2020

Pivotal Ops Manager, versions 2.4.x prior to 2.4.27, 2.5.x prior to 2.5.24, 2.6.x prior to 2.6.16, and 2.7.x prior to 2.

Snare for Linux before 1.7.0 has CSRF in the web interface.

Koala Framework before 2011-11-21 has XSS via the request_uri parameter.

After a HelloRetryRequest has been sent, the client may negotiate a lower protocol that TLS 1.3, resulting in an invalid

When pasting a <style> tag from the clipboard into a rich text editor, the CSS sanitizer does not escape < and

During the initialization of a new content process, a race condition occurs that can allow a content process to disclose

If an XML file is served with a Content Security Policy and the XML file includes an XSL stylesheet, the Content Securit

When in Private Browsing Mode on Windows 10, the Windows keyboard may retain word suggestions to improve the accuracy of

When pasting a <style> tag from the clipboard into a rich text editor, the CSS sanitizer incorrectly rewrites a @n

If upgrade-insecure-requests was specified in the Content Security Policy, and a link was dragged and dropped from that

A Content-Security-Policy that blocks in-line scripts could be bypassed using an object tag to execute JavaScript in the

GNU LibreDWG 0.9.3.2564 has an invalid pointer dereference in dwg_dynapi_entity_value in dynapi.c (dynapi.c is generated

GNU LibreDWG 0.9.3.2564 has a NULL pointer dereference in get_next_owned_entity in dwg.c.

GNU LibreDWG 0.9.3.2564 has an attempted excessive memory allocation in read_sections_map in decode_r2007.c.

An object tag with a data URI did not correctly inherit the document's Content Security Policy. This allowed a CSP bypas

A compromised content process could send a message to the parent process that would cause the 'Click to Play' permission

BigProf Online Invoicing System (OIS) through 2.6 has XSS that can be leveraged for session hijacking. An attacker can e

Failure to correctly handle null bytes when processing HTML entities resulted in Firefox incorrectly parsing these entit

If two same-origin documents set document.domain differently to become cross-origin, it was possible for them to call ar

By using a form with a data URI it was possible to gain access to the privileged JSONView object that had been cloned in

In LowEnergyClient::MtuChangedCallback of low_energy_client.cc, there is a possible out of bounds read due to a race con

In flattenString8 of Sensor.cpp, there is a possible information disclosure of heap memory due to uninitialized data. Th

In rw_i93_send_cmd_write_single_block of rw_i93.cc, there is a possible information disclosure of heap memory due to uni

In generateCrop of WallpaperManagerService.java, there is a possible sysui crash due to image exceeding maximum texture

In onCreate of InstallStart.java, there is a possible package validation bypass due to a time-of-check time-of-use vulne

A Denial of Service vulnerability exists in Symantec Norton Mobile Security for Android prior to 3.16, which could let a

An Information Disclosure vulnerability exists in the Google Pixel/Pixel SL Qualcomm Avtimer Driver due to a NULL pointe

An Information Disclosure vulnerability exists in the mid.dat file stored on the SD card in Symantec Norton Mobile Secur

An XSS issue was discovered in Ignite Realtime Openfire 4.4.4 via isTrustStore to Manage Store Contents.

An XSS issue was discovered in Ignite Realtime Openfire 4.4.4 via search to the Users/Group search page.

An XSS issue was discovered in Ignite Realtime Openfire 4.4.4 via cacheName to SystemCacheDetails.jsp.

An XSS issue was discovered in Ignite Realtime Openfire 4.4.4 via alias to Manage Store Contents.

A Cross-Site Scripting (XSS) vulnerability exists in the ITMS workflow process manager console in Symantec IT Management

In calc_vm_may_flags of ashmem.c, there is a possible arbitrary write to shared memory due to a permissions bypass. This

A Denial of Service vulnerability exists in the ITMS workflow process manager login window in Symantec IT Management Sui

It was found that keycloak before version 8.0.0 exposes internal adapter endpoints in org.keycloak.constants.AdapterCons

A Denial of Service vulnerability exists in Google Android 4.4.4, 5.0.2, and 5.1.1, which allows malicious users to bloc

Pearson eSIS (Enterprise Student Information System) message board has stored XSS due to improper validation of user inp

The WikibaseMediaInfo extension 1.35 for MediaWiki allows XSS because of improper template syntax within the PropertySug

An Information Disclosure vulnerability exists in NTP 4.2.7p25 private (mode 6/7) messages via a GET_RESTRICT control me

This vulnerability allows remote attackers redirect users to an external resource on affected installations of Tencent W

A DOM based XSS vulnerability has been identified on the WatchGuard XMT515 through 12.1.3, allowing a remote attacker to

An attacker could specially craft an FTP request that could crash the PR100088 Modbus gateway versions prior to release

Codoforum 4.8.3 allows XSS in the user registration page: via the username field to the index.php?u=/user/register URI.

In the Titan M handling of cryptographic operations, there is a possible information disclosure due to an unusual root c

An information exposure vulnerability in the external authentication profile form of FortiSIEM 5.2.2 and earlier may all

An improper neutralization of input during web page generation in FortiAuthenticator WEB UI 6.0.0 may allow an unauthent

A vulnerability was found in Moodle versions 3.7.x before 3.7.3, 3.6.x before 3.6.7 and 3.5.x before 3.5.9. When a cohor

OpenShift Container Platform 4 does not sanitize secret data written to static pod logs when the log level in a given op

AultWare pwStore 2010.8.30.0 has XSS