2020

An issue was discovered on Rittal PDU-3C002DEC through 5.17.10 and CMCIII-PU-9333E0FB through 3.17.10 devices. There is

A hard-coded telnet credential in the tenda_login binary of Tenda AC15 AC1900 version 15.03.05.19 allows unauthenticated

The goform/setUsbUnload endpoint of Tenda AC15 AC1900 version 15.03.05.19 allows remote attackers to execute arbitrary s

Pandora FMS 7.0 NG <= 746 suffers from Multiple XSS vulnerabilities in different browser views. A network administrator

A SQL injection vulnerability in the user and admin web interfaces of Sophos XG Firewall v18.0 MR1 and older potentially

A command injection vulnerability in the `devcert` module may lead to remote code execution when users of the module pas

In Eclipse Jetty, versions 9.4.27.v20200227 to 9.4.29.v20200521, in case of too large response headers, Jetty throws an

In FreeBSD 12.1-STABLE before r362281, 11.4-STABLE before r362281, and 11.4-RELEASE before p1, long values in the user-c

Elevation of privilege and/or unauthorized access vulnerability in Micro Focus Identity Manager. Affecting versions prio

Buffer overflow exists in Geovision Door Access Control device family, an unauthenticated remote attacker can execute ar

SQL injection with start and length parameters in Records.php for phpzag live add edit delete data tables records with a

SQL injection in order and column parameters in Records.php for phpzag live add edit delete data tables records with aja

SQL injection with the search parameter in Records.php for phpzag live add edit delete data tables records with ajax php

Gossipsub 1.0 does not properly resist invalid message spam, such as an eclipse attack or a sybil attack.

WebChess 1.0 allows SQL injection via the messageFrom, gameID, opponent, messageID, or to parameter.

RIOT 2020.04 has a buffer overflow in the base64 decoder. The decoding function base64_decode() uses an output buffer es

Venki Supravizio BPM 10.1.2 does not limit the number of authentication attempts. An unauthenticated user may exploit th

TCP/IP function included in the firmware of Mitsubishi Electric GOT2000 series (CoreOS with version -Y and earlier insta

TCP/IP function included in the firmware of Mitsubishi Electric GOT2000 series (CoreOS with version -Y and earlier insta

An authentication bypass vulnerability in MobileIron Core & Connector versions 10.3.0.3 and earlier, 10.4.0.0, 10.4.0.1,

A remote code execution vulnerability in MobileIron Core & Connector versions 10.3.0.3 and earlier, 10.4.0.0, 10.4.0.1,

Dell EMC VxRail versions 4.7.410 and 4.7.411 contain an improper authentication vulnerability. A remote unauthenticated

SolarWinds Serv-U FTP server before 15.2.1 does not validate an argument path.

SolarWinds Serv-U FTP server before 15.2.1 mishandles the CHMOD command.

SolarWinds Serv-U FTP server before 15.2.1 allows remote command execution.

We-com OpenData CMS 2.0 allows SQL Injection via the username field on the administrator login page.

SQL injection can occur in We-com Municipality portal CMS 2.1.x via the cerca/ keywords field.

The Micro Air Vehicle Link (MAVLink) protocol presents no authentication mechanism on its version 1.0 (nor authorization

This issue exists to document that a security improvement in the way that Jira Server and Data Center use velocity templ

The CodePeople Payment Form for PayPal Pro plugin before 1.1.65 for WordPress allows SQL Injection.

A vulnerability in session management for the web-based interface of Cisco Small Business Smart and Managed Switches cou

An issue was discovered on Wavlink WL-WN530HG4 M30HG4.V5030.191116 devices. Multiple buffer overflow vulnerabilities exi

An issue was discovered on Wavlink WL-WN530HG4 M30HG4.V5030.191116 devices. Multiple shell metacharacter injection vulne

An issue was discovered on Zolo Halo devices via the Linkplay firmware. There is Zolo Halo LAN remote code execution. Th

An issue was discovered on various devices via the Linkplay firmware. There is WAN remote code execution without user in

Monsta FTP 2.10.1 or below allows external control of paths used in filesystem operations. This allows attackers to read

Monsta FTP 2.10.1 or below is prone to a server-side request forgery vulnerability due to insufficient restriction of th

php/exec/escapeshellarg in Locutus PHP through 2.0.11 allows an attacker to achieve code execution.

This improper access control vulnerability in Helpdesk allows attackers to get control of QNAP Kayako service. Attackers

In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic

In NGINX Controller 3.3.0-3.4.0, undisclosed API endpoints may allow for a reflected Cross Site Scripting (XSS) attack.

openSIS through 7.4 has Incorrect Access Control.

openSIS through 7.4 allows SQL Injection.

openSIS before 7.4 allows SQL Injection.

In nDPI through 3.2, ndpi_reset_packet_line_info in lib/ndpi_main.c omits certain reinitialization, leading to a use-aft

In nDPI through 3.2, there is a stack overflow in extractRDNSequence in lib/protocols/tls.c.

In nDPI through 3.2, the OpenVPN dissector is vulnerable to a heap-based buffer over-read in ndpi_search_openvpn in lib/

In nDPI through 3.2, the H.323 dissector is vulnerable to a heap-based buffer over-read in ndpi_search_h323 in lib/proto

In nDPI through 3.2, the packet parsing code is vulnerable to a heap-based buffer over-read in ndpi_parse_packet_line_in

Persian VIP Download Script 1.0 allows SQL Injection via the cart_edit.php active parameter.