2020

A logic issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.0.1, watchOS 7.1, iO

The official irssi docker images before 1.1-alpine (Alpine specific) contain a blank password for a root user. System us

The official notary docker images before signer-0.6.1-1 contain a blank password for a root user. System using the notar

The official spiped docker images before 1.5-alpine contain a blank password for a root user. Systems using the spiped d

The official storm Docker images before 1.2.1 contain a blank password for a root user. Systems using the Storm Docker c

The official Express Gateway Docker images before 1.14.0 contain a blank password for a root user. Systems using the Exp

The official znc docker images before 1.7.1-slim contain a blank password for a root user. Systems using the znc docker

The official eggdrop Docker images before 1.8.4rc2 contain a blank password for a root user. Systems using the Eggdrop D

The official elixir Docker images before 1.8.0-alpine (Alpine specific) contain a blank password for a root user. System

The official Consul Docker images 0.7.1 through 1.4.2 contain a blank password for a root user. System using the Consul

The X.509 GeneralName type is a generic type for representing different types of names. One of those name types is known

The official piwik Docker images before fpm-alpine (Alpine specific) contain a blank password for a root user. Systems u

Kirby is a CMS. In Kirby CMS (getkirby/cms) before version 3.4.5, and Kirby Panel before version 2.5.14 , an editor with

omniauth-apple is the OmniAuth strategy for "Sign In with Apple" (RubyGem omniauth-apple). In omniauth-apple before vers

SourceCodester Student Management System Project in PHP version 1.0 is vulnerable to stored a cross-site scripting (XSS)

API calls in the Translation API feature in Systran Pure Neural Server before 9.7.0 allow a threat actor to use the Syst

A Cross-Site Scripting (XSS) issue in WebUI Translation in Systran Pure Neural Server before 9.7.0 allows a threat actor

Online Bus Booking System Project Using PHP/MySQL version 1.0 has SQL injection via the login page. By placing SQL injec

A Java Serialization vulnerability was found in Apache Tapestry 4. Apache Tapestry 4 will attempt to deserialize the "sp

Kirby is a CMS. In Kirby CMS (getkirby/cms) before version 3.3.6, and Kirby Panel before version 2.5.14 there is a vulne

A flaw was found in Wildfly affecting versions 19.0.0.Final, 19.1.0.Final, 20.0.0.Final, 20.0.1.Final, and 21.0.0.Final.

A flaw was found in the check_chunk_name() function of pngcheck-2.4.0. An attacker able to pass a malicious file to be p

A NULL pointer dereference was found in OpenLDAP server and was fixed in openldap 2.4.55, during a request for renaming

A flaw was found in Ceph-ansible v4.0.41 where it creates an /etc/ceph/iscsi-gateway.conf with insecure default permissi

A vulnerability was found in Moodle 3.9 to 3.9.1, 3.8 to 3.8.4 and 3.7 to 3.7.7 where it was possible to include JavaScr

A vulnerability was found in Moodle where the decompressed size of zip files was not checked against available user quot

A vulnerability was found in Moodle where users with "Log in as" capability in a course context (typically, course manag

The filter in the tag manager required extra sanitizing to prevent a reflected XSS risk. This affects 3.9 to 3.9.1, 3.8

In Kubernetes clusters using Ceph RBD as a storage provisioner, with logging level of at least 4, Ceph RBD admin secrets

In Kubernetes, if the logging level is set to at least 9, authorization and bearer tokens will be written to log files.

In Kubernetes clusters using a logging level of at least 4, processing a malformed docker config file will result in the

In Kubernetes clusters using VSphere as a cloud provider, with a logging level set to 4 or above, VSphere cloud credenti

NLnet Labs Unbound, up to and including version 1.12.0, and NLnet Labs NSD, up to and including version 4.3.3, contain a

In AWStats through 7.7, cgi-bin/awstats.pl?config= accepts an absolute pathname, even though it was intended to only rea

ImageMagick before 6.9.11-40 and 7.x before 7.0.10-40 mishandles the -authenticate option, which allows setting a passwo

IncomCMS 2.0 has a modules/uploader/showcase/script.php insecure file upload vulnerability. This vulnerability allows un

Apache Groovy provides extension methods to aid with creating temporary directories. Prior to this fix, Groovy's impleme

In Apache APISIX, the user enabled the Admin API and deleted the Admin API access IP restriction rules. Eventually, the

PlugIns\IDE_ACDStd.apl in ACDSee Photo Studio Studio Professional 2021 14.0 Build 1705 has a User Mode Write AV starting

An issue was discovered in Intland codeBeamer ALM 10.x through 10.1.SP4. The ReqIF XML data, used by the codebeamer ALM

Inspur NF5266M5 through 3.21.2 and other server M5 devices allow remote code execution via administrator privileges. The

An issue was discovered in Kata Containers through 1.11.3 and 2.x through 2.0-rc1. The runtime will execute binaries giv

There is a buffer overflow vulnerability in several Huawei products. The system does not sufficiently validate certain c

The Eat Spray Love mobile app for both iOS and Android contains logic that allows users to bypass authentication and ret

The Eat Spray Love mobile app for both iOS and Android contains a backdoor account that, when modified, allowed privileg

inSync Client installer for macOS versions v6.8.0 and prior could allow an attacker to gain privileges of a root user fr

Cross-site scripting (XSS) exists in SeedDMS 6.0.13 via the folderid parameter to views/bootstrap/class.DropFolderChoose

sysdeps/i386/ldbl2mpn.c in the GNU C Library (aka glibc or libc6) before 2.23 on x86 targets has a stack-based buffer ov

app/View/Elements/genericElements/SingleViews/Fields/genericField.ctp in MISP 2.4.135 has XSS via the authkey comment fi

The installer of Kaspersky Anti-Ransomware Tool (KART) prior to KART 4.0 Patch C was vulnerable to a DLL hijacking attac