2020

CRK Business Platform <= 2019.1 allows can inject SQL statements against the DB on any path using the 'strSessao' parame

An issue was discovered in URVE Build 24.03.2020. By using the _internal/pc/vpro.php?mac=0&ip=0&operation=0&usr=0&pass=0

An issue was discovered in URVE Build 24.03.2020. Using the _internal/pc/shutdown.php path, it is possible to shutdown t

An issue was discovered in Programi Bilanc build 007 release 014 31.01.2020 and possibly below. During the installation,

The built-in WEB server for MOXA NPort IAW5000A-I/O firmware version 2.1 or lower allows SSH/Telnet sessions, which may

The built-in web service for MOXA NPort IAW5000A-I/O firmware version 2.1 or lower does not require users to have strong

Firmware version 4.60 of Zyxel USG devices contains an undocumented account (zyfwp) with an unchangeable password. The p

A heap-based buffer overflow in the Treck HTTP Server component before 6.0.1.68 allows remote attackers to cause a denia

The affected versions of S+ Operations (version 2.1 SP1 and earlier) used an approach for user authentication which reli

In S+ Operations and S+ History, it is possible that an unauthenticated user could inject values to the Operations Histo

In S+ Operations and S+ Historian, a successful SQL injection exploit can read sensitive data from the database, modify

Improper input validation in database creation logic in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and ear

Programi Bilanc Build 007 Release 014 31.01.2020 supplies a .exe file containing several hardcoded credentials to differ

An issue was discovered in Programi 014 31.01.2020. It has multiple SQL injection vulnerabilities.

The Graphics Protocol feature in graphics.c in kitty before 0.19.3 allows remote attackers to execute arbitrary code bec

An XXE attack can occur in Kronos WebTA 5.0.4 when SAML is used.

SQL injection vulnerability in SeaCMS 10.1 (2020.02.08) via the id parameter in an edit action to admin_members_group.ph

SQL injection vulnerability in yunyecms V2.0.1 via the selcart parameter.

Loopback 8.0.0 contains a vulnerability that could allow an attacker to manipulate or pollute Javascript values and caus

A signature verification vulnerability exists in crewjam/saml. This flaw allows an attacker to bypass SAML Authenticatio

EgavilanMedia ECM Address Book 1.0 is affected by SQL injection. An attacker can bypass the Admin Login panel through SQ

LimitLoginAttempts.php in the limit-login-attempts-reloaded plugin before 2.17.4 for WordPress allows a bypass of (per I

A potential security vulnerability has been identified in HPE iLO Amplifier Pack server version 1.70. The vulnerability

A potential security vulnerability has been identified in HPE Systems Insight Manager (SIM) version 7.6. The vulnerabili

A vulnerability in the MIME message handling of the HCL Notes v9 client could potentially be exploited by an unauthentic

In DolphinScheduler 1.2.0 and 1.2.1, with mysql connectorj a remote code execution vulnerability exists when choosing my

SQL injection vulnerability in the wp_where function in WeiPHP 5.0.

Eval injection vulnerability in the parserCommom method in the ParserTemplate class in zzz_template.php in zzzphp 1.7.2

There are multiple unauthenticated directory traversal vulnerabilities in different FTP commands in uftpd FTP server ver

An unauthenticated stack-based buffer overflow vulnerability in common.c's handle_PORT in uftpd FTP server versions 2.10

Xinuos (formerly SCO) Openserver v5 and v6 allows attackers to execute arbitrary commands via shell metacharacters in ou

An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) (Exynos chipsets) software. They allo

An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), Q(10.0), and R(11.0) software. Attackers can bypa

A flaw was found in Linux-Pam in versions prior to 1.5.1 in the way it handle empty passwords for non-existing users. Wh

If Apache TomEE 8.0.0-M1 - 8.0.3, 7.1.0 - 7.1.3, 7.0.0-M1 - 7.0.8, 1.0.0 - 1.7.5 is configured to use the embedded Activ

The reported vulnerability allows an attacker who has network access to the device to execute code with specially crafte

A command injection vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2, with the improved pas

A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an attacker to manipulate sy

Time-based SQL injection exists in Spotweb 1.4.9 via the query string.

Fleet is an open source osquery manager. In Fleet before version 3.5.1, due to issues in Go's standard library XML parsi

The contact-form-7 (aka Contact Form 7) plugin before 5.3.2 for WordPress allows Unrestricted File Upload and remote cod

jsonpickle through 1.4.1 allows remote code execution during deserialization of a malicious payload through the decode()

A sensitive information disclosure vulnerability in Kyland KPS2204 6 Port Managed Din-Rail Programmable Serial Device Se

An arbitrary code execution vulnerability in Kyland KPS2204 6 Port Managed Din-Rail Programmable Serial Device Servers S

LogRhythm Platform Manager 7.4.9 allows Command Injection. To exploit this, an attacker can inject arbitrary program nam

The official memcached docker images before 1.5.11-alpine (Alpine specific) contain a blank password for a root user. Sy

The official rabbitmq docker images before 3.7.13-beta.1-management-alpine (Alpine specific) contain a blank password fo

The official haproxy docker images before 1.8.18-alpine (Alpine specific) contain a blank password for a root user. Syst

The official vault docker images before 0.11.6 contain a blank password for a root user. System using the vault docker c

The official drupal docker images before 8.5.10-fpm-alpine (Alpine specific) contain a blank password for a root user. S