2020

The Chrome Plugin for Rapid7 AppSpider can incorrectly keep browser sessions active after recording a macro, even after

It has been reported that cross-site scripting (XSS) is possible in Forcepoint Web Security, version 8.x, via host heade

A Cross-site Scripting (XSS) vulnerability exists in the Serendipity freetag plugin before 3.30 in the tagcloud paramete

Multiple Cross-site Scripting (XSS) vulnerabilities exist in Joomla! through 1.7.0 in index.php in the search word, exte

The Calculated Fields Form plugin through 1.0.353 for WordPress suffers from multiple Stored XSS vulnerabilities present

The wemail_consumer_service (from the built-in application wemail) in Samsung Galaxy Gear series allows an unprivileged

The SoundServer/FocusServer system services in Tizen allow an unprivileged process to perform media-related system actio

The bt/bt_core system service in Tizen allows an unprivileged process to create a system user interface and control the

The BlueZ system service in Tizen allows an unprivileged process to partially control Bluetooth or acquire sensitive inf

An issue was discovered in Simple Machines Forum (SMF) before 2.0.16. Reverse tabnabbing can occur because of use of _bl

In postfix-mta-sts-resolver before 0.5.1, All users can receive incorrect response from daemon under rare conditions, re

Lifesize Express ls ex2_4.7.10 2000 (14) devices allow XSS via the interface/interface.php brand parameter.

Honor V30 smartphones with versions earlier than 10.0.1.135(C00E130R4P1) have an improper authentication vulnerability.

HUAWEI Mate 20 smart phones with versions earlier than 10.0.0.175(C00E70R3P8) have an insufficient authentication vulner

Jama Connect 8.44.0 is vulnerable to stored Cross-Site Scripting

Cacti through 1.2.7 is affected by a graphs.php?template_id= SQL injection vulnerability affecting how template identifi

apt-cacher-ng through 3.3 allows local users to obtain sensitive information by hijacking the hardcoded TCP port. The /u

There is a use-after-free issue in all samba 4.9.x versions before 4.9.18, all samba 4.10.x versions before 4.10.12 and

All samba versions 4.9.x before 4.9.18, 4.10.x before 4.10.12 and 4.11.x before 4.11.5 have an issue where if it is set

There is an issue in all samba 4.11.x versions before 4.11.5, all samba 4.10.x versions before 4.10.12 and all samba 4.9

CarbonFTP v1.4 uses insecure proprietary password encryption with a hard-coded weak encryption key. The key for local FT

Path Traversal in the file browser of DIMO YellowBox CRM before 6.3.4 allows a standard authenticated user to browse the

mIRC prior to 7.22 has a message leak because chopping of outbound messages is mishandled.

Sonoff TH 10 and 16 devices with firmware 6.6.0.21 allows XSS via the Friendly Name 1 field (after a successful login wi

Jara 1.6 has an XSS vulnerability

Mozilla Firefox prior to 3.6 has a DoS vulnerability due to an issue in the validation of certificates.

Improper initialization of local variables which are parameters to sfs api may cause invalid pointer dereference and lea

The conversation-watson plugin before 0.8.21 for WordPress has a DOM-based XSS vulnerability that is executed when a cha

SMC D3G0804W 3.5.2.5-LAT_GA devices allow XSS via the SSID field on the WiFi Network Configuration page (after a success

Gentoo Portage through 2.3.84 allows local users to place a Trojan horse plugin in the /usr/lib64/nagios/plugins directo

An issue was discovered in Gallagher Command Centre 7.x before 7.90.991(MR5), 8.00 before 8.00.1161(MR5), and 8.10 befor

TestLink before 1.9.20 allows XSS via non-lowercase javascript: in the index.php reqURI parameter. NOTE: this issue exis

UHP UHP-100 3.4.1.15, 3.4.2.4, and 3.4.3 devices allow XSS via cw2?td= (Site Name field of the Site Setup section).

UHP UHP-100 3.4.1.15, 3.4.2.4, and 3.4.3 devices allow XSS via cB3?ta= (profile title).

Ruckus ZoneFlex R310 104.0.0.0.1347 devices allow Stored XSS via the SSID field on the Configuration > Radio 2.4G > Wire

Evoko Home 1.31 devices provide different error messages for failed login requests depending on whether the username is

Westermo MRD-315 1.7.3 and 1.7.4 devices have an information disclosure vulnerability that allows an authenticated remot

An issue was discovered in Amcrest Web Server 2.520.AC00.18.R 2017-06-29 WEB 3.2.1.453504. The login page responds with

An arbitrary code execution vulnerability exists in the Trend Micro Security 2019 (v15) consumer family of products whic

A RootCA vulnerability found in Trend Micro Password Manager for Windows and macOS exists where the localhost.key of Roo

A memory usage vulnerability exists in Trend Micro Password Manager 3.8 that could allow an attacker with access and per

The chained-quiz plugin 1.1.8.1 for WordPress has reflected XSS via the wp-admin/admin-ajax.php total_questions paramete

Spring Framework, versions 5.2.x prior to 5.2.3 are vulnerable to CSRF attacks through CORS preflight requests that targ

It was found that the Red Hat Enterprise Linux 8 kpatch update did not include the complete fix for CVE-2018-12207. A fl

V6.0.10P2T2 and V6.0.10P2T5 of F6x2W product are impacted by Information leak vulnerability. Unauthorized users could lo

VMware Workspace ONE SDK and dependent mobile application updates address sensitive information disclosure vulnerability

A Stored Client Side Template Injection (CSTI) with Angular was discovered in the SolarWinds Orion Platform 2019.2 HF1 i

A Reflected Client Side Template Injection (CSTI) with Angular was discovered in the SolarWinds Orion Platform 2019.2 HF

Improper permissions in Intel(R) DAAL before version 2020 Gold may allow an authenticated user to potentially enable inf

Insufficient control flow in certain data structures for some Intel(R) Processors with Intel(R) Processor Graphics may a