2020

gulp-scss-lint through 1.0.0 allows execution of arbitrary commands. It is possible to inject arbitrary commands to the

An issue was discovered in drf-jwt 1.15.x before 1.15.1. It allows attackers with access to a notionally invalidated tok

In parseTrackFragmentRun of MPEG4Extractor.cpp, there is possible resource exhaustion due to improper input validation.

In readCString of Parcel.cpp, there is a possible out of bounds write due to an integer overflow. This could lead to arb

In Bluetooth, there is a possible out of bounds read due to a missing bounds check. This could lead to remote informatio

In Bluetooth, there is a possible out of bounds read due to a missing bounds check. This could lead to remote informatio

In overlay notifications, there is a possible hidden notification due to improper input validation. This could lead to a

In app uninstallation, there is a possible set of permissions that may not be removed from a shared app ID. This could l

In StatsService, there is a possible out of bounds read. This could lead to local information disclosure if UBSAN were n

In libAACdec, there is a possible out of bounds read. This could lead to remote information disclosure, with no addition

An issue was discovered in Walmart Labs Concord before 1.44.0. CORS Access-Control-Allow-Origin headers have a potential

v2rayL 2.1.3 allows local users to achieve root access because /etc/v2rayL/config.json is owned by a low-privileged user

v2rayL 2.1.3 allows local users to achieve root access because /etc/v2rayL/add.sh and /etc/v2rayL/remove.sh are owned by

The dot package v1.1.2 uses Function() to compile templates. This can be exploited by the attacker if they can control t

The package integrity validation in yarn < 1.19.0 contains a TOCTOU vulnerability where the hash is computed before writ

antiX and MX Linux allow local users to achieve root access via "persist-config --command /bin/sh" because of the Sudo c

An arbitrary file read vulnerability exists in system/controller/backend/template.php in QCMS v3.0.1.

An issue was discovered in Janus through 0.9.1. janus.c has multiple concurrent threads that misuse the source property

An issue was discovered in Janus through 0.9.1. plugins/janus_voicemail.c in the VoiceMail plugin has a race condition t

An issue was discovered in Janus through 0.9.1. plugins/janus_videocall.c in the VideoCall plugin mishandles session man

An issue was discovered in Janus through 0.9.1. janus.c tries to use a string that doesn't actually exist during a "quer

An issue was discovered in Janus through 0.9.1. janus_audiobridge.c has a double mutex unlock when listing private rooms

An issue was discovered in psd-tools before 1.9.4. The Cython implementation of RLE decoding did not check for malicious

The sitepress-multilingual-cms (WPML) plugin before 4.3.7-b.2 for WordPress has CSRF due to a loose comparison. This lea

An issue was discovered in Responsive Filemanager through 9.14.0. In the ajax_calls.php file in the save_img action in t

grub2-bhyve, as used in FreeBSD bhyve before revision 525916 2020-02-12, mishandles font loading by a guest through a gr

grub2-bhyve, as used in FreeBSD bhyve before revision 525916 2020-02-12, does not validate the address provided as part

An issue was discovered in the File Upload plugin before 4.13.0 for WordPress. A directory traversal can lead to remote

In wagtail-2fa before 1.4.1, any user with access to the CMS can view and delete other users 2FA devices by going to the

In Administrate (rubygem) before version 0.13.0, when sorting by attributes on a dashboard, the direction parameter was

An issue was discovered in DEVOME GRR before 3.4.1c. frmcontactlist.php mishandles a SQL query.

An issue was discovered in DEVOME GRR before 3.4.1c. admin_edit_room.php mishandles file uploads.

Dell Wyse Management Suite versions prior to 1.4.1 contain a stored cross-site scripting vulnerability when unregisterin

Dell Wyse Management Suite versions prior to 1.4.1 contain a stored cross-site scripting vulnerability. A remote authent

Dell EMC XtremIO XMS versions prior to 6.3.0 contain a stored cross-site scripting vulnerability. A low-privileged malic

Dell EMC XtremIO XMS versions prior to 6.3.0 contain an incorrect permission assignment vulnerability. A malicious local

Dell EMC XtremIO XMS versions prior to 6.3.0 contain an information disclosure vulnerability where OS users’ passwords a

An issue was discovered in Halvotec RaQuest 10.23.10801.0. One of the exposed web services allows an anonymous user to a

Ricoh SP C250DN 1.05 devices allow denial of service (issue 2 of 3). Unauthenticated crafted packets to the IPP service

Ricoh SP C250DN 1.05 devices have a fixed password. FTP service credential were found to be hardcoded within the printer

Ricoh SP C250DN 1.05 devices allow denial of service (issue 1 of 3). Some Ricoh printers were affected by a wrong LPD se

Ricoh SP C250DN 1.05 devices have an Authentication Method Vulnerable to Brute Force Attacks. Some Ricoh printers did no

Some Kyocera printers (such as the ECOSYS M5526cdw 2R7_2000.001.701) were affected by a buffer overflow vulnerability in

Some Kyocera printers (such as the ECOSYS M5526cdw 2R7_2000.001.701) were affected by a buffer overflow vulnerability in

The web application of several Kyocera printers (such as the ECOSYS M5526cdw 2R7_2000.001.701) was affected by Reflected

Some Kyocera printers (such as the ECOSYS M5526cdw 2R7_2000.001.701) did not implement any mechanism to avoid CSRF. Succ

The web application of several Kyocera printers (such as the ECOSYS M5526cdw 2R7_2000.001.701) was affected by Stored XS

Some Kyocera printers (such as the ECOSYS M5526cdw 2R7_2000.001.701) were affected by a buffer overflow vulnerability in

Some Kyocera printers (such as the ECOSYS M5526cdw 2R7_2000.001.701) were affected by a buffer overflow vulnerability in

The web application of some Kyocera printers (such as the ECOSYS M5526cdw 2R7_2000.001.701) was vulnerable to path trave