2020

checkpath in OpenRC through 0.42.1 might allow local users to take ownership of arbitrary files because a non-terminal p

eMPS prior to eMPS 9.0 FireEye EX 3500 devices allows remote authenticated users to conduct SQL injection attacks via th

In Wiki.js before version 2.5.162, an XSS payload can be injected in a page title and executed via the search results. W

In Octopus Deploy through 2020.4.2, an attacker could redirect users to an external site via a modified HTTP Host header

opentmpfiles through 0.3.1 allows local users to take ownership of arbitrary files because d entries are mishandled and

The HPE BlueData EPIC Software Platform version 4.0 and HPE Ezmeral Container Platform 5.0 use an insecure method of han

A remote server-side request forgery (ssrf) vulnerability was discovered in Aruba Airwave Software version(s): Prior to

A ZTE product is impacted by an XSS vulnerability. The vulnerability is caused by the lack of correct verification of cl

AntSword 2.1.8.1 contains a cross-site scripting (XSS) vulnerability in the View Site funtion. When viewing an added sit

pathval before version 1.1.1 is vulnerable to prototype pollution.

Multiple Stored Cross Site Scripting (XSS) vulnerabilities exist in the YOURLS Admin Panel, Versions 1.5 - 1.7.10. An au

A Cross-Site Request Forgery (CSRF) vulnerability is identified in FruityWifi through 2.4. Due to a lack of CSRF protect

VMware Horizon Client for Windows (5.x prior to 5.5.0) contains an information disclosure vulnerability. A malicious att

VMware Horizon Server (7.x prior to 7.10.3 or 7.13.0) contains a Cross Site Scripting (XSS) vulnerability. Successful ex

CryptoPro CSP through 5.0.0.10004 on 64-bit platforms allows local users with the SeChangeNotifyPrivilege right to cause

OX App Suite through 7.10.3 allows stats/diagnostic?param= XSS.

OX App Suite through 7.10.3 allows Information Exposure because a user can obtain the IP address and User-Agent string o

OX App Suite through 7.10.3 allows SSRF via the the /ajax/messaging/message message API.

Verifone MX900 series Pinpad Payment Terminals with OS 30251000 have Insecure Permissions, with resultant svc_netcontrol

Verifone VerixV Pinpad Payment Terminals with QT000530 have an undocumented physical access mode (aka VerixV shell.out).

Verifone Pinpad Payment Terminals allow undocumented physical access to the system via an SBI bootloader memory write op

Verifone MX900 series Pinpad Payment Terminals with OS 30251000 allow installation of unsigned packages.

A cross-site scripting (XSS) vulnerability on Comtrend AR-5387un devices with A731-410JAZ-C04_R02.A2pD035g.d23i firmware

Parse Server (npm package parse-server) broadcasts events to all clients without checking if the session token is valid.

Velero (prior to 1.4.3 and 1.5.2) in some instances doesn’t properly manage volume identifiers which may result in infor

An issue was discovered in the Linux kernel through 5.9.1, as used with Xen through 4.14.x. drivers/xen/events/events_ba

An issue was discovered in Xen through 4.14.x allowing x86 PV guest OS users to gain guest OS privileges by modifying ke

An issue was discovered in the Linux kernel through 5.9.1, as used with Xen through 4.14.x. Guest OS users can cause a d

When a link to an external protocol was clicked, a prompt was presented that allowed the user to choose what application

If a valid external protocol handler was referenced in an image tag, the resulting broken image size could be distinguis

An issue has been discovered in GitLab Runner affecting all versions starting from 13.4.0 before 13.4.2, all versions st

In Network Security Services (NSS) before 3.36.7 and before 3.41.1, a malformed signature can cause a crash due to a nul

Microchip CryptoAuthentication Library CryptoAuthLib prior to 20191122 has a Buffer Overflow (issue 1 of 2).

An information disclosure issue was addressed with improved state management. This issue is fixed in macOS Catalina 10.1

This issue was addressed with improved checks. This issue is fixed in macOS Catalina 10.15.6. A local user may be able t

A logic issue was addressed with improved state management. This issue is fixed in macOS Catalina 10.15.6. A user may be

An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 13.6 and iPadOS 13.6, macO

Strapi before 3.2.5 has stored XSS in the wysiwyg editor's preview feature.

Microchip CryptoAuthentication Library CryptoAuthLib prior to 20191122 has a Buffer Overflow (issue 2 of 2).

A logic issue was addressed with improved restrictions. This issue is fixed in macOS Catalina 10.15.5. A person with phy

A logic issue was addressed with improved restrictions. This issue is fixed in iOS 13.4 and iPadOS 13.4, macOS Catalina

A logic issue was addressed with improved restrictions. This issue is fixed in iOS 13.4 and iPadOS 13.4, macOS Catalina

An access issue was addressed with additional sandbox restrictions. This issue is fixed in iOS 13.4 and iPadOS 13.4, mac

A Cross Site Scripting (XSS) issue was discovered in the search feature of DedeCMS v.5.8 that allows malicious users to

AtomXCMS 2.0 is affected by Arbitrary File Read via admin/dump.php

Biscom Secure File Transfer (SFT) before 5.1.1082 and 6.x before 6.0.1011 allows user credential theft.

A cross-site scripting (XSS) vulnerability exists in the 'merge account' functionality in admins.js in BigBlueButton Gre

The FileImporter extension in MediaWiki through 1.35.0 was not properly attributing various user actions to a specific u

The Cosmos Skin for MediaWiki through 1.35.0 has stored XSS because MediaWiki messages were not being properly escaped.

Adobe InDesign version 15.1.2 (and earlier) is affected by a NULL pointer dereference bug that occurs when handling a ma