists in Zavio IP Cameras through 1.6.3 because the RTSP protocol authentication is dis

IKTeam BearFTP before 0.2.0 allows remote attackers to achieve denial of service via a large volume of connections to th

An Authentication Bypass vulnerability exists in the web interface in Zavio IP Cameras through 1.6.03 due to a hardcoded