2020

In Karaf, JMX authentication takes place using JAAS and authorization takes place using ACL files. By default, only an "

The Branding Module in Viki Vera 4.9.1.26180 allows an authenticated user to change the logo on the website. An attacker

In affected versions of WordPress, misuse of the `set-screen-option` filter's return value allows arbitrary user meta fi

In affected versions of WordPress, when uploading themes, the name of the theme folder can be crafted in a way that coul

In affected versions of WordPress, due to an issue in wp_validate_redirect() and URL sanitization, an arbitrary external

In affected versions of WordPress, authenticated users with upload permissions (like authors) are able to inject JavaScr

In affected versions of WordPress, users with low privileges (like contributors and authors) can use the embed block in

An issue was discovered in Icinga2 before v2.12.0-rc1. The prepare-dirs script (run as part of the icinga2 systemd servi

Adobe Experience Manager versions 6.5 and earlier have a cross-site scripting (reflected) vulnerability. Successful expl

Adobe Experience Manager versions 6.5 and earlier have a cross-site scripting vulnerability. Successful exploitation cou

Adobe Experience Manager versions 6.5 and earlier have a cross-site scripting (dom-based) vulnerability. Successful expl

Adobe Experience Manager versions 6.5 and earlier have a blind server-side request forgery (ssrf) vulnerability. Success

Adobe Experience Manager versions 6.5 and earlier have a cross-site scripting (stored) vulnerability. Successful exploit

Adobe Experience Manager versions 6.5 and earlier have a server-side request forgery (ssrf) vulnerability. Successful ex

Adobe Framemaker versions 2019.0.5 and below have a memory corruption vulnerability. Successful exploitation could lead

Adobe Framemaker versions 2019.0.5 and below have an out-of-bounds write vulnerability. Successful exploitation could le

Adobe Framemaker versions 2019.0.5 and below have an out-of-bounds write vulnerability. Successful exploitation could le

Adobe Flash Player Desktop Runtime 32.0.0.371 and earlier, Adobe Flash Player for Google Chrome 32.0.0.371 and earlier,

A flaw was found in the Linux kernel's implementation of Userspace core dumps. This flaw allows an attacker with a local

IBM API Connect 5.0.0.0 through 5.0.8.8 is vulnerable to cross-site scripting. This vulnerability allows users to embed

GeoVision Door Access Control device family improperly stores and controls access to system logs, any users can read the

GeoVision Door Access Control device family employs shared cryptographic private keys for SSH and HTTPS. Attackers may c

GeoVision Door Access Control device family is hardcoded with a root password, which adopting an identical password in a

Zoho ManageEngine ServiceDesk Plus before 11.1 build 11115 allows remote unauthenticated attackers to change the install

SSB-DB version 20.0.0 has an information disclosure vulnerability. The get() method is supposed to only decrypt messages

HashiCorp Consul and Consul Enterprise include an HTTP API (introduced in 1.2.0) and DNS (introduced in 1.4.3) caching f

HashiCorp Consul and Consul Enterprise did not appropriately enforce scope for local tokens issued by a primary data cen

HashiCorp Consul and Consul Enterprise failed to enforce changes to legacy ACL token rules due to non-propagation to sec

HashiCorp Consul and Consul Enterprise could crash when configured with an abnormally-formed service-router entry. Intro

Philips IntelliBridge Enterprise (IBE), Versions B.12 and prior, IntelliBridge Enterprise system integration with SureSi

The Rolling Proximity Identifier used in the Apple/Google Exposure Notification API beta through 2020-05-29 enables atta

Havoc Research discovered an authenticated Server-Side Request Forgery (SSRF) via the "JSON" data source of Redash open-

When configured to enable default typing, Jackson contained a deserialization vulnerability that could lead to arbitrary

Mids' Reborn Hero Designer 2.6.0.7 downloads the update manifest, as well as update files, over cleartext HTTP. Addition

Mids' Reborn Hero Designer 2.6.0.7 has an elevation of privilege vulnerability due to default and insecure permissions b

In main of main.cpp, there is possible memory corruption due to a use after free. This could lead to local escalation of

In onCreate of SliceDeepLinkSpringBoard.java there is a possible insecure Intent. This could lead to local elevation of

In loadSoundModel and related functions of SoundTriggerHwService.cpp, there is possible out of bounds write due to a rac

In RW_T4tPresenceCheck of rw_t4t.cc, there is a possible out of bounds write due to a missing bounds check. This could l

In phNciNfc_RecvMfResp of phNxpExtns_MifareStd.cpp, there is a possible out of bounds write due to an integer overflow.

In onCreate of ConfirmConnectActivity.java, there is a possible leak of Bluetooth information due to a permissions bypas

In ce_t4t_process_select_file_cmd of ce_t4t.cc, there is a possible out of bounds read due to an incorrect bounds check.

In hevcd_fmt_conv_420sp_to_420sp_av8 of ihevcd_fmt_conv_420sp_to_420sp.s, there is a possible out of bounds write due to

In _onBufferDestroyed of InputBufferManager.cpp, there is a possible out of bounds read due to a use after free. This co

In SumCompoundHorizontalTaps of convolve_neon.cc, there is a possible out of bounds read due to a missing bounds check.

In removeSharedAccountAsUser of AccountManager.java, there is a possible permissions bypass to a confused deputy. This c

In multiple functions of AccountManager.java, there is a possible permissions bypass. This could lead to local escalatio

In multiple functions of AccountManager.java, there is a possible permissions bypass. This could lead to local escalatio

In next_marker of jdmarker.c, there is a possible out of bounds read due to improper input validation. This could lead t

In the settings app, there is a possible app crash due to improper input validation. This could lead to local denial of