2020

A flaw was found in CImg in versions prior to 2.9.3. Integer overflows leading to heap buffer overflows in load_pnm() ca

A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. This flaw allow

In Saibo Cyber Game Accelerator 3.7.9 there is a local privilege escalation vulnerability. Attackers can use the constru

A flaw was found in the Linux kernel’s futex implementation. This flaw allows a local attacker to corrupt system memory

A flaw was found in the Linux kernel. A use-after-free memory flaw was found in the perf subsystem allowing a local atta

A flaw was found in libvirt, where it leaked a file descriptor for `/dev/mapper/control` into the QEMU process. This fil

An exploitable use-after-free vulnerability exists in WebKitGTK browser version 2.30.1 x64. A specially crafted HTML web

A code execution vulnerability exists in the WebSocket functionality of Webkit WebKitGTK 2.30.0. A specially crafted web

A local privilege elevation vulnerability exists in the file system permissions of LogicalDoc 8.5.1 installation. Depend

A use-after-free vulnerability exists in a way Pixar OpenUSD 20.08 processes reference paths textual USD files. A specia

Jenkins CVS Plugin 2.16 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

Jenkins Chaos Monkey Plugin 0.4 and earlier does not perform permission checks in an HTTP endpoint, allowing attackers w

Jenkins Chaos Monkey Plugin 0.3 and earlier does not perform permission checks in several HTTP endpoints, allowing attac

A cross-site request forgery (CSRF) vulnerability in Jenkins Shelve Project Plugin 3.0 and earlier allows attackers to s

Jenkins Plugin Installation Manager Tool 2.1.3 and earlier does not verify plugin downloads.

OpenClinic version 0.8.2 is affected by a medical/test_new.php insecure file upload vulnerability. This vulnerability al

OpenClinic version 0.8.2 is affected by a stored XSS vulnerability in lib/Check.php that allows users of the application

OpenClinic version 0.8.2 is affected by a missing authentication vulnerability that allows unauthenticated users to acce

A flaw was found in the way samba handled file and directory permissions. An authenticated user could use this flaw to g

Check Point Endpoint Security Client for Windows before version E84.20 allows write access to the directory from which t

Valve's Game Networking Sockets prior to version v1.2.0 improperly handles long unreliable segments in function SNP_Rece

An exploitable denial-of-service vulnerability exists in the IPv4 functionality of Allen-Bradley MicroLogix 1100 Program

Improper input validation vulnerability in EC-CUBE versions from 3.0.5 to 3.0.18 allows a remote attacker to cause a den

Improper restriction of rendered UI layers or frames in EC-CUBE versions from 3.0.0 to 3.0.18 leads to clickjacking atta

Stored cross-site scripting vulnerability in GROWI v3.8.1 and earlier allows remote attackers to inject arbitrary script

Reflected cross-site scripting vulnerability in GROWI v4.0.0 and earlier allows remote attackers to inject arbitrary scr

GROWI v4.1.3 and earlier allow remote attackers to obtain information which is not allowed to access via unspecified vec

Cross-site scripting vulnerability in desknet's NEO (desknet's NEO Small License V5.5 R1.5 and earlier, and desknet's NE

Pimcore is an open source digital experience platform. In Pimcore before version 6.8.5 it is possible to modify & create

An SQL injection vulnerability was discovered in Gym Management System In manage_user.php file, GET parameter 'id' is vu

An SQL injection vulnerability was discovered in Car Rental Management System v1.0 can be exploited via the id parameter

SQL injection vulnerability was discovered in Point of Sales in PHP/PDO 1.0, which can be exploited via the id parameter

The file view-chair-list.php in Multi Restaurant Table Reservation System 1.0 does not perform input validation on the t

An SQL injection vulnerability was discovered in Online Doctor Appointment Booking System PHP and Mysql via the q parame

SQL injection vulnerability in BloodX 1.0 allows attackers to bypass authentication.

The Victor CMS v1.0 application is vulnerable to SQL injection via the 'search' parameter on the search.php page.

PHP remote file inclusion in the assign_resume_tpl method in Application/Common/Controller/BaseController.class.php in 7

Python oic is a Python OpenID Connect implementation. In Python oic before version 1.2.1, there are several related cryp

An issue was discovered in Bitrix24 Bitrix Framework (1c site management) 20.0. An "User enumeration and Improper Restri

An exploitable vulnerability exists in the way Pixar OpenUSD 20.05 handles parses certain encoded types. A specially cra

An exploitable vulnerability exists in the way Pixar OpenUSD 20.05 handles parses certain encoded types. A specially cra

An exploitable vulnerability exists in the way Pixar OpenUSD 20.05 handles parses certain encoded types. A specially cra

A heap overflow vulnerability exists in the Pixar OpenUSD 20.05 parsing of compressed string tokens in binary USD files.

A heap overflow vulnerability exists in Pixar OpenUSD 20.05 when the software parses compressed sections in binary USD f

An exploitable Out-of-bounds Write vulnerability exists in the xls_addCell function of libxls 2.0. A specially crafted x

An exploitable out-of-bounds read vulnerability exists in libevm (Ethereum Virtual Machine) of CPP-Ethereum. A specially

The official Crux Linux Docker images 3.0 through 3.4 contain a blank password for a root user. System using the Crux Li

Lepton-CMS 4.7.0 is affected by cross-site scripting (XSS). An attacker can inject the XSS payload in the URL field of t

Online Birth Certificate System Project V 1.0 is affected by cross-site scripting (XSS). This vulnerability can result i

AppImage appimaged before 1.0.3 does not properly check whether a downloaded file is a valid appimage. For example, it w