2020

CouchDB version 3.0.0 shipped with a new configuration setting that governs access control to the entire database server

Panasonic P110, Eluga Z1 Pro, Eluga X1, and Eluga X1 Pro devices through 2020-04-10 have Insecure Permissions. NOTE: the

The administrative UI component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server for AWS

An issue was discovered in SmartBear ReadyAPI SoapUI Pro 3.2.5. Due to unsafe use of an Java RMI based protocol in an un

WSO2 API Manager 3.0.0 does not properly restrict outbound network access from a Publisher node, opening up the possibil

Video Insight VMS versions prior to 7.6.1 allow remote attackers to conduct code injection attacks via unspecified vecto

Whale Browser Installer before 1.2.0.5 versions don't support signature verification for Flash installer.

Netsweeper through 6.4.3 allows unauthenticated remote code execution because webadmin/tools/unixlogin.php (with certain

The management tool in MyLittleAdmin 3.8 allows remote attackers to execute arbitrary code because machineKey is hardcod

Panasonic P99 devices through 2020-04-10 have Incorrect Access Control. NOTE: the vendor states that all affected produc

Jenzabar JICS (aka Internet Campus Solution) before 9.0.1 Patch 3, 9.1 before 9.1.2 Patch 2, and 9.2 before 9.2.2 Patch

A use-after-free is possible due to an error in lifetime management in the request adaptor when a malicious client invok

An issue was discovered in AODDriver2.sys in AMD OverDrive. The vulnerable driver exposes a wrmsr instruction via IOCTL

rConfig 3.9.4 is vulnerable to session fixation because session expiry and randomization are mishandled. The application

OpenTrace, as used in COVIDSafe through v1.0.17, TraceTogether, ABTraceTogether, and other applications on iOS and Andro

In Cherokee through 1.2.104, remote attackers can trigger an out-of-bounds write in cherokee_handler_cgi_add_env_pair in

An issue was discovered in the Elementor Pro plugin before 2.9.4 for WordPress, as exploited in the wild in May 2020 in

An issue was discovered in Mikrotik-Router-Monitoring-System through 2018-10-22. SQL Injection exists in check_community

Morita Shogi 64 through 2020-05-02 for Nintendo 64 devices allows remote attackers to execute arbitrary code via crafted

Lack of output sanitization allowed an attack to execute arbitrary shell commands via the logkitty npm package before ve

scikit-learn (aka sklearn) through 0.23.0 can unserialize and execute commands from an untrusted file that is passed to

pandas through 1.0.3 can unserialize and execute commands from an untrusted file that is passed to the read_pickle() fun

MISP MISP-maltego 1.4.4 incorrectly shares a MISP connection across users in a remote-transform use case.

SecureCRT before 8.7.2 allows remote attackers to execute arbitrary code via an Integer Overflow and a Buffer Overflow b

An issue was discovered on D-Link DAP-1360 revision F devices. Remote attackers can start a telnet service without autho

eQ-3 Homematic Central Control Unit (CCU)2 through 2.51.6 and CCU3 through 3.51.6 allow Remote Code Execution in the JSO

Improper Input Validation vulnerability in the cevakrnl.rv0 module as used in the Bitdefender Engines allows an attacker

Opto 22 SoftPAC Project Version 9.6 and prior. SoftPAC communication does not include any credentials. This allows an at

Opto 22 SoftPAC Project Version 9.6 and prior. SoftPACAgent communicates with SoftPACMonitor over network Port 22000. Ho

Airbrush FW's scratch memory allocator is susceptible to numeric overflow. When the overflow occurs, the next allocation

In a2dp_aac_decoder_cleanup of a2dp_aac_decoder.cc, there is a possible invalid free due to memory corruption. This coul

Veritas APTARE versions prior to 10.4 included code that bypassed the normal login process when specific authentication

Apache Camel Netty enables Java deserialization by default. Apache Camel 2.22.x, 2.23.x, 2.24.x, 2.25.0, 3.0.0 up to 3.1

Apache Camel RabbitMQ enables Java deserialization by default. Apache Camel 2.22.x, 2.23.x, 2.24.x, 2.25.0, 3.0.0 up to

A buffer overflow vulnerability has been found in the baremetal component of Apache CloudStack. This applies to all vers

Bond JetSelect (all versions) has an issue in the Java class (ENCtool.jar) and corresponding password generation algorit

An authentication bypass vulnerability in the Panorama context switching feature allows an attacker with network access

WordPress Plugin Simple File List before 4.2.8 is prone to a vulnerability that lets attackers delete arbitrary files be

Some Dahua products with Build time before December 2019 have Session ID predictable vulnerabilities. During normal user

In FreeBSD 12.1-STABLE before r360971, 12.1-RELEASE before p5, 11.4-STABLE before r360971, 11.4-BETA1 before p1 and 11.3

In FreeBSD 12.1-STABLE before r356911, and 12.1-RELEASE before p5, insufficient checking in the cryptodev module allocat

TRENDnet ProView Wireless camera TV-IP512WN 1.0R 1.0.4 is vulnerable to an unauthenticated stack-based buffer overflow i

Ping Identity PingID SSH before 4.0.14 contains a heap buffer overflow in PingID-enrolled servers. This condition can be

In XWiki Platform 7.2 through 11.10.2, registered users without scripting/programming permissions are able to execute py

SAP Business Objects Business Intelligence Platform (Live Data Connect), versions 1.0, 2.0, 2.1, 2.2, 2.3, allows an att

OpenConnect 8.09 has a buffer overflow, causing a denial of service (application crash) or possibly unspecified other im

The Apache NuttX (Incubating) project provides an optional separate "apps" repository which contains various optional co

There is a vulnerability in actionpack_page-caching gem < v1.2.1 that allows an attacker to write arbitrary files to a w

A malformed JSON payload that is received from an UpdateHub server may trigger memory corruption in the Zephyr OS. This

Apache log4net versions before 2.0.10 do not disable XML external entities when parsing log4net configuration files. Thi