2020

An issue was discovered in Yubico libykpiv before 2.1.0. An attacker can trigger an incorrect free() in the ykpiv_util_g

An issue was discovered in Yubico libykpiv before 2.1.0. lib/util.c in this library (which is included in yubico-piv-too

In Eclipse Jetty, versions 9.4.27.v20200227 to 9.4.29.v20200521, in case of too large response headers, Jetty throws an

In Redgate SQL Monitor 7.1.4 through 10.1.6 (inclusive), the scope for disabling some TLS security certificate checks ca

An out-of-bounds read vulnerability was found in the SLiRP networking implementation of the QEMU emulator. This flaw occ

An issue was discovered in Mods for HESK 3.1.0 through 2019.1.0. A privileged user can achieve code execution on the ser

An issue was discovered in Mods for HESK 3.1.0 through 2019.1.0. A blind time-based SQL injection issue allows remote un

An issue was discovered in Mods for HESK 3.1.0 through 2019.1.0. A Stored XSS issue allows remote unauthenticated attack

Mozilla developers and community members reported memory safety bugs present in Firefox 77. Some of these bugs showed ev

Due to confusion processing a hyphen character in Date.parse(), a one-byte out of bounds read could have occurred, leadi

When the Windows DLL "webauthn.dll" was missing from the Operating System, and a malicious one was placed in a folder in

In non-standard configurations, a JPEG image created by JavaScript could have caused an internal variable to overflow, r

When performing add-on updates, certificate chains terminating in non-built-in-roots were rejected (even if they were le

When trying to connect to a STUN server, a race condition could have caused a use-after-free of a pointer, leading to me

When processing callbacks that occurred during window flushing in the parent process, the associated window may die; cau

Manipulating individual parts of a URL object could have caused an out-of-bounds read, leaking process memory to malicio

Due to confusion about ValueTags on JavaScript Objects, an object may pass through the type barrier, resulting in memory

A VideoStreamEncoder may have been freed in a race condition with VideoBroadcaster::AddOrUpdateSink, resulting in a use-

When "%2F" was present in a manifest URL, Firefox's AppCache behavior may have become confused and allowed a manifest to

IndexedDB should be cleared when leaving private browsing mode and it is not, the API for WKWebViewConfiguration was bei

By navigating a tab using the history API, an attacker could cause the address bar to display the incorrect domain (with

Mozilla developers reported memory safety bugs present in Firefox 76. Some of these bugs showed evidence of memory corru

Mozilla developers reported memory safety bugs present in Firefox 76 and Firefox ESR 68.8. Some of these bugs showed evi

When using certain blank characters in a URL, they where incorrectly rendered as spaces instead of an encoded URL. This

When browsing a document hosted on an IP address, an attacker could insert certain characters to flip domain and path in

Mozilla Developer Nicolas Silva found that when using WebRender, Firefox would under certain conditions leak arbitrary G

Mozilla Developer Iain Ireland discovered a missing type check during unboxed objects removal, resulting in a crash. We

When browsing a malicious page, a race condition in our SharedWorkerService could occur and lead to a potentially exploi

For native-to-JS bridging the app requires a unique token to be passed that ensures non-app code can't call the bridging

During RSA key generation, bignum implementations used a variation of the Binary Extended Euclidean Algorithm which enta

NSS has shown timing differences when performing DSA signatures, which was exploitable and could eventually leak private

If Thunderbird is configured to use STARTTLS for an IMAP server, and the server sends a PREAUTH response, then Thunderbi

Incorrect handling of Upgrade header with the value websocket leads in crashing of containers hosting sockjs apps. This

PKCE support is not implemented in accordance with the RFC for OAuth 2.0 for Native Apps. Without the use of PKCE, the a

In FreeBSD 12.1-STABLE before r362281, 11.4-STABLE before r362281, and 11.4-RELEASE before p1, long values in the user-c

In FreeBSD 12.1-STABLE before r359565, 12.1-RELEASE before p7, 11.4-STABLE before r362975, 11.4-RELEASE before p1, and 1

Dell EMC iDRAC9 versions prior to 4.20.20.20 contain a Path Traversal Vulnerability. A remote authenticated malicious us

When constructing a permission prompt for WebRTC, a URI was supplied from the content process. This URI was untrusted, a

An integer overflow vulnerability in the Skia library when allocating memory for edge builders on some systems with at l

D-Link DIR-610 devices allow Remote Command Execution via the cmd parameter to command.php. NOTE: This vulnerability onl

D-Link DIR-610 devices allow Information Disclosure via SERVICES=DEVICE.ACCOUNT%0AAUTHORIZED_GROUP=1 to getcfg.php. NOTE

Android App 'Mercari' (Japan version) prior to version 3.52.0 allows arbitrary method execution of a Java object by a re

NVIDIA JetPack SDK, version 4.2 and 4.3, contains a vulnerability in its installation scripts in which permissions are i

An issue was discovered in phpList through 3.5.4. An XSS vulnerability occurs within the Import Administrators section v

An issue was discovered in phpList through 3.5.4. An error-based SQL Injection vulnerability exists via the Import Admin

An OS Command Injection vulnerability in the PAN-OS GlobalProtect portal allows an unauthenticated network based attacke

An integer underflow vulnerability in the dnsproxyd component of the PAN-OS management interface allows authenticated ad

An OS Command Injection vulnerability in the PAN-OS management interface that allows authenticated administrators to exe

Certain communication between PAN-OS and cloud-delivered services inadvertently use TLS 1.0, which is known to be a cryp

The SIP module of some Huawei products have a denial of service (DoS) vulnerability. A remote attacker could exploit the