2020

The svglib package through 0.9.3 for Python allows XXE attacks via an svg2rlg call.

An issue was discovered in Simple Machines Forum (SMF) before release 2.0.17. There is SSRF related to Subs-Package.php

A code injection in Nextcloud Desktop Client 2.6.2 for macOS allowed to load arbitrary code when starting the client wit

A missing access control check in Nextcloud Server < 18.0.1, < 17.0.4, and < 16.0.9 causes hide-download shares to be do

A missing check for IPv4 nested inside IPv6 in Nextcloud server < 17.0.1, < 16.0.7, and < 15.0.14 allowed a Server-Side

cs/service/account/AutoCompleteGal.java in Zimbra zm-mailbox before 8.8.15.p8 allows authenticated users to request any

Squid before 4.9, when certain web browsers are used, mishandles HTML in the host (aka hostname) parameter to cachemgr.c

Rock RMS before 1.8.6 mishandles vCard access control within the People/GetVCard/REST controller.

An issue was discovered in the AbuseFilter extension for MediaWiki. includes/special/SpecialAbuseLog.php allows attacker

An issue was discovered in LINBIT csync2 through 2.0. csync_daemon_session in daemon.c neglects to force a failure of a

An XSS vulnerability in qcopd-shortcode-generator.php in the Simple Link Directory plugin before 7.3.5 for WordPress all

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Studio P

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Studio P

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Studio P

Code injection vulnerability in blamer 1.0.0 and earlier may result in remote code execution when the input can be contr

Prototype pollution vulnerability in fastify-multipart < 1.0.5 allows an attacker to crash fastify applications parsing

The uppy npm package < 1.9.3 is vulnerable to a Server-Side Request Forgery (SSRF) vulnerability, which allows an attack

Server-side request forgery (SSRF) vulnerability in Ghost CMS < 3.10.0 allows an attacker to scan local or external netw

Deserialization of Untrusted Data in Liferay Portal prior to 7.2.1 CE GA2 allows remote attackers to execute arbitrary c

The driving interface of Tesla Model 3 vehicles in any release before 2020.4.10 allows Denial of Service to occur due to

RainLoop Webmail before 1.13.0 lacks XSS protection mechanisms such as xlink:href validation, the X-XSS-Protection heade

The WP Live Chat Support plugin before 8.0.33 for WordPress accepts certain REST API calls without invoking the wplc_api

An issue was discovered in includes/head.inc.php in rConfig before 3.9.4. An unauthenticated attacker can retrieve saved

openITCOCKPIT through 3.7.2 allows remote attackers to configure the self::DEVELOPMENT or self::STAGING option by placin

Xmidt cjwt through 1.0.1 before 2019-11-25 maps unsupported algorithms to alg=none, which sometimes leads to untrusted a

Tellabs Optical Line Terminal (OLT) 1150 devices allow Remote Command Execution via the -l option to TELNET or SSH. Tell

The bootloader of the homee Brain Cube V2 through 2.23.0 allows attackers with physical access to gain root access by ma

An issue was discovered in Rivet Killer Control Center before 2.1.1352. IOCTL 0x120004 in KfeCo10X64.sys fails to valida

An issue was discovered in Rivet Killer Control Center before 2.1.1352. IOCTL 0x120404 in KfeCo10X64.sys fails to valida

An issue was discovered in Rivet Killer Control Center before 2.1.1352. IOCTL 0x120404 in KfeCo10X64.sys fails to valida

An issue was discovered in Rivet Killer Control Center before 2.1.1352. IOCTL 0x120444 in KfeCo10X64.sys fails to valida

An issue was discovered in iNextrix ASTPP before 4.0.1. web_interface/astpp/application/config/config.php does not have

An issue was discovered in Rivet Killer Control Center before 2.1.1352. IOCTL 0x120004 in KfeCo10X64.sys fails to valida

There is an improper integrity checking vulnerability on some huawei products. The software of the affected product has

A flaw was found in the way certificate signatures could be forged using collisions found in the SHA-1 algorithm. An att

Huawei smartphone OxfordS-AN00A with versions earlier than 10.0.1.152D(C735E152R3P3),versions earlier than 10.0.1.160(C0

Some Huawei products have a security vulnerability due to improper authentication. A remote attacker needs to obtain som

There is a double free vulnerability in some Huawei products. A local attacker with low privilege may perform some opera

There is an improper authorization vulnerability in several smartphones. The software incorrectly performs an authorizat

There is a logic error vulnerability in several smartphones. The software does not properly restrict certain operation w

There is an improper authentication vulnerability in several smartphones. The applock does not perform a sufficient auth

There is an improper authentication vulnerability in several smartphones. The applock does not perform a sufficient auth

A vulnerability was found in all openshift/mediawiki 4.x.x versions prior to 4.3.0, where an insecure modification vulne

A vulnerability was found in all openshift/postgresql-apb 4.x.x versions prior to 4.3.0, where an insecure modification

A flaw was found in the all pki-core 10.x.x versions, where Token Processing Service (TPS) where it did not properly san

Delta Industrial Automation DOPSoft, Version 4.00.08.15 and prior. Multiple out-of-bounds read vulnerabilities may be ex