2020

USVN (aka User-friendly SVN) before 1.0.9 allows remote code execution via shell metacharacters in the number_start or n

gssproxy (aka gss-proxy) before 0.8.3 does not unlock cond_mutex before pthread exit in gp_worker_main() in gp_workers.c

JsLink in Webswing before 2.6.12 LTS, and 2.7.x and 20.x before 20.1, allows remote code execution.

The Amaze File Manager application before 3.4.2 for Android does not properly restrict intents for controlling the FTP s

An issue was discovered on D-Link DAP-1650 devices through v1.03b07 before 1.04B02_J65H Hot Fix. Attackers can bypass au

Rocket.Chat before 0.74.4, 1.x before 1.3.4, 2.x before 2.4.13, 3.x before 3.7.3, 3.8.x before 3.8.3, and 3.9.x before 3

Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php newpassword function.

Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php resetpassword function.

Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php check function.

Certain NETGEAR devices are affected by incorrect configuration of security settings. This affects AC2100 before 1.2.0.7

Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects R6400v2 before 1.

NETGEAR NMS300 devices before 1.6.0.27 are affected by command injection by an unauthenticated attacker.

Certain NETGEAR devices are affected by a buffer overflow by an unauthenticated attacker. This affects AC2100 before 1.2

Command Injection in EntoneWebEngine in Amino Communications AK45x series, AK5xx series, AK65x series, Aria6xx series, A

Because of hard-coded SSH keys for the root user in Amino Communications AK45x series, AK5xx series, AK65x series, Aria6

Use of Hard-coded Credentials in EntoneWebEngine in Amino Communications AK45x series, AK5xx series, AK65x series, Aria6

The SolarWinds Orion API is vulnerable to an authentication bypass that could allow a remote attacker to execute API com

Prototype pollution vulnerability in 'libnested' versions 0.0.0 through 1.5.0 allows an attacker to cause a denial of se

Prototype pollution vulnerability in 'getobject' version 0.1.0 allows an attacker to cause a denial of service and may l

Prototype pollution vulnerability in 'set-object-value' versions 0.0.0 through 0.0.5 allows an attacker to cause a denia

Prototype pollution vulnerability in 'predefine' versions 0.0.0 through 0.1.2 allows an attacker to cause a denial of se

Prototype pollution vulnerability in 'flattenizer' versions 0.0.5 through 1.0.5 allows an attacker to cause a denial of

Prototype pollution vulnerability in 'shvl' versions 1.0.0 through 2.0.1 allows an attacker to cause a denial of service

Prototype pollution vulnerability in 'dset' versions 1.0.0 through 2.0.1 allows attacker to cause a denial of service an

Prototype pollution vulnerability in 'deep-set' versions 1.0.0 through 1.0.1 allows attacker to cause a denial of servic

miniserv.pl in Webmin 1.962 on Windows mishandles special characters in query arguments to the CGI program.

An issue was discovered in G-Data before 25.5.9.25 using Symbolic links, it is possible to abuse the infected-file resto

An issue was discovered in Joomla! 3.0.0 through 3.9.22. Improper filter blacklist configuration leads to a SQL injectio

Dex is a federated OpenID Connect provider written in Go. In Dex before version 2.27.0 there is a critical set of vulner

An issue was discovered in Zammad before 3.4.1. There is an authentication bypass in the SSO endpoint via a crafted head

KLog Server 2.4.1 allows OS command injection via shell metacharacters in the actions/authenticate.php user parameter.

Flamingo (aka FlamingoIM) through 2020-09-29 has a SQL injection vulnerability in UserManager::addUser.

Flamingo (aka FlamingoIM) through 2020-09-29 has a SQL injection vulnerability in UserManager::addGroup.

Flamingo (aka FlamingoIM) through 2020-09-29 has a SQL injection vulnerability in UserManager::updateUserInfoInDb.

Flamingo (aka FlamingoIM) through 2020-09-29 has a SQL injection vulnerability in UserManager::updateUserTeamInfoInDbAnd

struct2json before 2020-11-18 is affected by a Buffer Overflow because strcpy is used for S2J_STRUCT_GET_string_ELEMENT.

Beijing Huorong Internet Security 5.0.55.2 allows a non-admin user to escalate privileges by injecting code into a proce

A password-disclosure issue in the web interface on certain TP-Link devices allows a remote attacker to get full adminis

Belkin LINKSYS RE6500 devices before 1.0.012.001 allow remote attackers to execute arbitrary commands or set a new passw

Esri ArcGIS Server before 10.8 is vulnerable to SSRF in some configurations.

BrowserUp Proxy allows you to manipulate HTTP requests and responses, capture HTTP content, and export performance data

EGavilan Media EGM Address Book 1.0 contains a SQL injection vulnerability. An attacker can gain Admin Panel access usin

EGavilan Media Under Construction page with cPanel 1.0 contains a SQL injection vulnerability. An attacker can gain Admi

Remote Command Execution (RCE) vulnerability in TerraMaster TOS <= 4.2.06 allow remote unauthenticated attackers to inje

Multiple directory traversal vulnerabilities in TerraMaster TOS <= 4.2.06 allow remote authenticated attackers to read,

If exploited, this stored cross-site scripting vulnerability could allow remote attackers to inject malicious code in Fi

An unauthenticated command-execution vulnerability exists in TerraMaster TOS through 4.2.06 via shell metacharacters in

SourceCodester Online Health Care System 1.0 is affected by SQL Injection which allows a potential attacker to bypass th

SourceCodester Library Management System 1.0 is affected by SQL Injection allowing an attacker to bypass the user authen

SourceCodester Alumni Management System 1.0 is affected by SQL injection causing arbitrary remote code execution from GE