2020

NHIServiSignAdapter fails to verify the length of digital credential files’ path which leads to a heap overflow loophole

The encryption function of NHIServiSignAdapter fail to verify the file path input by users. Remote attacker can access a

OpenEMR 5.0.1.3 allows Cross-Site Request Forgery (CSRF) via library/ajax and interface/super, as demonstrated by use of

DrayTek Vigor2960 1.5.1 allows remote command execution via shell metacharacters in a toLogin2FA action to mainfunction.

XWiki Platform before 12.8 mishandles escaping in the property displayer.

Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization design

On Tenda AC1200 (Model AC6) 15.03.06.51_multi devices, a large HTTP POST request sent to the change password API will tr

In MatrixSSL before 4.2.2 Open, the DTLS server can encounter an invalid pointer free (leading to memory corruption and

Ptarmigan before 0.2.3 lacks API token validation, e.g., an "if (token === apiToken) {return true;} return false;" code

In Correspondence Management System (corms) in Newgen eGov 12.0, an attacker can modify other users' profile information

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. It is an npm pac

An issue was discovered in a smart contract implementation for MORPH Token through 2019-06-05, an Ethereum token. A typo

A typo exists in the constructor of a smart contract implementation for EAI through 2019-06-05, an Ethereum token. This

An issue was discovered in a smart contract implementation for AIRDROPX BORN through 2019-05-29, an Ethereum token. The

An issue was discovered in MantisBT before 2.24.4. An incorrect access check in bug_revision_view_page.php allows an unp

EGavilanMedia User Registration and Login System With Admin Panel 1.0 is affected by SQL injection in the User Login Pag

Plone before 5.2.3 allows XXE attacks via a feature that is protected by an unapplied permission of plone.schemaeditor.M

Plone before 5.2.3 allows SSRF attacks via the tracebacks feature (only available to the Manager role).

Plone before 5.2.3 allows XXE attacks via a feature that is explicitly only available to the Manager role.

dotCMS before 20.10.1 allows SQL injection, as demonstrated by the /api/v1/containers orderby parameter. The PaginatorOr

Certain NETGEAR devices are affected by disclosure of sensitive information. This affects D7800 before 1.0.1.58, R7800 b

Certain NETGEAR devices are affected by disclosure of sensitive information. This affects CBR40 before 2.5.0.14, RBW30 b

Certain NETGEAR devices are affected by incorrect configuration of security settings. This affects JGS516PE before 2.6.0

Certain NETGEAR devices are affected by a stack-based buffer overflow by an unauthenticated attacker. This affects D3600

Certain NETGEAR devices are affected by a buffer overflow by an unauthenticated attacker. This affects CBR40 before 2.5.

Certain NETGEAR devices are affected by command injection by an authenticated user. This affects RBS40V before 2.6.1.4,

Certain NETGEAR devices are affected by command injection by an authenticated user. This affects R7500v2 before 1.0.3.48

NETGEAR NMS300 devices before 1.6.0.27 are affected by command injection by an authenticated user.

NETGEAR WAC104 devices before 1.0.4.13 are affected by a buffer overflow by an authenticated user.

Certain NETGEAR devices are affected by a buffer overflow by an authenticated user. This affects D3600 before 1.0.0.76,

NETGEAR DGN2200v1 devices before v1.0.0.60 mishandle HTTPd authentication (aka PSV-2020-0363, PSV-2020-0364, and PSV-202

Certain NETGEAR devices are affected by lack of access control at the function level. This affects JGS516PE before 2.6.0

NETGEAR NMS300 devices before 1.6.0.27 are affected by denial of service.

NETGEAR NMS300 devices before 1.6.0.27 are affected by denial of service.

NETGEAR NMS300 devices before 1.6.0.27 are affected by denial of service.

NETGEAR DGN2200v1 devices before v1.0.0.58 are affected by command injection.

Command Injection in the CPE WAN Management Protocol (CWMP) registration in Amino Communications AK45x series, AK5xx ser

The Inventory module of the 1E Client 5.0.0.745 doesn't handle an unquoted path when executing %PROGRAMFILES%\1E\Client\

The Inventory module of the 1E Client 5.0.0.745 doesn't handle an unquoted path when executing %PROGRAMFILES%\1E\Client\

The MSI installer in 1E Client 4.1.0.267 and 5.0.0.745 allows remote authenticated users and local users to gain elevate

There is a denial of service vulnerability in some Huawei smartphones. Due to the improper processing of received abnorm

There is an improper authentication vulnerability in some verisons of Huawei CloudEngine product. A module does not veri

There is a memory leak vulnerability in some versions of Huawei CloudEngine product. An unauthenticated, remote attacker

There is an out of bound read vulnerability in some verisons of Huawei CloudEngine product. A module does not deal with

The site-offline plugin before 1.4.4 for WordPress lacks certain wp_create_nonce and wp_verify_nonce calls, aka CSRF.

An unauthenticated remote attacker can send data to RsvcHost.exe listening on TCP port 5241 to add entries in the Factor

An attacker-controlled memory allocation size can be passed to the C++ new operator in RnaDaSvr.dll by sending a special

An attacker can craft and send an OpenNamespace message to port 4241 with valid session-id that triggers an unhandled ex

Apache Accumulo versions 1.5.0 through 1.10.0 and version 2.0.0 do not properly check the return value of some policy en

This command injection vulnerability allows attackers to execute arbitrary commands in a compromised application. QNAP h