2020

The parse_report() function in whoopsie.c in Whoopsie through 0.2.69 mishandles memory allocation failures, which allows

PlayerGeneric.cpp in MilkyTracker through 1.02.00 has a use-after-free in the PlayerGeneric destructor.

In all versions of the package jspdf, it is possible to use <<script>script> in order to go over the filtering regex.

All affected versions <2.0.0 of package jspdf are vulnerable to Cross-site Scripting (XSS). It is possible to inject Jav

An issue was discovered in Roundcube Webmail before 1.2.11, 1.3.x before 1.3.14, and 1.4.x before 1.4.7. It allows XSS v

SolarWinds Serv-U FTP server before 15.2.1 does not validate an argument path.

SolarWinds Serv-U FTP server before 15.2.1 mishandles the CHMOD command.

SolarWinds Serv-U FTP server before 15.2.1 allows remote command execution.

We-com OpenData CMS 2.0 allows SQL Injection via the username field on the administrator login page.

SQL injection can occur in We-com Municipality portal CMS 2.1.x via the cerca/ keywords field.

XSS can occur in We-com Municipality portal CMS 2.1.x via the cerca/ search bar.

An issue was discovered in the Vanguard plugin 2.1 for WordPress. XSS can occur via the mails/new title field, a product

An issue was discovered in the bestsoftinc Hotel Booking System Pro plugin through 1.1 for WordPress. Persistent XSS can

An issue was discovered in the bestsoftinc Car Rental System plugin through 1.3 for WordPress. Persistent XSS can occur

In Wireshark 3.2.0 to 3.2.4, the GVCP dissector could go into an infinite loop. This was addressed in epan/dissectors/pa

An issue was discovered in Valve Steam Client 2.10.91.91. The installer allows local users to gain NT AUTHORITY\SYSTEM p

An issue was discovered in GOG Galaxy Client 2.0.17. Local escalation of privileges is possible when a user installs a g

An issue was discovered in GOG Galaxy Client 2.0.17. Local escalation of privileges is possible when a user starts or un

In Python 3.6 through 3.6.10, 3.7 through 3.7.8, 3.8 through 3.8.4rc1, and 3.9 through 3.9.0b4 on Windows, a Trojan hors

Exposure of Sensitive Information in McAfee Network Security Management (NSM) prior to 10.1.7.7 allows local users to ga

The Micro Air Vehicle Link (MAVLink) protocol presents no authentication mechanism on its version 1.0 (nor authorization

This vulnerability applies to the Micro Air Vehicle Link (MAVLink) protocol and allows a remote attacker to gain access

Privilege Escalation vulnerability in McAfee Total Protection (MTP) before 16.0.R26 allows local users to create and edi

Privilege Escalation vulnerability in McAfee Total Protection (MTP) before 16.0.R26 allows local users to delete files t

Privilege Escalation vulnerability in McAfee Total Protection (MTP) prior to 16.0.R26 allows local users to delete files

VeeamFSR.sys in Veeam Availability Suite before 10 and Veeam Backup & Replication before 10 has no device object DACL, w

The file upload feature in Atlassian Jira Server and Data Center in affected versions allows remote attackers to inject

This issue exists to document that a security improvement in the way that Jira Server and Data Center use velocity templ

Affected versions of Atlassian Jira Server and Data Center allow remote attackers to execute arbitrary code via a DLL hi

Affected versions of Atlassian Jira Server and Data Center allow remote attackers to prevent users from accessing the in

In QEMU 4.2.0, a MemoryRegionOps object may lack read/write callback methods, leading to a NULL pointer dereference.

We have recently released new version of UniFi Protect firmware v1.13.3 and v1.14.10 for Unifi Cloud Key Gen2 Plus and U

A denial of service vulnerability exists in Rails <6.0.3.2 that allowed an untrusted user to run any pending migrations

Improper access control in Nextcloud Deck 1.0.0 allowed an attacker to inject tasks into other users decks.

A cross-site scripting vulnerability exists in koa-shopify-auth v3.1.61-v3.1.62 that allows an attacker to inject JS pay

A CSRF forgery vulnerability exists in rails < 5.2.5, rails < 6.0.4 that makes it possible for an attacker to, given a g

The is a code injection vulnerability in versions of Rails prior to 5.0.1 that wouldallow an attacker who controlled the

A directory traversal vulnerability exists in rack < 2.2.0 that allows an attacker perform directory traversal vulnerabi

In PrestaShop from version 1.5.0.0 and before version 1.7.6.6, the authentication system is malformed and an attacker is

In October from version 1.0.319 and before version 1.0.467, pasting content copied from malicious websites into the Froa

TenderMint from version 0.33.0 and before version 0.33.6 allows block proposers to include signatures for the wrong bloc

In PrestaShop from version 1.7.0.0 and before version 1.7.6.6, if a target sends a corrupted file, it leads to a reflect

In PrestaShop from version 1.6.0.1 and before version 1.7.6.6, the dashboard allows rewriting all configuration variable

In PrestaShop from version 1.5.0.0 and before 1.7.6.6, there is information exposure in the upload directory. The proble

In PrestaShop from version 1.7.4.0 and before version 1.7.6.6, some files should not be in the release archive, and othe

In PrestaShop from version 1.5.0.0 and before version 1.7.6.6, there is improper access control in Carrier page, Module

In PrestaShop from version 1.5.3.0 and before version 1.7.6.6, there is a stored XSS when using the name of a quick acce

The CodePeople Payment Form for PayPal Pro plugin before 1.1.65 for WordPress allows SQL Injection.

An XSS vulnerability exists in the Webmail component of Zimbra Collaboration Suite before 8.8.15 Patch 11. It allows an

Traefik 2.x, in certain configurations, allows HTTPS sessions to proceed without mutual TLS verification in a situation