2020

Improper certificate validation vulnerability in OpenVPN client in Synology Router Manager (SRM) before 1.2.4-8081 allow

Improper certificate validation vulnerability in OpenVPN client in Synology DiskStation Manager (DSM) before 6.2.3-25426

This affects the package chart.js before 2.9.4. The options parameter is not properly sanitized when it is processed. Wh

NVIDIA DGX servers, all BMC firmware versions prior to 3.38.30, contain a vulnerability in the AMI BMC firmware in which

NVIDIA DGX servers, all BMC firmware versions prior to 3.38.30, contain a vulnerability in the AMI BMC firmware in which

NVIDIA DGX servers, all DGX-1 with BMC firmware versions prior to 3.38.30 and all DGX-2 with BMC firmware versions prior

NVIDIA DGX servers, DGX-1 with BMC firmware versions prior to 3.38.30. DGX-2 with BMC firmware versions prior to 1.06.06

NVIDIA DGX servers, all DGX-1 with BMC firmware versions prior to 3.38.30, contains a Cross-Site Request Forgery (CSRF)

SonarQube 8.4.2.36762 allows remote attackers to discover cleartext SMTP, SVN, and GitLab credentials via the api/settin

Gophish through 0.10.1 does not invalidate the gophish cookie upon logout.

Gophish before 0.11.0 allows the creation of CSV sheets that contain malicious content.

An issue was discovered in QSC Q-SYS Core Manager 8.2.1. By utilizing the TFTP service running on UDP port 69, a remote

An issue was discovered in Dual DHCP DNS Server 7.40. Due to insufficient access restrictions in the default installatio

An issue was discovered in Home DNS Server 0.10. Due to insufficient access restrictions in the default installation dir

Issues were discovered in Open DHCP Server (Regular) 1.75 and Open DHCP Server (LDAP Based) 0.1Beta. Due to insufficient

Issues were discovered in Open TFTP Server multithreaded 1.66 and Open TFTP Server single port 1.66. Due to insufficient

Sectona Spectra before 3.4.0 has a vulnerable SOAP API endpoint that leaks sensitive information about the configured as

Winston 1.5.4 devices have a local www-data user that is overly permissioned, resulting in root privilege escalation.

Winston 1.5.4 devices do not enforce authorization. This is exploitable from the intranet, and can be combined with othe

Winston 1.5.4 devices make use of a Monit service (not managed during the normal user process) which is configured with

The API on Winston 1.5.4 devices is vulnerable to CSRF.

If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. QNAP has al

IBM Sterling Connect Direct for Microsoft Windows 4.7, 4.8, 6.0, and 6.1 could allow a remote attacker to cause a denial

Red Discord Bot before version 3.4.1 has an unauthorized privilege escalation exploit in the Mod module. This exploit al

Shibboleth Identify Provider 3.x before 3.4.6 has a denial of service flaw. A remote unauthenticated attacker can cause

osCommerce Phoenix CE before 1.0.5.4 allows admin/define_language.php CSRF.

The Snap7 server component in version 1.4.1, when an attacker sends a crafted packet with COTP protocol the last-data-un

A vulnerability in the Pulse Connect Secure < 9.1R9 admin web interface could allow an authenticated attacker to perform

A vulnerability in the Pulse Secure Desktop Client < 9.1R9 has Remote Code Execution (RCE) if users can be convinced to

A vulnerability in the Pulse Secure Desktop Client (Linux) < 9.1R9 could allow local attackers to escalate privilege.

A vulnerability in the Pulse Secure Desktop Client (Linux) < 9.1R9 could allow local attackers to perform buffer overflo

A vulnerability in the Pulse Secure Desktop Client (Linux) < 9.1R9 could allow local attackers to escalate privilege.

A vulnerability in the Pulse Secure Desktop Client < 9.1R9 could allow the attacker to perform a MITM Attack if end user

A vulnerability in the Pulse Secure Desktop Client < 9.1R9 allows a restricted user on an endpoint machine can use syste

SonicWall Global VPN client version 4.10.4.0314 and earlier have an insecure library loading (DLL hijacking) vulnerabili

SonicWall Global VPN client version 4.10.4.0314 and earlier allows unprivileged windows user to elevate privileges to SY

An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Catalina 10.15.7, Securi

An out-of-bounds read was addressed with improved input validation. This issue is fixed in macOS Catalina 10.15.7, Secur

This issue was addressed with improved checks. This issue is fixed in macOS Catalina 10.15.7, Security Update 2020-005 H

A memory corruption issue was addressed with improved validation. This issue is fixed in Safari 13.0.1, iOS 13.1 and iPa

A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in m

An issue existed with Siri Suggestions access to encrypted data. The issue was fixed by limiting access to encrypted dat

An out-of-bounds read was addressed with improved input validation. This issue is fixed in watchOS 6.1.2, iOS 13.3.1 and

A logic issue was addressed with improved validation. This issue is fixed in iCloud for Windows 7.17, iTunes 12.10.4 for

A memory corruption issue was addressed with improved memory handling. This issue is fixed in macOS Catalina 10.15.3, Se

An access issue was addressed with improved access restrictions. This issue is fixed in macOS Catalina 10.15.3, Security

A use after free issue was addressed with improved memory management. This issue is fixed in macOS Catalina 10.15.4, Sec

The Zigbee protocol implementation on Texas Instruments CC2538 devices with Z-Stack 3.0.1 does not properly process a ZC

The Zigbee protocol implementation on Texas Instruments CC2538 devices with Z-Stack 3.0.1 does not properly process a ZC

The Zigbee protocol implementation on Texas Instruments CC2538 devices with Z-Stack 3.0.1 does not properly process a ZC