2020

GraphicsMagick before 1.3.35 has an integer overflow and resultant heap-based buffer overflow in HuffmanDecodeImage in m

A stored cross-site scripting (XSS) vulnerability exists in the WPForms Contact Form (aka wpforms-lite) plugin before 1.

IBM Tivoli Netcool Impact 7.1.0.0 through 7.1.0.17 is vulnerable to cross-site scripting. This vulnerability allows user

IBM API Connect V5.0.0.0 through 5.0.8.7iFix3 uses weaker than expected cryptographic algorithms that could allow an att

A vulnerability was discovered in the PyYAML library in versions before 5.3.1, where it is susceptible to arbitrary code

Acyba AcyMailing before 6.9.2 mishandles file uploads by admins.

Memcached 1.6.x before 1.6.2 allows remote attackers to cause a denial of service (daemon crash) via a crafted binary pr

KDE Okular before 1.10.0 allows code execution via an action link in a PDF document.

A flaw was found in keycloak before version 9.0.1. When configuring an Conditional OTP Authentication Flow as a post log

A flaw was found in Ansible Engine, all versions 2.7.x, 2.8.x and 2.9.x prior to 2.7.17, 2.8.9 and 2.9.6 respectively, w

The Telegram application through 5.12 for Android, when Show Popup is enabled, might allow physically proximate attacker

The command-line "safety" package for Python has a potential security issue. There are two Python characteristics that a

There is a vulnerability in Apache Traffic Server 6.0.0 to 6.2.3, 7.0.0 to 7.1.8, and 8.0.0 to 8.0.5 with a smuggling at

rConfig before 3.9.5 allows command injection by sending a crafted GET request to lib/crud/search.crud.php since the nod

Motorola FX9500 devices allow remote attackers to conduct absolute path traversal attacks, as demonstrated by PL/SQL Ser

There is a vulnerability in Apache Traffic Server 6.0.0 to 6.2.3, 7.0.0 to 7.1.8, and 8.0.0 to 8.0.5 with a smuggling at

There is a vulnerability in Apache Traffic Server 6.0.0 to 6.2.3, 7.0.0 to 7.1.8, and 8.0.0 to 8.0.5 with a smuggling at

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest Foglight Evolve

This vulnerability allows remote attackers to create arbitrary files on affected installations of Horde Groupware Webmai

This vulnerability allows remote attackers to execute local PHP files on affected installations of Horde Groupware Webma

This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-86

This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-86

This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of ELOG Ele

In Rockwell Automation all versions of FactoryTalk Diagnostics software, a subsystem of the FactoryTalk Services Platfor

Motorola FX9500 devices allow remote attackers to read database files.

In Auto-Maskin RP210E Versions 3.7 and prior, DCU210E Versions 3.7 and prior and Marine Observer Pro (Android App), the

A CWE-79:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists Andov

A CWE-79:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists Andov

A CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exists in Andover Continuum (All versi

A CWE-306: Missing Authentication for Critical Function vulnerability exists in IGSS (Versions 14 and prior using the se

A CWE-22: Improper Limitation of a Pathname to a Restricted Directory exists in IGSS (Versions 14 and prior using the se

A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists in Quantum Ethernet Network module

A CWE-426: Untrusted Search Path vulnerability exists in ZigBee Installation Kit (Versions prior to 1.0.1), which could

The HTTP interface of the Grandstream UCM6200 series is vulnerable to an unauthenticated remote SQL injection via crafte

In OpenWrt LuCI git-20.x, remote unauthenticated attackers can retrieve the list of installed packages and services. NOT

Zim through 0.72.1 creates temporary directories with predictable names. A malicious user could predict and create Zim's

In Auto-Maskin RP210E Versions 3.7 and prior, DCU210E Versions 3.7 and prior and Marine Observer Pro (Android App), the

A CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'), reflective

A CWE-427: Uncontrolled Search Path Element vulnerability exists in ProSoft Configurator (v1.002 and prior), for the PME

This vulnerability allows local attackers to disclose information on affected installations of Parallels Desktop 15.1.2-

This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 15.1.2-4

This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 15.1.2-4

This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 15.1.2-4

This vulnerability allows local attackers to disclose sensitive information on affected installations of Parallels Deskt

This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 15.1.0-4

An issue was discovered in the pricing-table-by-supsystic plugin before 1.8.2 for WordPress. Because there is no permiss

An issue was discovered in Zoho ManageEngine AssetExplorer 6.5. During an upgrade of the Windows agent, it does not vali

AutoUpdater.cs in AutoUpdater.NET before 1.5.8 allows XXE.

The remote keyless system on Honda HR-V 2017 vehicles sends the same RF signal for each door-open request, which might a

Zoho ManageEngine Asset Explorer 6.5 does not validate the System Center Configuration Manager (SCCM) database username