2020

IBM API Connect's V2018.4.1.0 through 2018.4.1.10 management server has an unsecured api which can be exploited by an un

IBM API Connect V2018.4.1.0 through 2018.4.1.10 could allow a remote attacker to hijack the clicking action of the victi

An out-of-bounds buffer read flaw was found in the pluto daemon of libreswan from versions 3.27 till 3.31 where, an unau

A flaw was found in OpenShift Container Platform where OAuth tokens are not encrypted when the encryption of data at res

IBM Maximo Asset Management 7.6.0, and 7.6.1 could allow an authenticated user to obtain highly sensitive information th

There is a vulnerability in actionpack_page-caching gem < v1.2.1 that allows an attacker to write arbitrary files to a w

A missing verification of the TLS host in Nextcloud Mail 1.1.3 allowed a man in the middle attack.

An outdated 3rd party library in the Files PDF viewer for Nextcloud Server 18.0.2 caused a Cross-site scripting vulnerab

An Insecure direct object reference vulnerability in Nextcloud Server 18.0.2 allowed an attacker to remote wipe devices

Improper access control in Groupfolders app 4.0.3 allowed to delete hidden directories when when renaming an accessible

There is a possible information disclosure issue in Active Resource <v5.1.1 that could allow an attacker to create speci

In SLP Validate (npm package slp-validate) before version 1.2.1, users could experience false-negative validation outcom

SLPJS (npm package slpjs) before version 0.27.2, has a vulnerability where users could experience false-negative validat

A malicious userspace application can cause a integer overflow and bypass security checks performed by system call handl

In updatehub_probe, right after JSON parsing is complete, objects\[1] is accessed from the output structure in two diffe

The UpdateHub module disables DTLS peer checking, which allows for a man in the middle attack. This is mitigated by firm

Multiple syscalls in the Kscan subsystem perform insufficient argument validation, allowing code executing in userspace

Multiple syscalls with insufficient argument validation See NCC-ZEP-006 This issue affects: zephyrproject-rtos zephyr ve

An attacker who has obtained code execution within a user thread is able to elevate privileges to that of the kernel. Se

The arm platform-specific code uses a signed integer comparison when validating system call numbers. An attacker who has

The shell subsystem contains a buffer overflow, whereby an adversary with physical access to the device is able to cause

A malformed JSON payload that is received from an UpdateHub server may trigger memory corruption in the Zephyr OS. This

Out-of-bounds Write in the USB Mass Storage memoryWrite handler with unaligned Sizes See NCC-ZEP-024, NCC-ZEP-025, NCC-Z

USB DFU has a potential buffer overflow where the requested length (wLength) is not checked against the buffer size. Thi

A flaw was found in Keycloak in versions before 9.0.2. This flaw allows a malicious user that is currently logged in, to

In SwiftNIO Extras before 1.4.1, a logic issue was addressed with improved restrictions.

All versions before 1.6.7 and all versions after 2.0.0 inclusive and before 2.8.2 of io.jooby:jooby and org.jooby:jooby

Symantec Endpoint Protection, prior to 14.3, may not respect file permissions when writing to log files that are replace

Symantec Endpoint Protection, prior to 14.3, can potentially reset the ACLs on a file as a limited user while Symantec E

Symantec Endpoint Protection Manager, prior to 14.3, has a race condition in client remote deployment which may result i

Symantec Endpoint Protection Manager, prior to 14.3, may be susceptible to a directory traversal attack that could allow

Symantec Endpoint Protection Manager, prior to 14.3, may be susceptible to an out of bounds vulnerability, which is a ty

In the SEOmatic plugin before 3.2.49 for Craft CMS, helpers/DynamicMeta.php does not properly sanitize the URL. This lea

Certain versions of the NetApp Service Processor and Baseboard Management Controller firmware allow a remote unauthentic

IBM UrbanCode Deploy (UCD) 7.0.5.2 could allow a remote attacker to obtain sensitive information, caused by the failure

A use-after-free vulnerability in the TOBESOFT XPLATFORM versions 9.1 to 9.2.2 may lead to code execution on a system ru

Apache log4net versions before 2.0.10 do not disable XML external entities when parsing log4net configuration files. Thi

cPanel before 86.0.14 allows attackers to obtain access to the current working directory via the account backup feature

cPanel before 86.0.14 allows remote attackers to trigger a bandwidth suspension via mail log strings (SEC-505).

An issue was discovered in OpenNMS Horizon before 26.0.1, and Meridian before 2018.1.19 and 2019 before 2019.1.7. The Ac

An issue was discovered on LG mobile devices with Android OS 7.2, 8.0, 8.1, 9, and 10 software. A crafted application ca

An issue was discovered on LG mobile devices with Android OS 7.2, 8.0, 8.1, 9, and 10 software. Arbitrary code execution

An issue was discovered on Samsung mobile devices with P(9.0) and Q(10.0) (with TEEGRIS) software. Attackers can determi

An issue was discovered on Samsung mobile devices with O(8.X), P(9.0), and Q(10.0) software. The Quram image codec libra

An issue was discovered on Samsung mobile devices with Q(10.0) software. Attackers can bypass Factory Reset Protection (

An issue was discovered on Samsung mobile devices with P(9.0) (Exynos chipsets) software. The S.LSI Wi-Fi drivers have a

An issue was discovered on Samsung mobile devices with Q(10.0) software. Attackers can bypass the locked-state protectio

An issue was discovered on Samsung mobile devices with Q(10.0) (Exynos980 9630 and Exynos990 9830 chipsets) software. Th

An issue was discovered on Samsung mobile devices with O(8.X), P(9.0), and Q(10.0) (Exynos chipsets) software. Attackers

An issue was discovered on Samsung mobile devices with Q(10.0) software. Attackers can bypass the locked-state protectio