2020

A flaw was found in Ansible Engine when the module package or service is used and the parameter 'use' is not specified.

A flaw was found in Ansible Engine when a file is moved using atomic_move primitive as the file mode cannot be specified

A flaw was found in the Ansible Engine when the fetch module is used. An attacker could intercept the module, inject a n

An issue was discovered in Joomla! before 3.9.16. The lack of type casting of a variable in a SQL statement leads to a S

An issue was discovered in Joomla! before 3.9.16. Inadequate handling of CSS selectors in the Protostar and Beez3 JavaSc

An issue was discovered in Joomla! before 3.9.16. Missing token checks in the image actions of com_templates lead to CSR

An issue was discovered in Joomla! before 3.9.16. Missing length checks in the user table can lead to the creation of us

An issue was discovered in Joomla! before 3.9.16. Incorrect Access Control in the SQL fieldtype of com_fields allows acc

An issue was discovered in Joomla! before 3.9.16. Various actions in com_templates lack the required ACL checks, leading

CentOS-WebPanel.com (aka CWP) CentOS Web Panel (for CentOS 6 and 7) allows SQL Injection via the /cwp_{SESSION_HASH}/adm

IBM MQ and IBM MQ Appliance 7.1, 7.5, 8.0, 9.0 LTS, 9.1 LTS, and 9.1 CD could allow a local attacker to obtain sensitive

IBM MQ and IBM MQ Appliance 7.1, 7.5, 8.0, 9.0 LTS, 9.1 LTS, and 9.1 CD is vulnerable to a denial of service attack that

IBM MQ and IBM MQ Appliance 7.1, 7.5, 8.0, 9.0 LTS, 9.1 LTS, and 9.1 CD could allow a local attacker to obtain sensitive

IBM Cloud Automation Manager 3.2.1.0 does not renew a session variable after a successful authentication which could lea

Missing output sanitation in Swisscom Centro Grande Centro Grande before 6.16.12, Centro Business 1.0 (ADB) before 7.10.

Missing hostname validation in Swisscom Centro Grande before 6.16.12 allows a remote attacker to inject its local IP add

Incorrect input sanitation in text-oriented user interfaces (telnet, ssh) in Swisscom Centro Grande before 6.16.12 allow

An XSS Injection vulnerability exists in Sangoma FreePBX and PBXact 13, 14, and 15 within the Debug/Test page of the Sup

In OPC Foundation OPC UA .NET Standard codebase 1.4.357.28, servers do not create sufficiently random numbers in OPCFoun

A security flaw was found in Ansible Engine, all Ansible 2.7.x versions prior to 2.7.17, all Ansible 2.8.x versions prio

An issue was discovered in AContent through 1.4. It allows the user to run commands on the server with a low-privileged

Dolibarr ERP/CRM before 10.0.3 has an Insufficient Filtering issue that can lead to user/card.php XSS.

Dolibarr ERP/CRM before 10.0.3 allows XSS because uploaded HTML documents are served as text/html despite being renamed

Dolibarr ERP/CRM before 10.0.3 allows SQL Injection.

Codiad Web IDE through 2.8.4 allows PHP Code injection.

A flaw was found when an OpenSSL security provider is used with Wildfly, the 'enabled-protocols' value in the Wildfly co

LimeSurvey 3.17.7+190627 has XSS via Boxes in application/extensions/PanelBoxWidget/views/box.php or a label title in ap

Easy!Appointments 1.3.0 has a Missing Authorization issue allowing retrieval of hashed passwords and salts.

Easy!Appointments 1.3.0 has a Guessable CAPTCHA issue.

Contao before 4.5.7 has XSS in the system log.

Login filter can access configuration files vulnerability in Micro Focus Service Manager (Web Tier), affecting versions

When TLS is enabled with ssl-endpoint-identification-enabled set to true, Apache Geode fails to perform hostname verific

HTTP methods reveled in Web services vulnerability in Micro Focus Service manager (server), affecting versions 9.40, 9.4

Resource Management Errors vulnerability in TCP function included in the firmware of Mitsubishi Electric MELQIC IU1 seri

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in TCP function include

TCP function included in the firmware of Mitsubishi Electric MELQIC IU1 series IU1-1M20-D firmware version 1.0.7 and ear

Null Pointer Dereference vulnerability in TCP function included in the firmware of Mitsubishi Electric MELQIC IU1 series

TCP function included in the firmware of Mitsubishi Electric MELQIC IU1 series IU1-1M20-D firmware version 1.0.7 and ear

Buffer error vulnerability in TCP function included in the firmware of Mitsubishi Electric MELQIC IU1 series IU1-1M20-D

An improper input validation vulnerability in FortiOS 6.2.1, 6.2.0, 6.0.8 and below until 5.4.0 under admin webUI may al

An Insufficient Verification of Data Authenticity vulnerability in FortiManager 6.2.1, 6.2.0, 6.0.6 and below may allow

A system command injection vulnerability in the FortiAP-S/W2 6.2.1, 6.2.0, 6.0.5 and below, FortiAP 6.0.5 and below and

An Unsafe Search Path vulnerability in FortiClient for Windows online installer 6.2.3 and below may allow a local attack

An Unsafe Search Path vulnerability in FortiClient EMS online installer 6.2.1 and below may allow a local attacker with

gulp-styledocco through 0.0.3 allows execution of arbitrary commands. The argument 'options' of the exports function in

docker-compose-remote-api through 0.1.4 allows execution of arbitrary commands. Within 'index.js' of the package, the fu

gulp-tape through 1.0.0 allows execution of arbitrary commands. It is possible to inject arbitrary commands as part of '

pulverizr through 0.7.0 allows execution of arbitrary commands. Within "lib/job.js", the variable "filename" can be cont

closure-compiler-stream through 0.1.15 allows execution of arbitrary commands. The argument "options" of the exports fun

node-prompt-here through 1.0.1 allows execution of arbitrary commands. The "runCommand()" is called by "getDevices()" fu