2020

An exploitable out-of-bounds read vulnerability exists in the way MiniSNMPD version 1.4 parses incoming SNMP packets. A

Improper Input Validation in Nextcloud Server 15.0.7 allows group admins to create users with IDs of system folders.

Exposure of Private Information in Nextcloud Server 16.0.1 causes the server to send it's domain and user IDs to the Nex

Not strictly enough sanitization in the Nextcloud Android app 3.6.0 allowed an attacker to get content information from

Improper permissions preservation in Nextcloud Server 16.0.1 causes sharees to be able to reshare with write permissions

Improper access control in Nextcloud Talk 6.0.3 leaks the existance and the name of private conversations when linked th

Improper neutralization of file names, conversation names and board names in Nextcloud Server 16.0.3, Nextcloud Talk 6.0

Missing escaping of HTML in the Updater of Nextcloud 15.0.5 allowed a reflected XSS when starting the updater from a mal

A missing check in Nextcloud Server 17.0.0 allowed an attacker to set up a new second factor when trying to login.

Dangling remote share attempts in Nextcloud 16 allow a DNS pollution when running long.

A wrong check for the system time in the Android App 3.9.0 causes a bypass of the lock protection when changing the time

Missing sanitization in the iOS App 2.24.4 causes an XSS when opening malicious HTML files.

A bug in Nextcloud Server 17.0.1 causes the workflow rules to depend their behaviour on the file extension when checking

A bug in Nextcloud Server 15.0.2 causes pending 2FA logins to not be correctly expired when the password of the user is

Violation of Secure Design Principles in the iOS App 2.23.0 causes the app to leak its login and token to other Nextclou

Improper authorization in the Circles app 0.17.7 causes retaining access when an email address was removed from a circle

A vulnerability exists in in FortiManager 5.2.1 and earlier and 5.0.10 and earlier in the WebUI FTP backup page

A Cross-site Scripting (XSS) vulnerability exists in FortiManager 5.2.1 and earlier and 5.0.10 and earlier via an unspec

A Command Injection vulnerability exists in FortiManager 5.2.1 and earlier and FortiManager 5.0.10 and earlier via unspe

phppgadmin through 7.12.1 allows sensitive actions to be performed without validating that the request originated from t

mysql_install_db in MariaDB 10.4.7 through 10.4.11 allows privilege escalation from the mysql user account to root becau

IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0, under specialized conditions, could allow an authenticated user

IBM Security Identity Manager 7.0.1 contains hard-coded credentials, such as a password or cryptographic key, which it u

IBM Security Identity Manager 7.0.1 could allow a remote attacker to traverse directories on the system. An attacker cou

IBM Security Directory Server 6.4.0 stores sensitive information in URLs. This may lead to information disclosure if una

IBM Security Directory Server 6.4.0 does not perform an authentication check for a critical resource or functionality al

IBM Security Directory Server 6.4.0 is deployed with active debugging code that can create unintended entry points. IBM

IBM Security Directory Server 6.4.0 could allow a remote attacker to hijack the clicking action of the victim. By persua

IBM Security Directory Server 6.4.0 uses incomplete blacklisting for input validation which allows attackers to bypass a

IBM Security Directory Server 6.4.0 uses weaker than expected cryptographic algorithms that could allow an attacker to d

IBM Security Identity Manager 6.0.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbi

On Samsung mobile devices with O(8.0) and P(9.0) software and an Exynos 8895 chipset, RKP (aka the Samsung Hypervisor EL

Lib/zipfile.py in Python through 3.7.2 allows remote attackers to cause a denial of service (resource consumption) via a

PandoraFMS 742 suffers from multiple XSS vulnerabilities, affecting the Agent Management, Report Builder, and Graph Buil

Cisco Linksys E4200 1.0.05 Build 7 routers contain a Local File Include Vulnerability which could allow remote attackers

Brother MFC-9970CDW 1.10 firmware L devices contain an information disclosure vulnerability which allows remote attacker

D-Link DIR-100 4.03B07 has PPTP and poe information disclosure

D-Link DIR-100 4.03B07: cli.cgi XSS

D-Link DIR-100 4.03B07: cli.cgi CSRF

D-Link DIR-100 4.03B07: security bypass via an error in the cliget.cgi script

D-Link DIR-100 4.03B07: cli.cgi security bypass due to failure to check authentication parameters

webcalendar before 1.2.7 shows the reason for a failed login (e.g., "no such user").

ZPanel 10.0.1 has insufficient entropy for its password reset process.

Ushahidi before 2.6.1 has insufficient entropy for forgot-password tokens.

Joomla! com_mailto 1.5.x through 1.5.13 has an automated mail timeout bypass.

Joomla! 1.7.1 has core information disclosure due to inadequate error checking.

Joomla! core 1.7.1 allows information disclosure due to weak encryption

SysJust Syuan-Gu-Da-Shih, versions before 20191223, contain vulnerability of Cross-Site Scripting(XSS), personal informa

SysJust Syuan-Gu-Da-Shih, versions before 20191223, contain vulnerability of Request Forgery, allowing attackers to laun

SQL Injection in SysJust Syuan-Gu-Da-Shih, versions before 20191223, allowing attackers to perform unwanted SQL queries