2020

The Software AG Terracotta Server OSS Docker image 5.4.1 contains a blank password for the root user. Systems deployed u

The Appbase streams Docker image 2.1.2 contains a blank password for the root user. Systems deployed using affected vers

The official sonarqube docker images before alpine (Alpine specific) contain a blank password for a root user. System us

The Docker Docs Docker image through 2020-12-14 contains a blank password for the root user. Systems deployed using affe

The Blackfire Docker image through 2020-12-14 contains a blank password for the root user. Systems deployed using affect

Version 1.3.0 of the Weave Cloud Agent Docker image contains a blank password for the root user. Systems deployed using

Version 1.0.0 of the Instana Dynamic APM Docker image contains a blank password for the root user. Systems deployed usin

Version 3.16.0 of the CoScale agent Docker image contains a blank password for the root user. Systems deployed using aff

An issue was discovered in the Keysight Database Connector plugin before 1.5.0 for Confluence. A malicious user could by

An issue was discovered in the Keysight Database Connector plugin before 1.5.0 for Confluence. A malicious user could in

Icinga 2 v2.8.0 through v2.11.7 and v2.12.2 has an issue where revoked certificates due for renewal will automatically b

SolarWinds Database Performance Analyzer (DPA) 11.1.468 and 12.0.3074 have several persistent XSS vulnerabilities, relat

Multiple cross-site scripting (XSS) vulnerabilities exist in PHPJabbers Appointment Scheduler 2.3, in the index.php admi

jsonparser 1.0.0 allows attackers to cause a denial of service (panic: runtime error: slice bounds out of range) via a G

GJSON before 1.6.4 allows attackers to cause a denial of service via crafted JSON.

A Remote Code Execution vulnerability exists in DourceCodester Alumni Management System 1.0. An authenticated attacker c

Pega Platform through 8.4.x is affected by Cross Site Scripting (XSS) via the ConnectionID parameter, as demonstrated by

An issue was discovered on D-Link DSR-250 3.17 devices. Certain functionality in the Unified Services Router web interfa

An issue was discovered on D-Link DSR-250 3.17 devices. Insufficient validation of configuration file checksums could al

A lack of input validation and access controls in Lua CGIs on D-Link DSR VPN routers may result in arbitrary input being

The length of the input fields of Host Engineering H0-ECOM100, H2-ECOM100, and H4-ECOM100 modules are verified only on t

A flaw was found in Keycloak before 13.0.0 where an external identity provider, after successful authentication, redirec

A flaw was found in Keycloak before 13.0.0, where it is possible to force the server to call out an unverified URL using

An issue was discovered in Xen XAPI before 2020-12-15. Certain xenstore keys provide feedback from the guest, and are th

An issue was discovered in Xen through 4.14.x. Nodes in xenstore have an ownership. In oxenstored, a owner could give a

An issue was discovered in Xen 4.6 through 4.14.x. When acting upon a guest XS_RESET_WATCHES request, not all tracking i

An issue was discovered in Xen through 4.14.x. When a Xenstore watch fires, the xenstore client that registered the watc

An issue was discovered in Xen through 4.14.x. Xenstored and guests communicate via a shared memory page using a specifi

An issue was discovered in Xen through 4.14.x. A guest may access xenstore paths via absolute paths containing a full pa

An issue was discovered in Xen through 4.14.x. Access rights of Xenstore nodes are per domid. Unfortunately, existing gr

An issue was discovered in Xen through 4.14.x. Neither xenstore implementation does any permission checks when reporting

An issue was discovered in Xen through 4.14.x. In the Ocaml xenstored implementation, the internal representation of the

The REST API component of TIBCO Software Inc.'s TIBCO PartnerExpress contains a vulnerability that theoretically allows

An issue was discovered in Xen through 4.14.x. A bounds check common to most operation time functions specific to FIFO e

An issue was discovered in Xen through 4.14.x. Recording of the per-vCPU control block mapping maintained by Xen and tha

An issue was discovered in the Linux kernel through 5.10.1, as used with Xen through 4.14.x. The Linux kernel PV block b

An issue was discovered in Xen through 4.14.x. Some OSes (such as Linux, FreeBSD, and NetBSD) are processing watch event

An issue was discovered in Xen 4.14.x. When moving IRQs between CPUs to distribute the load of IRQ handling, IRQ vectors

An issue was discovered in Xen through 4.14.x. When they require assistance from the device model, x86 HVM guests must b

A flaw was found in the way RTAS handled memory accesses in userspace to kernel communication. On a locked down (usually

Product: AndroidVersions: Android kernelAndroid ID: A-127973231References: Upstream kernel

In the l2tp subsystem, there is a possible use after free due to a race condition. This could lead to local escalation o

In xfrm6_tunnel_free_spi of net/ipv6/xfrm6_tunnel.c, there is a possible use after free due to improper locking. This co

In getGpuStatsGlobalInfo and getGpuStatsAppInfo of GpuService.cpp, there is a possible permission bypass due to a missin

In SELinux policies of mls, there is a missing permission check. This could lead to local information disclosure of pack

In isSubmittable and showWarningMessagesIfAppropriate of WifiConfigController.java and WifiConfigController2.java, there

In onFactoryReset of BluetoothManagerService.java, there is a missing permission check. This could lead to local escalat

In broadcastWifiCredentialChanged of ClientModeImpl.java, there is a possible location permission bypass due to a missin

In getLockTaskLaunchMode of ActivityRecord.java, there is a possible way for any app to start in Lock Task Mode due to a

In NFA_RwI93WriteMultipleBlocks of nfa_rw_api.cc, there is a possible out of bounds write due to an integer overflow. Th