2020

A cross-site request forgery (CSRF) vulnerability in Jenkins Shared Objects Plugin 0.44 and earlier allows attackers to

A cross-site request forgery (CSRF) vulnerability in Jenkins Maven Cascade Release Plugin 1.3.2 and earlier allows attac

Jenkins Maven Cascade Release Plugin 1.3.2 and earlier does not perform permission checks in several HTTP endpoints, all

Jenkins Persona Plugin 2.4 and earlier allows users with Overall/Read permission to read arbitrary files on the Jenkins

Jenkins Release Plugin 2.10.2 and earlier does not escape the release version in badge tooltip, resulting in a stored cr

Jenkins Active Choices Plugin 2.4 and earlier does not escape some return values of sandboxed scripts for Reactive Refer

Jenkins Active Choices Plugin 2.4 and earlier does not escape the name and description of build parameters, resulting in

In Jenkins Audit Trail Plugin 3.6 and earlier, the default regular expression pattern could be bypassed in many cases by

Jenkins Audit Trail Plugin 3.6 and earlier applies pattern matching to a different representation of request URL paths t

An issue was discovered on D-Link DSR-250N before 3.17B devices. The CGI script upgradeStatusReboot.cgi can be accessed

In SourceCodester Online Bus Booking System 1.0, there is XSS through the name parameter in book_now.php.

PHPGurukul hospital-management-system-in-php 4.0 allows XSS via admin/patient-search.php, doctor/search.php, book-appoin

PHPGurukul hostel-management-system 2.1 allows XSS via Guardian Name, Guardian Relation, Guardian Contact no, Address, o

PyroCMS 3.7 is vulnerable to cross-site request forgery (CSRF) via the admin/pages/delete/ URI: pages will be deleted.

A vulnerability in the CLI of Cisco StarOS operating system for Cisco ASR 5000 Series Routers could allow an authenticat

A vulnerability in the CLI of Cisco StarOS operating system for Cisco ASR 5000 Series Routers could allow an authenticat

A vulnerability in the web-based management interface of Cisco Vision Dynamic Signage Director could allow an unauthenti

A vulnerability in the configuration restore feature of Cisco Nexus Data Broker software could allow an unauthenticated,

A vulnerability in the Session Initiation Protocol (SIP) of Cisco Expressway Series and Cisco TelePresence Video Communi

A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) Software could allow an au

A vulnerability in the antispam protection mechanisms of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA)

A vulnerability in the management REST API of Cisco Industrial Network Director (IND) could allow an authenticated, remo

A vulnerability in the Cisco Discovery Protocol of Cisco Video Surveillance 8000 Series IP Cameras could allow an unauth

A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, rem

A vulnerability in the web-based management interface of Cisco Firepower Management Center could allow an authenticated,

Smarter Coffee Maker before 2nd generation allows firmware replacement without authentication or authorization. User int

SoPlanning before 1.47 doesn't correctly check the security key used to publicly share plannings. It allows a bypass to

Contao before 4.4.52, 4.9.x before 4.9.6, and 4.10.x before 4.10.1 have Improper Input Validation. It is possible to inj

In GLPI before version 9.5.2, there is a SQL Injection in the API's search function. Not only is it possible to break th

Unquoted service path vulnerability in McAfee File and Removable Media Protection (FRP) prior to 5.3.0 allows local user

In kdeconnect-kde (aka KDE Connect) before 20.08.2, an attacker on the local network could send crafted packets that tri

In GLPI before version 9.5.2, there is a leakage of user information through the public FAQ. The issue was introduced in

ImpressCMS 1.4.0 is affected by XSS in modules/system/admin.php which may result in arbitrary remote code execution.

Cure53 DOMPurify before 2.0.17 allows mutation XSS. This occurs because a serialize-parse roundtrip does not necessarily

An issue was discovered in the GAEN (aka Google/Apple Exposure Notifications) protocol through 2020-10-05, as used in CO

Multiple buffer overflow vulnerabilities were found in the QUIC image decoding process of the SPICE remote display syste

Cross-site scripting (XSS) vulnerabilities in Symphony CMS 3.0.0 allow remote attackers to inject arbitrary web script o

Membership changes are not reflected in ToDo subscriptions in GitLab versions prior to 13.2.10, 13.3.7 and 13.4.2, allow

Improper group membership validation when deleting a user account in GitLab >=7.12 allows a user to delete own account w

In GitLab versions prior to 13.2.10, 13.3.7 and 13.4.2, improper authorization checks allow a non-member of a project/gr

Affected versions of Jira Server & Data Center allow a remote attacker with limited (non-admin) privileges to view a Jir

An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) software. Sticker Center allows direc

An issue was discovered on Samsung mobile devices with Q(10.0) software. The DynamicLockscreen Terms and Conditions can

An issue has been discovered in GitLab affecting all versions starting from 10.8. Reflected XSS on Multiple Routes

A potential DOS vulnerability was discovered in GitLab versions 13.1, 13.2 and 13.3. The api to update an asset as a lin

A path validation issue in WhatsApp for iOS prior to v2.20.61 and WhatsApp Business for iOS prior to v2.20.61 could have

An issue when unzipping docx, pptx, and xlsx documents in WhatsApp for iOS prior to v2.20.61 and WhatsApp Business for i

Receiving a large text message containing URLs in WhatsApp for iOS prior to v2.20.91.4 could have caused the application

Electron before versions 11.0.0-beta.6, 10.1.2, 9.3.1 or 8.5.2 is vulnerable to a context isolation bypass. Apps using b

"HCL AppScan Enterprise makes use of broken or risky cryptographic algorithm to store REST API user details."