2020

Certain NETGEAR devices are affected by command injection by an authenticated user. This affects D7800 before 1.0.1.56,

NETGEAR R7800 devices before 1.0.2.74 are affected by a buffer overflow by an authenticated user.

Certain NETGEAR devices are affected by lack of access control at the function level. This affects JGS516PE before 2.6.0

Certain NETGEAR devices are affected by lack of access control at the function level. This affects JGS516PE before 2.6.0

Certain NETGEAR devices are affected by CSRF. This affects GS716Tv3 before 6.3.1.36 and GS724Tv4 before 6.3.1.36.

Use of a Hard-coded Password in VNCserver in Amino Communications AK45x series, AK5xx series, AK65x series, Aria6xx seri

The %PROGRAMDATA%\1E\Client directory in 1E Client 5.0.0.745 and 4.1.0.267 allows remote authenticated users and local u

Vidyo 02-09-/D allows clickjacking via the portal/ URI.

There is an information leak vulnerability in iManager NetEco 6000 versions V600R021C00. A module is lack of authenticat

There is an out-of-bound read vulnerability in huawei smartphone Mate 30 versions earlier than 10.1.0.156 (C00E155R7P2).

There is a use after free vulnerability in Taurus-AL00A versions 10.0.0.1(C00E1R1P1). A module does not deal with specif

server/handler/HistogramQueryHandler.scala in Twitter TwitterServer (aka twitter-server) before 20.12.0, in some configu

There is a resource management error vulnerability in Jackman-AL00D versions 8.2.0.185(C00R2P1). Local attackers constru

OpenCart 3.0.3.6 is affected by cross-site scripting (XSS) in the Profile Image. An admin can upload a profile image as

OpenCart 3.0.3.6 is affected by cross-site scripting (XSS) in the Subject field of mail. This vulnerability can allow an

An attacker-controlled memory allocation size can be passed to the C++ new operator in the CServerManager::HandleBrowseL

nopCommerce Store 4.30 is affected by cross-site scripting (XSS) in the Schedule tasks name field. This vulnerability ca

NCH Express Invoice 8.06 to 8.24 is vulnerable to Reflected XSS in the Quotes List module.

In NCH Express Accounts 8.24 and earlier, an authenticated low-privilege user can enter a crafted URL to access higher-p

NCH Express Accounts 8.24 and earlier allows local users to discover the cleartext password by reading the configuration

An XSS issue was discovered in Roundcube Webmail before 1.2.13, 1.3.x before 1.3.16, and 1.4.x before 1.4.10. The attack

An issue was discovered in Joomla! 2.5.0 through 3.9.22. A missing token check in the emailexport feature of com_privacy

An issue was discovered in Joomla! 3.9.0 through 3.9.22. Improper handling of the username leads to a user enumeration a

A flaw was found in GDM in versions prior to 3.38.2.1. A race condition in the handling of session shutdown makes it pos

In Arista EOS malformed packets can be incorrectly forwarded across VLAN boundaries in one direction. This vulnerability

In EVPN VxLAN setups in Arista EOS, specific malformed packets can lead to incorrect MAC to IP bindings and as a result

dhowden tag before 2020-11-19 allows "panic: runtime error: slice bounds out of range" via readAtomData.

dhowden tag before 2020-11-19 allows "panic: runtime error: slice bounds out of range" via readTextWithDescrFrame.

dhowden tag before 2020-11-19 allows "panic: runtime error: index out of range" via readAPICFrame.

dhowden tag before 2020-11-19 allows "panic: runtime error: index out of range" via readPICFrame.

An issue was discovered in Zammad before 3.5.1. The default signup Role (for newly created Users) can be a privileged Ro

An issue was discovered in Zammad before 3.5.1. An Agent with Customer permissions in a Group can bypass intended access

An issue was discovered in Zammad before 3.4.1. There is Stored XSS via a Tags element in a TIcket.

An account-enumeration issue was discovered in Zammad before 3.4.1. The Create User functionality is implemented in a wa

An issue was discovered in Zammad before 3.4.1. The Tag and Link REST API endpoints (for add and delete) lack a CSRF tok

An issue was discovered in Zammad before 3.4.1. The global-search feature leaks Knowledge Base drafts to Knowledge Base

An issue was discovered in Zammad before 3.4.1. There are wrong authorization checks for impersonation requests via X-On

An issue was discovered in Zammad before 3.4.1. Admin Users without a ticket.* permission can access Tickets.

Panasonic Security System WV-S2231L 4.25 has an insecure hard-coded password of lkjhgfdsa (which is just the asdf keyboa

FOSCAM FHD X1 1.14.2.4 devices allow attackers (with physical UART access) to login via the ipc.fos~ password.

WavPack 5.3.0 has an out-of-bounds write in WavpackPackSamples in pack_utils.c because of an integer overflow in a mallo

The WooCommerce plugin before 4.7.0 for WordPress allows remote attackers to view the status of arbitrary orders via the

CXUUCMS V3 allows XSS via the first and third input fields to /public/admin.php.

CXUUCMS V3 allows class="layui-input" XSS.

XXL-JOB 2.2.0 allows Stored XSS (in Add User) to bypass the 20-character limit via xxl-job-admin/src/main/java/com/xxl/j

Autobahn|Python before 20.12.3 allows redirect header injection.

The serializer module in OAID Tengine lite-v1.0 has a Buffer Overflow and crash. NOTE: another person has stated "I don'

Subrion CMS 4.2.1 is affected by: Cross Site Scripting (XSS) through the avatar[path] parameter in a POST request to the

Savsoft Quiz 5 is affected by: Cross Site Scripting (XSS) via field_title (aka a title on the custom fields page).

CXUUCMS V3 3.1 has a CSRF vulnerability that can add an administrator account via admin.php?c=adminuser&a=add.