2020

All versions of package confucious are vulnerable to Prototype Pollution via the set function.

All versions of package arr-flatten-unflatten are vulnerable to Prototype Pollution via the constructor.

NETGEAR R8300 devices before 1.0.2.134 are affected by command injection by an unauthenticated attacker.

An issue was discovered on LG mobile devices with Android OS 9 and 10 software. LGTelephonyProvider allows a bypass of i

An issue was discovered on LG mobile devices with Android OS 9 and 10 software on the VZW network. lge_property allows p

An issue was discovered on LG mobile devices with Android OS 8.0, 8.1, 9, and 10 software. The network_management servic

An issue was discovered on LG mobile devices with Android OS 10 software. MDMService does not properly restrict APK inst

An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) software. The persona service allows

An issue was discovered on Samsung mobile devices with software through 2020-04-02 (Exynos modem chipsets). There is a h

An issue was discovered on Samsung mobile devices with Q(10.0) (exynos9830 chipsets) software. RKP allows arbitrary code

An issue was discovered on Samsung mobile devices with Q(10.0) (exynos9830 chipsets) software. H-Arx allows attackers to

An issue was discovered on Samsung mobile devices with P(9.0) and Q(10.0) software. StatusBarService has insufficient DE

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in SFAPV9601 - APC E

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in SFAPV9601 - APC E

An issue was discovered in Zoho ManageEngine Exchange Reporter Plus before build number 5510, AD360 before build number

OX App Suite 7.10.1 to 7.10.3 has improper input validation for rate limits with a crafted User-Agent header, spoofed va

In projectworlds Online Book Store 1.0 Use of Hard-coded Credentials in source code leads to admin panel access.

MPXJ through 8.1.3 allows XXE attacks. This affects the GanttProjectReader and PhoenixReader components.

A safety violation was discovered in the rgb crate before 0.8.20 for Rust, leading to (for example) dereferencing of arb

Version 1.1.6-free of Chameleon Mini Live Debugger on Google Play Store may have had it's sources or permissions tampere

in Scratch Login (MediaWiki extension) before version 1.1, any account can be logged into by using the same username wit

SQL injection vulnerability in the XooNIps 3.48 and earlier allows remote attackers to execute arbitrary SQL commands vi

The Scalyr Agent before 2.1.10 has Missing SSL Certificate Validation because, in some circumstances, native Python code

The Scalyr Agent before 2.1.10 has Missing SSL Certificate Validation because, in some circumstances, the openssl binary

Insecure File Permissions and Arbitrary File Upload in the upload pic function in updatesubcategory.php in Projects Worl

File Upload component in Projects World House Rental v1.0 suffers from an arbitrary file upload vulnerability with regul

13enforme CMS 1.0 has SQL Injection via the 'content.php' id parameter.

SQL injection can occur in Soluzione Globale Ecommerce CMS v1 via the parameter " offerta.php"

Webexcels Ecommerce CMS 2.x, 2017, 2018, 2019, 2020 has SQL Injection via the 'content.php' id parameter.

KandNconcepts Club CMS 1.1 and 1.2 has SQL Injection via the 'team.php,player.php,club.php' id parameter.

DesignMasterEvents Conference management 1.0.0 allows SQL Injection via the username field on the administrator login pa

IBM Security Guardium Data Encryption (GDE) 3.0.0.2 contains hard-coded credentials, such as a password or cryptographic

A vulnerability in Cisco Virtual Wide Area Application Services (vWAAS) with Cisco Enterprise NFV Infrastructure Softwar

Umanni RH 1.0 does not limit the number of authentication attempts. An unauthenticated user may exploit this vulnerabili

HMS Industrial Networks AB eCatcher all versions prior to 6.5.5 is vulnerable to a stack-based buffer overflow, which ma

Enterprise Access Client Auto-Updater allows for Remote Code Execution prior to version 2.0.1.

secure-store in Expo through 2.16.1 on iOS provides the insecure kSecAttrAccessibleAlwaysThisDeviceOnly policy when WHEN

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Marvell QConvergeConso

Advantech iView, Versions 5.7 and prior. The affected product is vulnerable to path traversal vulnerabilities that could

Softing Industrial Automation all versions prior to the latest build of version 4.47.0, The affected product is vulnerab

GateManager versions prior to 9.2c, The affected product contains a hard-coded credential for telnet, allowing an unpriv

Secomea GateManager all versions prior to 9.2c, An attacker can send a negative value and overwrite arbitrary data.

openSIS Community Edition version 7.3 is vulnerable to SQL injection via the USERNAME parameter of index.php.

A Remote Code Execution vulnerability exists in the gVectors wpDiscuz plugin 7.0 through 7.0.4 for WordPress, which allo

A vulnerability exists in The EdgeMax EdgeSwitch firmware <v1.9.1 where the EdgeSwitch legacy web interface SIDSSL cooki

The Management Console in WSO2 API Manager through 3.1.0 and API Microgateway 2.2.0 allows XML Entity Expansion attacks.

The Management Console in WSO2 API Manager through 3.1.0 and API Microgateway 2.2.0 allows XML External Entity injection

Lack of input sanitization in AceManager of ALEOS before 4.12.0, 4.9.5 and 4.4.9 allows disclosure of sensitive system i

Verint 5620PTZ Verint_FW_0_42 and Verint 4320 V4320_FW_0_23, and V4320_FW_0_31 units feature an autodiscovery service im

The administration console of the Moog EXO Series EXVF5C-2 and EXVP7C2-3 units features a 'statusbroadcast' command that