2020

IBL Online Weather before 4.3.5a allows unauthenticated reflected XSS via the redirect page.

ISPConfig before 3.1.15p3, when the undocumented reverse_proxy_panel_allowed=sites option is manually enabled, allows SQ

Improper neutralization of directives in dynamically evaluated code in Druva inSync Mac OS Client 6.5.0 allows a local,

VDSM and libvirt in Red Hat Enterprise Virtualization Hypervisor (aka RHEV-H) 7-7.x before 7-7.2-20151119.0 and 6-6.x be

NaCl in 2015 allowed the CLFLUSH instruction, making rowhammer attacks possible.

An issue was discovered in the pricing-table-by-supsystic plugin before 1.8.2 for WordPress. It allows CSRF.

An issue was discovered in the pricing-table-by-supsystic plugin before 1.8.2 for WordPress. It allows XSS.

The Software Development Kit of the MiContact Center Business with Site Based Security 8.0 through 9.0.1.0 before KB4962

An issue was discovered in Gurux GXDLMS Director through 8.5.1905.1301. When downloading OBIS codes, it does not verify

Gurux GXDLMS Director prior to 8.5.1905.1301 downloads updates to add-ins and OBIS code over an unencrypted HTTP connect

Improper neutralization of special elements used in an OS command in Druva inSync Windows Client 6.5.0 allows a local, u

Kunena before 5.0.4 does not restrict avatar file extensions to gif, jpeg, jpg, and png. This can lead to XSS and remote

An issue was discovered in the Linux kernel 5.4 and 5.5 through 5.5.6 on the AArch64 architecture. It ignores the top by

The WPJobBoard plugin 5.5.3 for WordPress allows Persistent XSS via the Add Job form, as demonstrated by title and Descr

LiteCart through 2.2.1 allows admin/?app=users&doc=edit_user CSRF to add a user.

Stored Cross-site scripting (XSS) vulnerability in Blackboard Learn/PeopleTool v9.1 allows users to inject arbitrary web

Multiple stored XSS vulnerabilities exist in the 10Web Photo Gallery plugin before 1.5.46 WordPress. Successful exploita

A stored XSS vulnerability exists in the Envira Photo Gallery plugin through 1.7.6 for WordPress. Successful exploitatio

LiteCart through 2.2.1 allows CSV injection via a customer's profile.

OpenSMTPD before 6.6.4 allows remote code execution because of an out-of-bounds read in mta_io in mta_session.c for mult

OpenSMTPD before 6.6.4 allows local users to read arbitrary files (e.g., on some Linux distributions) because of a combi

SolarWinds Orion Platform 2018.4 HF3 (NPM 12.4, NetPath 1.1.4) allows Stored HTML Injection by administrators via the We

An issue was discovered in the Linux kernel 3.16 through 5.5.6. set_fdc in drivers/block/floppy.c leads to a wait_til_re

An exploitable authentication bypass vulnerability exists in the hostname processing of the Moxa AWK-3131A firmware vers

An exploitable improper access control vulnerability exists in the iw_webs account settings functionality of the Moxa AW

An exploitable remote code execution vulnerability exists in the iw_webs configuration parsing functionality of the Moxa

An exploitable denial-of-service vulnerability exists in ServiceAgent functionality of the Moxa AWK-3131A, firmware vers

An exploitable format string vulnerability exists in the iw_console conio_writestr functionality of the Moxa AWK-3131A f

An exploitable command injection vulnerability exists in the hostname functionality of the Moxa AWK-3131A firmware versi

An exploitable command injection vulnerability exists in the iw_webs functionality of the Moxa AWK-3131A firmware versio

An exploitable command injection vulnerability exists in the iwwebs functionality of the Moxa AWK-3131A firmware version

An exploitable use of hard-coded credentials vulnerability exists in multiple iw_* utilities of the Moxa AWK-3131A firmw

An exploitable command injection vulnerability exists in encrypted diagnostic script functionality of the Moxa AWK-3131A

The usage of hard-coded cryptographic keys within the ServiceAgent binary allows for the decryption of captured traffic

An exploitable privilege escalation vulnerability exists in the iw_console functionality of the Moxa AWK-3131A firmware

IBM QRadar Advisor 1.1 through 2.5 could allow an unauthorized attacker to obtain sensitive information from specially c

IBM Qradar Advisor 1.1 through 2.5 with Watson uses weaker than expected cryptographic algorithms that could allow an at

An issue was discovered in the CardGate Payments plugin through 3.1.15 for WooCommerce. Lack of origin authentication in

An issue was discovered in the CardGate Payments plugin through 2.0.30 for Magento 2. Lack of origin authentication in t

A NULL Pointer Dereference exists in libzint in Zint 2.7.1 because multiple + characters are mishandled in add_on in upc

An issue was discovered in the Widgets extension through 1.4.0 for MediaWiki. Improper title sanitization allowed for th

controllers/admin.js in Total.js CMS 13 allows remote attackers to execute arbitrary code via a POST to the /admin/api/w

When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomc

In Apache Tomcat 9.0.0.M1 to 9.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99 the HTTP header parsing code used an approach t

The refactoring present in Apache Tomcat 9.0.28 to 9.0.30, 8.5.48 to 8.5.50 and 7.0.98 to 7.0.99 introduced a regression

Kylin has some restful apis which will concatenate SQLs with the user input string, a user is likely to be able to run m

On TP-Link TL-WR849N 0.9.1 4.16 devices, a remote command execution vulnerability in the diagnostics area can be exploit

includes/options.php in the motors-car-dealership-classified-listings (aka Motors - Car Dealer & Classified Ads) plugin

includes/options.php in the motors-car-dealership-classified-listings (aka Motors - Car Dealer & Classified Ads) plugin

In NETGEAR Nighthawk X10-R900 prior to 1.0.4.24, by sending a DHCP discover request containing a malicious hostname fiel