2020

If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. This issue

There is no input validation on the Locale property in an apt transaction. An unprivileged user can supply a full path t

This affects the package codemirror before 5.58.2; the package org.apache.marmotta.webjars:codemirror before 5.58.2. The

The package pimcore/pimcore from 6.7.2 and before 6.8.3 are vulnerable to SQL Injection in data classification functiona

Trend Micro Antivirus for Mac 2020 (Consumer) contains an Error Message Information Disclosure vulnerability that if exp

Trend Micro Antivirus for Mac 2020 (Consumer) contains a race condition vulnerability in the Web Threat Protection Block

Cross-Site Scripting (XSS) vulnerability on WSO2 API Manager 3.1.0. By exploiting a Cross-site scripting vulnerability t

A null pointer dereference flaw was found in samba's Winbind service in versions before 4.11.15, before 4.12.9 and befor

An issue was discovered in Click Studios Passwordstate 8.9 (Build 8973).If the user of the system has assigned himself a

On BIG-IP (LTM, AAM, AFM, Analytics, APM, ASM, DNS, FPS, GTM, Link Controller, PEM) versions 15.1.0-15.1.0.5, 14.1.0-14.

On BIG-IP APM 15.1.0-15.1.0.5, 14.1.0-14.1.2.3, and 13.1.0-13.1.3.3, when multiple HTTP requests from the same client to

On BIG-IP ASM 15.1.0-15.1.0.5, a cross-site scripting (XSS) vulnerability exists in the BIG-IP ASM Configuration utility

IBM Resilient SOAR V38.0 could allow an attacker on the internal net work to provide the server with a spoofed source IP

Hrsale 2.0.0 allows download?type=files&filename=../ directory traversal to read arbitrary files.

IBM Security Directory Server 6.4.0 does not set the secure attribute on authorization tokens or session cookies. Attack

IBM Security Directory Server 6.4.0 generates an error message that includes sensitive information about its environment

On BIG-IP 13.1.0-13.1.3.4, 12.1.0-12.1.5.2, and 11.6.1-11.6.5.2, when negotiating IPSec tunnels with configured, authent

Broadleaf Commerce 5.1.14-GA is affected by cross-site scripting (XSS) due to a slow HTTP post vulnerability.

WSO2 Enterprise Integrator 6.6.0 or earlier contains a stored cross-site scripting (XSS) vulnerability in BPMN explorer

Cleartext transmission of sensitive information vulnerability in DDNS in Synology Router Manager (SRM) before 1.2.4-8081

Cleartext transmission of sensitive information vulnerability in DDNS in Synology DiskStation Manager (DSM) before 6.2.3

Improper access control vulnerability in Synology Router Manager (SRM) before 1.2.4-8081 allows remote attackers to acce

Synology Router Manager (SRM) before 1.2.4-8081 does not set the Secure flag for the session cookie in an HTTPS session,

Synology DiskStation Manager (DSM) before 6.2.3-25426-2 does not set the Secure flag for the session cookie in an HTTPS

NVIDIA DGX servers, all DGX-1 with BMC firmware versions prior to 3.38.30 and all DGX-2 with BMC firmware versions prior

NVIDIA DGX servers, all DGX-1 with BMC firmware versions prior to 3.38.30, contains a vulnerability in the AMI BMC firmw

Cross Site Scripting (XSS) vulnerability in Gophish before 0.11.0 via the IMAP Host field on the account settings page.

The Reset button on the Account Settings page in Gophish before 0.11.0 allows attackers to cause a denial of service via

Gophish before 0.11.0 allows SSRF attacks.

Cross Site Scripting (XSS) vulnerability in Gophish through 0.10.1 via a crafted landing page or email template.

Cross Site Scripting (XSS) vulnerability in Gophish before 0.11.0 via the Host field on the send profile form.

Genexis Platinum-4410 P4410-V2-1.28 devices allow stored XSS in the WLAN SSID parameter. This could allow an attacker to

An Insecure Direct Object Reference vulnerability in Citadel WebCit through 926 allows authenticated remote attackers to

Multiple cross-site scripting (XSS) vulnerabilities in Citadel WebCit through 926 allow remote attackers to inject arbit

Citadel WebCit through 926 allows unauthenticated remote attackers to enumerate valid users within the platform. NOTE: t

The God Kings application 0.60.1 for Android exposes a broadcast receiver to other apps called com.innogames.core.fronte

Winston 1.5.4 devices allow a U-Boot interrupt, resulting in local root access.

If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. QNAP has al

IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to traverse directories on the sys

NeoPost Mail Accounting Software Pro 5.0.6 allows php/Commun/FUS_SCM_BlockStart.php?code= XSS.

Grafana before 7.1.0-beta 1 allows XSS via a query alias for the ElasticSearch datasource.

A vulnerability in the authenticated user web interface of Pulse Connect Secure < 9.1R9 could allow attackers to conduct

A vulnerability in the Pulse Connect Secure / Pulse Policy Secure below 9.1R9 could allow attackers to conduct Cross-Sit

A vulnerability in the Pulse Connect Secure / Pulse Policy Secure < 9.1R9 is vulnerable to arbitrary cookie injection.

A vulnerability in the Pulse Connect Secure < 9.1R9 admin web interface could allow an authenticated attacker to perform

When performing EC scalar point multiplication, the wNAF point multiplication algorithm was used; which leaked partial i

The RandomGameUnit extension for MediaWiki through 1.35 was not properly escaping various title-related data. When certa

The search functionality of the Greenmart theme 2.4.2 for WordPress is vulnerable to XSS.

This issue was addressed with improved checks to prevent unauthorized actions. This issue is fixed in Apple Music 3.4.0

A trust issue was addressed by removing a legacy API. This issue is fixed in iOS 14.0 and iPadOS 14.0, tvOS 14.0. An att