2020

Istio 1.4.x before 1.4.9 and Istio 1.5.x before 1.5.4 contain the following vulnerability when telemetry v2 is enabled:

A NULL pointer dereference was found in the libvirt API responsible introduced in upstream version 3.10.0, and fixed in

IP-in-IP protocol specifies IP Encapsulation within IP standard (RFC 2003, STD 1) that decapsulate and route IP-in-IP tr

An Insecure Temporary File vulnerability in FortiClient for Windows 6.2.1 and below may allow a local user to gain eleva

modules/security/classes/general.post_filter.php/post_filter.php in the Web Application Firewall in Bitrix24 through 20.

Python-RSA before 4.1 ignores leading '\0' bytes during decryption of ciphertext. This could conceivably have a security

An improper input validation in FortiAP-S/W2 6.2.0 to 6.2.2, 6.0.5 and below, FortiAP-U 6.0.1 and below CLI admin consol

In QuickBox Community Edition through 2.5.5 and Pro Edition through 2.1.8, the local www-data user has sudo privileges t

system/classes/DbPDO.php in Cmfive through 2015-03-15, when database connectivity malfunctions, allows remote attackers

admin.php?page=projects in Lexiglot through 2014-11-20 allows command injection via username and password fields.

Lexiglot through 2014-11-20 allows XSS (Reflected) via the username, or XSS (Stored) via the admin.php?page=config insta

Lexiglot through 2014-11-20 allows SSRF via the admin.php?page=projects svn_url parameter.

Lexiglot through 2014-11-20 allows CSRF.

Lexiglot through 2014-11-20 allows SQL injection via an admin.php?page=users&from_id= or admin.php?page=history&limit= U

Lexiglot through 2014-11-20 allows remote attackers to obtain sensitive information (names and details of projects) by v

Lexiglot through 2014-11-20 allows remote attackers to obtain sensitive information (full path) via an include/smarty/pl

Lexiglot through 2014-11-20 allows local users to obtain sensitive information by listing a process because the username

Lexiglot through 2014-11-20 allows denial of service because api/update.php launches svn update operations that use a gr

FarLinX X25 Gateway through 2014-09-25 allows attackers to write arbitrary data to fsUI.xyz via fsSaveUIPersistence.php.

FarLinX X25 Gateway through 2014-09-25 allows directory traversal via the log-handling feature.

FarLinX X25 Gateway through 2014-09-25 allows command injection via shell metacharacters to sysSaveMonitorData.php, fsx2

In QuickBox Community Edition through 2.5.5 and Pro Edition through 2.1.8, the local www-data user can execute sudo mysq

QuickBox Community Edition through 2.5.5 and Pro Edition through 2.1.8 allows an authenticated remote attacker to execut

The scp client in OpenSSH 8.2 incorrectly sends duplicate responses to the server upon a utimes system call failure, whi

There is a few bytes out-of-bounds read vulnerability in some Huawei products. The software reads data past the end of t

serialize-javascript prior to 3.1.0 allows remote attackers to inject arbitrary code via the function "deleteFunctions"

There is an improper Neutralization of Special Elements used in an SQL Command (SQL Injection) vulnerability in php file

A NULL pointer dereference in sanei_epson_net_read in SANE Backends before 1.0.30 allows a malicious device connected to

p_lx_elf.cpp in UPX before 3.96 has an integer overflow during unpacking via crafted values in a PT_DYNAMIC segment.

reel through 0.6.1 allows Request Smuggling attacks due to incorrect Content-Length and Transfer encoding header parsing

There is an input validation vulnerability in a PON terminal product of ZTE, which supports the creation of WAN connecti

The review coverage resource in Atlassian Fisheye and Crucible before version 4.8.2 allows remote attackers to inject ar

Affected versions are: Before 8.5.5, and from 8.6.0 before 8.8.1 of Atlassian Jira Server and Data Center allow remote a

The file downloading functionality in the Atlassian Companion App before version 1.0.0 allows remote attackers, who cont

The file editing functionality in the Atlassian Companion App before version 1.0.0 allows local attackers to have the ap

The setup resources in Atlassian Fisheye and Crucible before version 4.8.1 allows remote attackers to complete the setup

The /rest/jira-ril/1.0/jira-rest/applinks resource in the crucible-jira-ril plugin in Atlassian Fisheye and Crucible bef

The /plugins/servlet/jira-blockers/ resource in the crucible-jira-ril plugin in Atlassian Fisheye and Crucible before ve

The /json/fe/activeUserFinder.do resource in Altassian Fisheye and Crucible before version 4.8.1 allows remote attackers

The /profile/deleteWatch.do resource in Atlassian Fisheye and Crucible before version 4.8.1 allows remote attackers to r

The review resource in Atlassian Fisheye and Crucible before version 4.8.1 allows remote attackers to inject arbitrary H

Insecure storage of sensitive information in ABB Device Library Wizard versions 6.0.X, 6.0.3.1 and 6.0.3.2 allows unauth

All versions of snyk-broker before 4.73.1 are vulnerable to Information Exposure. It logs private keys if logging level

All versions of snyk-broker after 4.72.0 including and before 4.73.1 are vulnerable to Arbitrary File Read. It allows ar

All versions of snyk-broker before 4.72.2 are vulnerable to Arbitrary File Read. It allows arbitrary file reads for user

A Denial of Service vulnerability in MuleSoft Mule CE/EE 3.8.x, 3.9.x, and 4.x released before April 7, 2020, could allo

Incorrect Authorization vulnerability in Micro Focus Container Deployment Foundation component affects products: - Hybri

All versions of snyk-broker before 4.80.0 are vulnerable to Arbitrary File Read. It allows arbitrary file reads for user

All versions of snyk-broker before 4.80.0 are vulnerable to Arbitrary File Read. It allows arbitrary file reads for user

All versions of snyk-broker before 4.79.0 are vulnerable to Arbitrary File Read. It allows partial file reads for users