2020

GE Healthcare Imaging and Ultrasound Products may allow specific credentials to be exposed during transport over the net

GE Healthcare Imaging and Ultrasound Products may allow specific credentials to be exposed during transport over the net

An Origin Validation Error vulnerability in the SafePay component of Bitdefender Antivirus Plus allows a web resource to

SQL Injection in Classbooking before 2.4.1 via the username field of a CSV file when adding a new user.

SQL Injection in the login page in Online Bus Ticket Reservation 1.0 allows attackers to execute arbitrary SQL commands

A vulnerability in the MIME message handling of the Notes client (versions 9 and 10) could potentially be exploited by a

A vulnerability in the MIME message handling of the Domino server (versions 9 and 10) could potentially be exploited by

An issue was discovered in Car Rental Management System 1.0. An unauthenticated user can perform a file inclusion attack

In Apache Airflow versions prior to 1.10.13, the Charts and Query View of the old (Flask-admin based) UI were vulnerable

In Airflow versions prior to 1.10.13, when creating a user using airflow CLI, the password gets logged in plain text in

The GitLab Webhook Handler in amazee.io Lagoon before 1.12.3 has incorrect access control associated with project deleti

Improper check or handling of exceptional conditions in MELSEC iQ-F series FX5U(C) CPU unit firmware version 1.060 and e

Directory traversal vulnerability in FileZen versions from V3.0.0 to V4.2.2 allows remote attackers to upload an arbitra

Improper validation of integrity check value vulnerability in Aterm SA3500G firmware versions prior to Ver. 3.5.9 allows

Aterm SA3500G firmware versions prior to Ver. 3.5.9 allows an attacker with an administrative privilege to send a specia

Aterm SA3500G firmware versions prior to Ver. 3.5.9 allows an attacker on the adjacent network to send a specially craft

vendor/elfinder/php/connector.minimal.php in the secure-file-manager plugin through 2.5 for WordPress loads elFinder cod

The easy-wp-smtp plugin before 1.4.4 for WordPress allows Administrator account takeover, as exploited in the wild in De

In the Macally WIFISD2-2A82 Media and Travel Router 2.000.010, the Guest user is able to reset its own password. This pr

An issue was discovered in the LogMein LastPass Password Manager (aka com.lastpass.ilastpass) app 4.8.11.2403 for iOS. T

An issue was discovered in the LogMein LastPass Password Manager (aka com.lastpass.ilastpass) app 4.8.11.2403 for iOS. T

Ignite Realtime Openfire 4.6.0 has plugins/dbaccess/db-access.jsp sql Stored XSS.

Ignite Realtime Openfire 4.6.0 has create-bookmark.jsp users Stored XSS.

Ignite Realtime Openfire 4.6.0 has plugins/clientcontrol/spark-form.jsp Reflective XSS.

Ignite Realtime Openfire 4.6.0 has create-bookmark.jsp groupchatJID Stored XSS.

In AWStats through 7.8, cgi-bin/awstats.pl?config= accepts a partial absolute pathname (omitting the initial /etc), even

Western Digital Dashboard before 3.2.2.9 allows DLL Hijacking that leads to compromise of the SYSTEM account.

An issue was discovered on Western Digital My Cloud OS 5 devices before 5.07.118. A NAS Admin authentication bypass vuln

Frappe Framework 12 and 13 does not properly validate the HTTP method for the frappe.client API.

An issue was discovered in the IPv6 stack in Contiki through 3.0. There are inconsistent checks for IPv6 header extensio

An issue was discovered in the IPv6 stack in Contiki through 3.0. There is an insufficient check for the IPv6 header len

An issue was discovered in the DNS implementation in Ethernut in Nut/OS 5.1. The length byte of a domain name in a DNS q

An issue was discovered in the DNS implementation in Ethernut in Nut/OS 5.1. The number of DNS queries/responses (set in

An issue was discovered in the DNS implementation in Ethernut in Nut/OS 5.1. The DNS response data length is not checked

An issue was discovered in the DNS implementation in Ethernut in Nut/OS 5.1. There is no check on whether a domain name

An issue was discovered in FNET through 4.6.4. The code for processing resource records in mDNS queries doesn't check fo

An issue was discovered in picoTCP and picoTCP-NG through 1.7.0. The TCP input data processing function in pico_tcp.c do

An issue was discovered in picoTCP and picoTCP-NG through 1.7.0. The code that processes DNS responses in pico_mdns_hand

An issue was discovered in picoTCP and picoTCP-NG through 1.7.0. The DNS domain name record decompression functionality

An issue was discovered in picoTCP through 1.7.0. The DNS domain name record decompression functionality in pico_dns_dec

An issue was discovered in picoTCP and picoTCP-NG through 1.7.0. When an unsupported TCP option with zero length is prov

An issue was discovered in Contiki through 3.0 and Contiki-NG through 4.5. The code for parsing Type A domain name answe

The code that processes DNS responses in uIP through 1.0, as used in Contiki and Contiki-NG, does not check whether the

An issue was discovered in FNET through 4.6.4. The code that initializes the DNS client interface structure does not set

An issue was discovered in FNET through 4.6.4. The code for IPv6 fragment reassembly tries to access a previous fragment

An issue was discovered in FNET through 4.6.4. The code for processing the hop-by-hop header (in the IPv6 extension head

An issue was discovered in FNET through 4.6.4. The code for processing the hostname from an LLMNR request doesn't check

An issue was discovered in picoTCP 1.7.0. The code for processing the IPv6 destination options does not check for a vali

An issue was discovered in picoTCP 1.7.0. The routine for processing the next header field (and deducing whether the IPv

An issue was discovered in picoTCP 1.7.0. The code for creating an ICMPv6 echo replies doesn't check whether the ICMPv6