2020

It was discovered that snapctl user-open allowed altering the $XDG_DATA_DIRS environment variable when calling the syste

cloud-init as managed by snapd on Ubuntu Core 16 and Ubuntu Core 18 devices was run without restrictions on every boot,

TeamViewer Desktop for Windows before 15.8.3 does not properly quote its custom URI handlers. A malicious website could

The Kubernetes ingress-nginx component prior to version 0.28.0 allows a user with the ability to create namespaces and t

The dlf (aka Kitodo.Presentation) extension before 3.1.2 for TYPO3 allows XSS.

IBM Planning Analytics Local 2.0.0 through 2.0.9.1 is vulnerable to cross-site scripting. This vulnerability allows user

IBM Planning Analytics Local 2.0.0 through 2.0.9.1 could allow a remote attacker to hijack the clicking action of the vi

IBM Tivoli Key Lifecycle Manager does not require that users should have strong passwords by default, which makes it eas

IBM Tivoli Key Lifecycle Manager 3.0.1 and 4.0 could disclose sensitive information due to responding to unauthenticated

IBM Tivoli Key Lifecycle Manager 3.0.1 and 4.0 could allow a remote attacker to obtain sensitive information when a deta

IBM Tivoli Key Lifecycle Manager 3.0.1 and 4.0 uses a protection mechanism that relies on the existence or values of an

IBM Tivoli Key Lifecycle Manager 3.0.1 and 4.0 uses an inadequate account lockout setting that could allow a remote atta

IBM Maximo Asset Management 7.6.0.1 and 7.6.0.2 is vulnerable to an XML External Entity Injection (XXE) attack when proc

Passwords are stored in plain text within the configuration of SICK Package Analytics software up to and including V04.1

SICK Package Analytics software up to and including version V04.0.0 are vulnerable due to incorrect default permissions

SICK Package Analytics software up to and including version V04.0.0 are vulnerable to an authentication bypass by direct

OpenClinic GA 5.09.02 and 5.89.05b does not properly verify uploaded files, which may allow a low-privilege user to uplo

OpenClinic GA 5.09.02 contains a hidden default user account that may be accessed if an administrator has not expressly

An attacker may bypass permission/authorization checks in OpenClinic GA 5.09.02 and 5.89.05b by ignoring the redirect of

Magento versions 2.3.5-p1 and earlier, and 2.3.5-p1 and earlier have a security mitigation bypass vulnerability. Success

Magento versions 2.3.5-p1 and earlier, and 2.3.5-p1 and earlier have a dom-based cross-site scripting vulnerability. Suc

Magento versions 2.3.5-p1 and earlier, and 2.3.5-p1 and earlier have an observable timing discrepancy vulnerability. Suc

Magento versions 2.3.5-p1 and earlier, and 2.3.5-p1 and earlier have a path traversal vulnerability. Successful exploita

This affects the package Gerapy from 0 and before 0.9.3. The input being passed to Popen, via the project_configure endp

This affects all versions of package mock2easy. a malicious user could inject commands through the _data variable: Affec

A low-privilege user may use SQL syntax to write arbitrary files to the OpenClinic GA 5.09.02 and 5.89.05b server, which

OpenClinic GA 5.09.02 and 5.89.05b does not properly neutralize user-controllable input, which may allow the execution o

OpenClinic GA 5.09.02 and 5.89.05b includes arbitrary local files specified within its parameter and executes some files

OpenClinic GA 5.09.02 and 5.89.05b stores passwords using inadequate hashing complexity, which may allow an attacker to

Directory traversal vulnerability in KonaWiki 3.1.0 and earlier allows remote attackers to read arbitrary files via unsp

Cross-site scripting vulnerability in KonaWiki 3.1.0 and earlier allows remote attackers to execute an arbitrary script

Cross-site scripting vulnerability in KonaWiki 2.2.0 and earlier allows remote attackers to execute an arbitrary script

An exploitable denial of service vulnerability exists in the freeDiameter functionality of freeDiameter 1.3.2. A special

In Shopware before 6.2.3, the database password is leaked to an unauthenticated user when a DriverException occurs and v

In Shopware before 6.2.3, authenticated users are allowed to use the Mediabrowser fileupload feature to upload SVG image

Shopware before 6.2.3 is vulnerable to a Server-Side Request Forgery (SSRF) in its "Mediabrowser upload by URL" feature.

Concrete5 before 8.5.3 allows Unrestricted Upload of File with Dangerous Type such as a .phar file.

NCP Secure Enterprise Client before 10.15 r47589 allows a symbolic link attack on enumusb.reg via Support Assistant.

Gambio GX before 4.0.1.0 allows XSS in admin/coupon_admin.php.

Gambio GX before 4.0.1.0 allows admin/admin.php CSRF.

Gambio GX before 4.0.1.0 allows SQL Injection in admin/mobile.php.

Gambio GX before 4.0.1.0 allows SQL Injection in admin/gv_mail.php.

In imap_scan_tree_recursive in Claws Mail through 3.17.6, a malicious IMAP server can trigger stack consumption because

Dell EMC OpenManage Server Administrator (OMSA) versions 9.4 and prior contain multiple path traversal vulnerabilities.

Grin 3.0.0 before 4.0.0 has insufficient validation of data related to Mimblewimble.

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Veeam ONE 10.0

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Veeam ONE 10.0

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R670

This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R6700

This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of NETG