2020

An issue was discovered in Mikrotik-Router-Monitoring-System through 2018-10-22. SQL Injection exists in check_community

NaviServer 4.99.4 to 4.99.19 allows denial of service due to the nsd/driver.c ChunkedDecode function not properly valida

The kerberos package before 1.0.0 for Node.js allows arbitrary code execution and privilege escalation via injection of

Morita Shogi 64 through 2020-05-02 for Nintendo 64 devices allows remote attackers to execute arbitrary code via crafted

Lack of output sanitization allowed an attack to execute arbitrary shell commands via the logkitty npm package before ve

A flaw was found in Keycloak in versions before 10.0.0, where it does not perform the TLS hostname verification while se

iSpyConnect.com Agent DVR before 2.7.1.0 allows directory traversal.

scikit-learn (aka sklearn) through 0.23.0 can unserialize and execute commands from an untrusted file that is passed to

pandas through 1.0.3 can unserialize and execute commands from an untrusted file that is passed to the read_pickle() fun

yaws_config.erl in Yaws through 2.0.2 and/or 2.0.7 loads obsolete TLS ciphers, as demonstrated by ones that allow Sweet3

MISP MISP-maltego 1.4.4 incorrectly shares a MISP connection across users in a remote-transform use case.

The VFIO PCI driver in the Linux kernel through 5.6.13 mishandles attempts to access disabled memory space.

Cellebrite UFED 5.0 to 7.5.0.845 implements local operating system policies that can be circumvented to obtain a command

SecureCRT before 8.7.2 allows remote attackers to execute arbitrary code via an Integer Overflow and a Buffer Overflow b

A Cross-Site Request Forgery (CSRF) vulnerability was discovered in Subrion CMS 4.2.1 that allows a remote attacker to r

An XSS issue was identified on the Subrion CMS 4.2.1 /panel/configuration/general settings page. A remote attacker can i

An off-by-one error in the DecodeBlock function in codec/sdl_image.c in VideoLAN VLC media player before 3.0.9 allows re

An issue was discovered on D-Link DAP-1360 revision F devices. Remote attackers can start a telnet service without autho

eQ-3 Homematic Central Control Unit (CCU)2 through 2.51.6 and CCU3 through 3.51.6 allow Remote Code Execution in the JSO

XSS in the admin help system admin/help.html and admin/quicklinks.html in Interchange 4.7.0 through 5.11.x allows remote

libfreerdp/core/update.c in FreeRDP versions > 1.1 through 2.0.0-rc4 has an Out-of-bounds Read.

libfreerdp/cache/bitmap.c in FreeRDP versions > 1.0 through 2.0.0-rc4 has an Out of bounds read.

libfreerdp/codec/interleaved.c in FreeRDP versions > 1.0 through 2.0.0-rc4 has an Out-of-bounds Write.

libfreerdp/gdi/region.c in FreeRDP versions > 1.0 through 2.0.0-rc4 has an Integer Overflow.

libfreerdp/gdi/gdi.c in FreeRDP > 1.0 through 2.0.0-rc4 has an Out-of-bounds Read.

libfreerdp/codec/planar.c in FreeRDP version > 1.0 through 2.0.0-rc4 has an Out-of-bounds Write.

Use-after-free in libtransmission/variant.c in Transmission before 3.00 allows remote attackers to cause a denial of ser

ALSong 3.46 and earlier version contain a Document Object Model (DOM) based cross-site scripting vulnerability caused by

Huawei P20 smartphones with versions earlier than 10.0.0.156(C00E156R1P4) have an improper authentication vulnerability.

Missing input validation in the ar/tar implementations of APT before version 2.1.2 could result in denial of service whe

Honor 20;HONOR 20 PRO;Honor Magic2;HUAWEI Mate 20 X;HUAWEI P30;HUAWEI P30 Pro;Honor View 20 smartphones with versions ea

An incomplete fix was found for the fix of the flaw CVE-2020-1733 ansible: insecure temporary directory when running bec

Improper Input Validation vulnerability in the cevakrnl.rv0 module as used in the Bitdefender Engines allows an attacker

Submitty through 20.04.01 allows XSS via upload of an SVG document, as demonstrated by an attack by a Student against a

An Ubuntu-specific modification to Pulseaudio to provide security mediation for Snap-packaged applications was found to

An issue was discovered in CODESYS Development System before 3.5.16.0. CODESYS WebVisu and CODESYS Remote TargetVisu are

Opto 22 SoftPAC Project Version 9.6 and prior. SoftPAC’s firmware files’ signatures are not verified upon firmware updat

Opto 22 SoftPAC Project Version 9.6 and prior. Paths specified within the zip files used to update the SoftPAC firmware

Opto 22 SoftPAC Project Version 9.6 and prior. SoftPAC communication does not include any credentials. This allows an at

Opto 22 SoftPAC Project Version 9.6 and prior. SoftPAC does not specify the path of multiple imported .dll files. Theref

Opto 22 SoftPAC Project Version 9.6 and prior. SoftPACAgent communicates with SoftPACMonitor over network Port 22000. Ho

Airbrush FW's scratch memory allocator is susceptible to numeric overflow. When the overflow occurs, the next allocation

In crus_afe_callback of msm-cirrus-playback.c, there is a possible out of bounds write due to a missing bounds check. Th

In psi_write of psi.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local e

In simulatePackageSuspendBroadcast of NotificationManagerService.java, there is a missing permission check. This could l

In getCellLocation of PhoneInterfaceManager.java, there is a possible permission bypass due to a missing SDK version che

In onKeyguardVisibilityChanged of key_store_service.cpp, there is a missing permission check. This could lead to local e

In onShowingStateChanged of KeyguardStateMonitor.java, there is a possible inappropriate read due to a logic error. This

In a2dp_aac_decoder_cleanup of a2dp_aac_decoder.cc, there is a possible invalid free due to memory corruption. This coul

In GattServer::SendResponse of gatt_server.cc, there is a possible out of bounds write due to an incorrect bounds check.