2020

SchedMD Slurm before 18.08.9 and 19.x before 19.05.5 executes srun --uid with incorrect privileges.

The CTHthemes CityBook before 2.3.4, TownHub before 1.0.6, and EasyBook before 1.2.2 themes for WordPress allow nsecure

In Avast Premium Security 19.8.2393, attackers can send a specially crafted request to the local web server run by Avast

WordPress Advanced Access Manager Plugin before 2.8.2 has an Arbitrary File Overwrite Vulnerability

ManageEngine EventLog Analyzer version 7 through 9.9 build 9002 has a Credentials Disclosure Vulnerability. Fixed versio

Zoho ManageEngine EventLog Analyzer versions 7 through 9.9 build 9002 have a database Information Disclosure Vulnerabili

Grand MA 300 allows retrieval of the access PIN from sniffed data.

libmysofa 0.9.1 has a stack-based buffer overflow in readDataVar in hdf/dataobject.c during the reading of a header mess

OpenJPEG through 2.3.1 has a heap-based buffer overflow in opj_t1_clbl_decode_processor in openjp2/t1.c because of lack

Use after free in audio in Google Chrome prior to 79.0.3945.117 allowed a remote attacker to potentially exploit heap co

An issue was discovered in ManageEngine Applications Manager 14 with Build 14360. Integrated PostgreSQL which is built-i

Use after free in media picker in Google Chrome prior to 79.0.3945.88 allowed a remote attacker who had compromised the

Citrix XenApp Online Plug-in for Windows 12.1 and earlier, and Citrix Receiver for Windows 3.2 and earlier could allow r

TotalAV 2020 4.14.31 has a quarantine flaw that allows privilege escalation. Exploitation uses an NTFS directory junctio

Ricoh SP C250DN 1.06 devices have Incorrect Access Control (issue 2 of 2).

Ricoh SP C250DN 1.06 devices allow CSRF.

Ricoh SP C250DN 1.06 devices have Incorrect Access Control (issue 1 of 2).

An invalid pointer vulnerability in IOCTL Handling in the kyrld.sys driver in Kyrol Internet Security 9.0.6.9 allows an

Chamilo before 1.8.8.6 does not adequately handle user supplied input by the index.php script, which could allow remote

In Arial Campaign Enterprise before 11.0.551, multiple pages are accessible without authentication or authorization.

Arial Campaign Enterprise before 11.0.551 stores passwords in clear text and these may be retrieved.

Arial Campaign Enterprise before 11.0.551 has unauthorized access to the User-Edit.asp page, which allows remote attacke

IBM QRadar SIEM 7.3.0 through 7.3.3 uses weak credential storage in some instances which could be decrypted by a local a

Status2k allows Remote Command Execution in admin/options/editpl.php.

SpagoBI before 4.1 has Privilege Escalation via an error in the AdapterHTTP script

DOMPDF before 0.6.2 allows remote code execution, a related issue to CVE-2014-2383.

contentHostProperties.php in Rasilient PixelStor 5000 K:4.0.1580-20150629 (KDI Version) allows authenticated attackers t

LTSP LDM through 2.18.06 allows fat-client root access because the LDM_USERNAME variable may have an empty value if the

In phpMyAdmin 4 before 4.9.4 and 5 before 5.0.1, SQL injection exists in the user accounts page. A malicious user could

KeePass 2.4.1 allows CSV injection in the title field of a CSV export.

uploadimage.php in Employee Records System 1.0 allows upload and execution of arbitrary PHP code because file-extension

SOPlanning 1.45 has SQL injection via the user_list.php "by" parameter.

Samsung Kies before 2.5.0.12094_27_11 has registry modification.

Samsung Kies before 2.5.0.12094_27_11 has arbitrary directory modification.

Samsung Kies before 2.5.0.12094_27_11 has arbitrary file modification.

Samsung Kies before 2.5.0.12094_27_11 contains a NULL pointer dereference vulnerability which could allow remote attacke

Gateway Geomatics MapServer for Windows before 3.0.6 contains a Local File Include Vulnerability which allows remote att

fwknop before 2.0.3 allow remote authenticated users to cause a denial of service (server crash) or possibly execute arb

The (1) my_popenv_impl and (2) my_spawnv functions in src/condor_utils/my_popen.cpp and the (3) systemCommand function i

PHP code injection in TinyWebGallery before 1.8.8 allows remote authenticated users with admin privileges to inject arbi

The error function in Error.cc in poppler before 0.21.4 allows remote attackers to execute arbitrary commands via a PDF

A flaw in the WordPress plugin, Minimal Coming Soon & Maintenance Mode through 2.10, allows authenticated users with bas

HP DeskJet 3630 All-in-One Printers models F5S43A - F5S57A, K4T93A - K4T99C, K4U00B - K4U03B, and V3F21A - V3F22A (firmw

A Privilege Escalation vulnerability exists in Symantec Norton Antivirus, Norton AntiVirus with Backup, Norton Security,

A flaw in the WordPress plugin, Minimal Coming Soon & Maintenance Mode through 2.10, allows a CSRF attack to enable main

Apache Olingo versions 4.0.0 to 4.7.0 provide the AsyncRequestWrapperImpl class which reads a URL from the Location head

Certain HP DeskJet 3630 All-in-One Printers models F5S43A - F5S57A, K4T93A - K4T99C, K4U00B - K4U03B, and V3F21A - V3F22

Billion Smart Energy Router SG600R2 Firmware v3.02.rc6 allows an authenticated attacker to gain root execution privilege

An exposed Telnet Service on the Billion Smart Energy Router SG600R2 with firmware v3.02.rc6 allows a local network atta

netflow_get_stats in functions_netflow.php in Pandora FMS 7.0NG allows remote authenticated users to execute arbitrary O