2020

All versions of com.gradle.plugin-publish before 0.11.0 are vulnerable to Insertion of Sensitive Information into Log Fi

The "Apache NetBeans" autoupdate system does not fully validate code signatures. An attacker could modify the downloaded

The "Apache NetBeans" autoupdate system does not validate SSL certificates and hostnames for https based downloads. This

Zoho ManageEngine Desktop Central before 10.0.483 allows unauthenticated users to access PDFGenerationServlet, leading t

In webERP 4.15, the Import Bank Transactions function fails to sanitize the content of imported MT940 bank statement fil

An issue was discovered in Open Source Social Network (OSSN) through 5.3. A user-controlled file path with a weak crypto

When MELSOFT transmission port (UDP/IP) of Mitsubishi Electric MELSEC iQ-R series (all versions), MELSEC iQ-F series (al

Toyota 2017 Model Year DCU (Display Control Unit) allows an unauthenticated attacker within Bluetooth range to cause a d

Local Privilege Escalation can occur in PHOENIX CONTACT PORTICO SERVER through 3.0.7 when installed to run as a service.

An exploitable denial of service vulnerability exists in the GstRTSPAuth functionality of GStreamer/gst-rtsp-server 1.14

Insecure, default path permissions in PHOENIX CONTACT PC WORX SRT through 1.14 allow for local privilege escalation.

GitLab 8.10 and later through 12.9 is vulnerable to an SSRF in a project import note feature.

GitLab EE/CE 11.1 through 12.9 is vulnerable to parameter tampering on an upload feature that allows an unauthorized use

GitLab through 12.9 is affected by a potential DoS in repository archive download.

In GitLab EE 11.7 through 12.9, the NPM feature is vulnerable to a path traversal issue.

GitLab EE/CE 8.11 through 12.9.1 allows blocked users to pull/push docker images.

The custom-searchable-data-entry-system (aka Custom Searchable Data Entry System) plugin through 1.7.1 for WordPress all

The Kubernetes API server component in versions prior to 1.15.9, 1.16.0-1.16.6, and 1.17.0-1.17.2 has been found to be v

The Kubelet component in versions 1.15.0-1.15.9, 1.16.0-1.16.6, and 1.17.0-1.17.2 has been found to be vulnerable to a d

In NGINX Controller versions prior to 3.2.0, an unauthenticated attacker with network access to the Controller API can c

On BIG-IP 15.1.0-15.1.0.1, 15.0.0-15.0.1.1, and 14.1.0-14.1.2.2, under certain conditions, TMM may crash or stop process

On BIG-IP 12.1.0-12.1.5, the TMM process may produce a core file in some cases when Ram Cache incorrectly optimizes stor

On BIG-IP 15.0.0-15.1.0.2, 14.1.0-14.1.2.3, 13.1.0-13.1.3.2, 12.1.0-12.1.5.1, and 11.5.2-11.6.5.1 and BIG-IQ 7.0.0, 6.0.

On BIG-IP 15.1.0.1, specially formatted HTTP/3 messages may cause TMM to produce a core file.

On BIG-IP 15.0.0-15.0.1.2, 14.1.0-14.1.2.2, 13.1.0-13.1.3.2, 12.1.0-12.1.5, and 11.5.2-11.6.5.1 and BIG-IQ 7.0.0, 6.0.0-

On BIG-IP 15.0.0-15.0.1, 14.1.0-14.1.2.2, 13.1.0-13.1.3.1, 12.1.0-12.1.5, and 11.5.2-11.6.5.1, undisclosed HTTP behavior

MITRE is populating this ID because it was assigned prior to Lenovo becoming a CNA. A vulnerability was discovered (fixe

MITRE is populating this ID because it was assigned prior to Lenovo becoming a CNA. A directory traversal vulnerability

MITRE is populating this ID because it was assigned prior to Lenovo becoming a CNA. A local privilege escalation vulnera

MITRE is populating this ID because it was assigned prior to Lenovo becoming a CNA. A vulnerability was reported (fixed

MITRE is populating this ID because it was assigned prior to Lenovo becoming a CNA. A race condition was reported (fixed

MITRE is populating this ID because it was assigned prior to Lenovo becoming a CNA. A local privilege escalation vulnera

MITRE is populating this ID because it was assigned prior to Lenovo becoming a CNA. A local privilege escalation vulnera

MITRE is populating this ID because it was assigned prior to Lenovo becoming a CNA. A buffer overflow vulnerability was

An insecure direct object reference in webmail in totemo totemomail 7.0.0 allows an authenticated remote user to read an

In Advantech WebAccess, Versions 8.4.2 and prior. A stack-based buffer overflow vulnerability caused by a lack of proper

An attacker with the ability to generate session IDs or password reset tokens, either by being able to authenticate or b

It's possible to craft Lost Password requests with wildcards in the Token value, which allows attacker to retrieve valid

Attacker is able craft an article with a link to the customer address book with malicious content (JavaScript). When age

Support bundle generated files could contain sensitive information that might be unwanted to be disclosed. This issue af

In the login screens (in agent and customer interface), Username and Password fields use autocomplete, which might be co

Sunnet eHRD, a human training and development management system, contains a vulnerability of Broken Access Control. Afte

Sunnet eHRD, a human training and development management system, contains vulnerability of Cross-Site Scripting (XSS), a

Sunnet eHRD, a human training and development management system, improperly stores system files. Attackers can use a spe

UltraLog Express device management interface does not properly filter user inputted string in some specific parameters,

UltraLog Express device management software stores user’s information in cleartext. Any user can obtain accounts informa

UltraLog Express device management interface does not properly perform access authentication in some specific pages/func

Osmand through 2.0.0 allow XXE because of binary/BinaryMapIndexReader.java.

Azkaban through 3.84.0 allows XXE, related to validator/XmlValidatorManager.java and user/XmlUserManager.java.

Mulesoft APIkit through 1.3.0 allows XXE because of validation/RestXmlSchemaValidator.java