2020

Improper access due to socket opened by the logging application without specifying localhost address in Snapdragon Consu

Any application can bind to it and exercise the APIs due to no protection for AIDL uimlpaservice in Snapdragon Auto, Sna

Possible buffer overflow while copying the frame to local buffer due to lack of check of length before copying in Snapdr

Double free issue in kernel memory mapping due to lack of memory protection mechanism in Snapdragon Compute, Snapdragon

Integer overflow in diag command handler when user inputs a large value for number of tasks field in the request packet

System Services exports services without permission protect and can lead to information exposure in Snapdragon Industria

Double free issue in NPU due to lack of resource locking mechanism to avoid race condition in Snapdragon Auto, Snapdrago

Out of bound write can happen due to lack of check of array index value while parsing SDP attribute for SAR in Snapdrago

Buffer overflow occurs while processing an subsample data length out of range due to lack of user input validation in Sn

Copying RTCP messages into the output buffer without checking the destination buffer size which could lead to a remote s

Buffer overflows while decoding setup message from Network due to lack of check of IE message length received from netwo

While IPA driver processes route add rule IOCTL, there is no input validation of the rule ID prior to adding the rule to

Payload size is not validated before reading memory that may cause issue of accessing invalid pointer or some garbage da

kernel writes to user passed address without any checks can lead to arbitrary memory write in Snapdragon Auto, Snapdrago

Multiple XSS vulnerabilities in the Final Tiles Gallery plugin before 3.4.19 for WordPress allow remote attackers to inj

Concrete5 before 8.5.3 does not constrain the sort direction to a valid asc or desc value.

A SQL injection vulnerability in PHP-Fusion 9.03.50 affects the endpoint administration/comments.php via the ctype param

Multiple XSS vulnerabilities in the Easy Testimonials plugin before 3.6 for WordPress allow remote attackers to inject a

In Gogs 0.11.91, MakeEmailPrimary in models/user_mail.go lacks a "not the owner of the email" check.

Mutt before 1.14.4 and NeoMutt before 2020-06-19 have a STARTTLS buffering issue that affects IMAP, SMTP, and POP3. When

aaPanel through 6.6.6 allows remote authenticated users to execute arbitrary commands via shell metacharacters in a modi

Tendenci 12.0.10 allows unrestricted deserialization in apps\helpdesk\views\staff.py.

compose.php in SquirrelMail 1.4.22 calls unserialize for the $attachments value, which originates from an HTTP POST requ

compose.php in SquirrelMail 1.4.22 calls unserialize for the $mailtodata value, which originates from an HTTP GET reques

Kubernetes cluster token disclosure in GitLab CE/EE 10.3 and later through 13.0.1 allows other group maintainers to view

An authorization issue relating to project maintainer impersonation was identified in GitLab EE 9.5 and later through 13

Amazon EKS credentials disclosure in GitLab CE/EE 12.6 and later through 13.0.1 allows other administrators to view Amaz

A stack-based buffer overflow in DMitry (Deepmagic Information Gathering Tool) 1.3a might allow remote WHOIS servers to

User is allowed to set an email as a notification email even without verifying the new email in all previous GitLab CE/E

A user with an unverified email address could request an access to domain restricted groups in GitLab EE 12.2 and later

A security issue allowed achieving Denial of Service attacks through memory exhaustion by uploading malicious artifacts

A Denial of Service vulnerability allowed exhausting the system resources in GitLab CE/EE 12.0 and later through 13.0.1

OAuth flow missing verification checks CE/EE 12.3 and later through 13.0.1 allows unverified user to use OAuth authoriza

User email verification bypass in GitLab CE/EE 12.5 and later through 13.0.1 allows user to bypass email verification

Client-Side code injection through Mermaid markup in GitLab CE/EE 12.9 and later through 13.0.1 allows a specially craft

An issue was discovered in BT CTROMS Terminal OS Port Portal CT-464. Account takeover can occur because the password-res

WooCommerce before 3.6.5, when it handles CSV imports of products, has a cross-site request forgery (CSRF) issue with re

Sensitive information written to a log file vulnerability was found in jaegertracing/jaeger before version 1.18.1 when t

An issue was discovered in Mattermost Server before 3.6.0 and 3.5.2. XSS can occur via a link on an error page.

An issue was discovered in Mattermost Server before 3.6.2. The WebSocket feature does not follow the Same Origin Policy.

An issue was discovered in Mattermost Server before 3.7.0 and 3.6.3. Attackers can use the API for unauthenticated team

An issue was discovered in Mattermost Server before 3.7.3 and 3.6.5. A System Administrator can place a SAML certificate

An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. Weak hashing was used for e-mail invitation

An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. API endpoint access control does not honor

An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. After a restart of a server, an attacker mi

An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. An external link can occur on an error page

An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. XSS can occur via a link on an error page.

An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2. A password-reset request was sometime sent

An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2. XSS could occur via a channel header.

An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2, when Single Sign-On OAuth2 is used. An att