2020

Tenda AC18 Router through V15.03.05.05_EN and through V15.03.05.19(6318) CN devices could cause a remote code execution

The package bestzip before 2.1.7 are vulnerable to Command Injection via the options param.

An issue was discovered in Noise-Java through 2020-08-27. AESGCMOnCtrCipherState.encryptWithAd() allows out-of-bounds ac

An issue was discovered in Noise-Java through 2020-08-27. AESGCMFallbackCipherState.encryptWithAd() allows out-of-bounds

An issue was discovered in Noise-Java through 2020-08-27. ChaChaPolyCipherState.encryptWithAd() allows out-of-bounds acc

A vulnerability in Cisco Jabber for Windows could allow an authenticated, remote attacker to execute arbitrary code. The

A type confusion vulnerability when resolving properties of JavaScript objects with specially-crafted prototype chains i

In NASM 2.15.04rc3, there is a double-free vulnerability in pp_tokline asm/preproc.c. This is fixed in commit 8806c3ca00

Heybbs v1.2 has a SQL injection vulnerability in login.php file via the username parameter which may allow a remote atta

Heybbs v1.2 has a SQL injection vulnerability in msg.php file via the ID parameter which may allow a remote attacker to

Heybbs v1.2 has a SQL injection vulnerability in user.php file via the ID parameter which may allow a remote attacker to

A user controlled parameter used in video call in WhatsApp for Android prior to v2.20.17, WhatsApp Business for Android

A security feature bypass issue in WhatsApp Desktop versions prior to v0.3.4932 could have allowed for sandbox escape in

A SQL injection vulnerability in login in Sourcecodetester Daily Tracker System 1.0 allows unauthenticated user to execu

Use of a hard-coded cryptographic key in Pancake versions < 4.13.29 allows an attacker to forge session cookies, which m

eramba c2.8.1 and Enterprise before e2.19.3 has a weak password recovery token (createHash has only a million possibilit

IBM Spectrum Protect Operations Center 7.1.0.000 through 7.1.10 and 8.1.0.000 through 8.1.9 may allow an attacker to exe

ForLogic Qualiex v1 and v3 has weak token expiration. This allows remote unauthenticated privilege escalation and access

Because of unauthenticated password changes in ForLogic Qualiex v1 and v3, customer and admin permissions and data can b

Rebar3 versions 3.0.0-beta.3 to 3.13.2 are vulnerable to OS command injection via URL parameter of dependency specificat

Zyxel VMG5313-B30B router on firmware 5.13(ABCJ.6)b3_1127, and possibly older versions of firmware are affected by insec

A ZTE product is impacted by the cryptographic issues vulnerability. The encryption algorithm is not properly used, so r

A memory corruption vulnerability exists in the TIFF handle_COMPRESSION_PACKBITS functionality of Accusoft ImageGear 19.

A remote code execution vulnerability exists in the install functionality of OS4Ed openSIS 7.4. The username variable wh

A remote code execution vulnerability exists in the install functionality of OS4Ed openSIS 7.4. The password variable wh

A remote code execution vulnerability exists in the Modules.php functionality of OS4Ed openSIS 7.3. A specially crafted

SQL injection vulnerability exists in the password reset functionality of OS4Ed openSIS 7.3. The password_stf_email para

SQL injection vulnerability exists in the password reset functionality of OS4Ed openSIS 7.3. The username_stf_email para

SQL injection vulnerability exists in the password reset functionality of OS4Ed openSIS 7.3. The uname parameter in the

SQL injection vulnerability exists in the password reset functionality of OS4Ed openSIS 7.3. The password_stf_email para

MAGMI versions prior to 0.7.24 are vulnerable to a remote authentication bypass due to allowing default credentials in t

USVN (aka User-friendly SVN) before 1.0.10 allows attackers to execute arbitrary code in the commit view.

The affected product is vulnerable to reflected cross-site scripting, which may allow an attacker to remotely execute ar

The affected product is vulnerable to stored cross-site scripting, which may allow an attacker to remotely execute arbit

The affected product is vulnerable due to an undocumented interface found on the device, which may allow an attacker to

An exploitable SQL injection vulnerability exists in the login functionality of OS4Ed openSIS 7.3. A specially crafted H

There is a vulnerability in Paginator (Elixir/Hex package) which makes it susceptible to Remote Code Execution (RCE) att

All versions of package gedi are vulnerable to Prototype Pollution via the set function.

All versions of package safe-object2 are vulnerable to Prototype Pollution via the setter function.

All versions of package worksmith are vulnerable to Prototype Pollution via the setValue function.

All versions of package tiny-conf are vulnerable to Prototype Pollution via the set function.

All versions of package promisehelpers are vulnerable to Prototype Pollution via the insert function.

All versions of package nodee-utils are vulnerable to Prototype Pollution via the deepSet function.

All versions of package node-oojs are vulnerable to Prototype Pollution via the setPath function.

The package node-forge before 0.10.0 is vulnerable to Prototype Pollution via the util.setPath function. Note: Version 0

Versions of package locutus before 2.0.12 are vulnerable to prototype Pollution via the php.strings.parse_str function.

All versions of package gammautils are vulnerable to Prototype Pollution via the deepSet and deepMerge functions.

All versions of package dot-notes are vulnerable to Prototype Pollution via the create function.

All versions of package deeps are vulnerable to Prototype Pollution via the set function.

All versions of package deep-get-set are vulnerable to Prototype Pollution via the main function.