2020

An improper access control vulnerability in FortiMail admin webUI 6.2.0, 6.0.0 to 6.0.6, 5.4.10 and below may allow admi

Freeciv before 2.3.3 allows remote attackers to cause a denial of service via a crafted packet.

A vulnerability was found in the Undertow HTTP server in versions before 2.0.28.SP1 when listening on HTTPS. An attacker

A Symbolic Link (Symlink) Following vulnerability in the packaging of munge in SUSE Linux Enterprise Server 15; openSUSE

Server-side request forgery (SSRF) vulnerability in feed-proxy.php in extjs 5.0.0.

In JFrog Artifactory 5.x and 6.x, insecure FreeMarker template processing leads to remote code execution, e.g., by modif

FastTrack Admin By Request 6.1.0.0 supports group policies that are supposed to allow only a select range of users to el

FastTrack Admin By Request 6.1.0.0 supports group policies that are supposed to allow only a select range of users to el

Splunk 5.0.3 has an Unquoted Service Path in Windows for Universal Forwarder which can allow an attacker to escalate pri

PrestaShop 1.5.5 allows remote authenticated attackers to execute arbitrary code by uploading a crafted profile and then

BabyGekko before 1.2.4 has SQL injection.

Toshiba ConfigFree 8.0.38 has a CF7 File Remote Command Execution Vulnerability

mIRC before 6.35 allows attackers to cause a denial of service (crash) via a long nickname.

UNIX Symbolic Link (Symlink) Following vulnerability in the trousers package of SUSE Linux Enterprise Server 15 SP1; ope

SSRF in AjaxRestrictedCmdStat in zap in Ruckus Wireless Unleashed through 200.7.10.102.64 allows a remote denial of serv

A double-free is present in libyang before v1.0-r1 in the function yyparse() when an organization field is not terminate

A double-free is present in libyang before v1.0-r3 in the function yyparse() when a type statement in used in a notifica

A double-free is present in libyang before v1.0-r1 in the function yyparse() when an empty description is used. Applicat

Directory Traversal in ruckus_cli2 in Ruckus Wireless Unleashed through 200.7.10.102.64 allows a remote attacker to jail

Waitress through version 1.3.1 allows request smuggling by sending the Content-Length header twice. Waitress would heade

WebKitGTK+ before 2.14.0: A use-after-free vulnerability can allow remote attackers to cause a DoS

An issue exists in Vanilla Forums before 2.0.17.9 due to the way cookies are handled.

Cross-Site Request Forgery (CSRF) vulnerability exists in panel.php in UseBB before 1.0.12.

A File Inclusion vulnerability exists in act parameter to admin.php in UseBB before 1.0.12.

A Cross-site Request Forgery (CSRF) vulnerability exists in Advanced Electron Forums (AEF) through 1.0.9 due to inadequa

A CWE-427:Uncontrolled Search Path Element vulnerability exists in MSX Configurator (Software Version prior to V1.0.8.1)

Samsung Galaxy Gear series before build RE2 includes the hcidump utility with no privilege or permission restriction. Th

The wnoti system service in Samsung Galaxy Gear series allows an unprivileged process to take over the internal notifica

The system-popup system service in Tizen allows an unprivileged process to perform popup-related system actions, due to

The Enlightenment system service in Tizen allows an unprivileged process to fully control or capture windows, due to imp

The PulseAudio system service in Tizen allows an unprivileged process to control its A2DP MediaEndpoint, due to improper

The pkgmgr system service in Tizen allows an unprivileged process to perform package management actions, due to improper

xmlStringLenDecodeEntities in parser.c in libxml2 2.9.10 has an infinite loop in a certain end-of-file situation.

xmlSchemaPreRun in xmlschemas.c in libxml2 2.9.10 allows an xmlSchemaValidateStream memory leak.

repodata_schema2id in repodata.c in libsolv before 0.7.6 has a heap-based buffer over-read via a last schema whose lengt

There is an integer overflow vulnerability in LDAP server of some Huawei products. Due to insufficient input validation,

There is an integer overflow vulnerability in LDAP client of some Huawei products. Due to insufficient input validation,

MultiTech Conduit MTCDT-LVW2-24XX 1.4.17-ocea-13592 devices allow remote authenticated administrators to execute arbitra

Trustwave ModSecurity 3.0.0 through 3.0.3 allows an attacker to send crafted requests that may, when sent quickly in lar

storeBackup.pl in storeBackup through 3.5 relies on the /tmp/storeBackup.lock pathname, which allows symlink attacks tha

A vulnerability in WhatsApp Desktop versions prior to 0.3.9309 when paired with WhatsApp for iPhone versions prior to 2.

Grin through 2.1.1 has Insufficient Validation.

The Meinberg SyncBox/PTP/PTPv2 devices have default SSH keys which allow attackers to get root access to the devices. Al

The marketo-forms-and-tracking plugin through 1.0.2 for WordPress allows wp-admin/admin.php?page=marketo_fat CSRF with r

The update process in Xmind 3.4.1 and earlier allow remote attackers to execute arbitrary code via a man-in-the-middle a

log.c in Squid Analysis Report Generator (sarg) through 2.3.11 allows local privilege escalation. By default, it uses a

Parallels 13 uses cleartext HTTP as part of the update process, allowing man-in-the-middle attacks. Users of out-of-date

tftp.c in libslirp 4.1.0, as used in QEMU 4.2.0, does not prevent ..\ directory traversal on Windows.

A vulnerability was discovered in all quay-2 versions before quay-3.0.0, in the Quay web GUI where POST requests include

An Arbitrary File Upload issue in the file browser of DIMO YellowBox CRM before 6.3.4 allows a standard authenticated us