2020

In IXP EasyInstall 6.2.13723, there is Lateral Movement (using the Agent Service) against other users on a client system

In IXP EasyInstall 6.2.13723, it is possible to temporarily disable UAC by using the Agent Service on a client system. A

In IXP EasyInstall 6.2.13723, there is Directory Traversal on TCP port 8000 via the Engine Service by an unauthenticated

Memory leak in the OBJ_obj2txt function in LibreSSL before 2.3.1 allows remote attackers to cause a denial of service (m

Buffer overflow in the send_control_msg function in hw/char/virtio-serial-bus.c in QEMU before 2.4.0 allows guest users

Off-by-one error in the OBJ_obj2txt function in LibreSSL before 2.3.1 allows remote attackers to cause a denial of servi

The ne2000_receive function in hw/net/ne2000.c in QEMU before 2.4.0.1 allows attackers to cause a denial of service (inf

Integer overflow in the VNC display driver in QEMU before 2.1.0 allows attachers to cause a denial of service (process c

Cross-site request forgery (CSRF) vulnerability in ownCloud Server before 5.0.15 and 6.0.x before 6.0.2 allows remote at

A Denial of Service vulnerability exists in the WRITE_C function in the msg_server.exe module in SAP NetWeaver 2004s, 7.

A Buffer Overflow vulnerability exists in the Message Server service _MsJ2EE_AddStatistics() function when sending speci

EJB method in Red Hat JBoss BRMS 5; Red Hat JBoss Enterprise Application Platform 5; Red Hat JBoss Operations Network 3.

HashiCorp Vault Enterprise 0.11.0 through 1.3.1 fails, in certain circumstances, to revoke dynamic secrets for a mount i

An issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185. There is a CORS miscon

An issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185. There is a user enumer

An issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185. Certain HTTP security

An issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185. The server allows remo

An issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185. CSRF can be used to se

An issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185. There is stored XSS in

An improper access control vulnerability in FortiMail admin webUI 6.2.0, 6.0.0 to 6.0.6, 5.4.10 and below may allow admi

An improper access control vulnerability in FortiMail admin webUI 6.2.0, 6.0.0 to 6.0.6, 5.4.10 and below may allow admi

Freeciv before 2.3.3 allows remote attackers to cause a denial of service via a crafted packet.

Improper permission or value checking in the CLI console may allow a non-privileged user to obtain Fortinet FortiOS plai

The ECDSA signature implementation in ecdsa.c in Arm Mbed Crypto 2.1 and Mbed TLS through 2.19.1 does not reduce the bli

A hard-coded password vulnerability in the Fortinet FortiSIEM database component version 5.2.5 and below may allow attac

A vulnerability was found in the Undertow HTTP server in versions before 2.0.28.SP1 when listening on HTTPS. An attacker

A Symbolic Link (Symlink) Following vulnerability in the packaging of munge in SUSE Linux Enterprise Server 15; openSUSE

Server-side request forgery (SSRF) vulnerability in feed-proxy.php in extjs 5.0.0.

In JFrog Artifactory 5.x and 6.x, insecure FreeMarker template processing leads to remote code execution, e.g., by modif

Zoho ManageEngine ServiceDesk Plus 11.0 Build 11007 allows XSS. This issue was fixed in version 11.0 Build 11010, SD-839

emfd in Ruckus Wireless Unleashed through 200.7.10.102.64 allows remote attackers to execute OS commands via a POST requ

emfd in Ruckus Wireless Unleashed through 200.7.10.102.64 allows remote attackers to execute OS commands via a POST requ

The apt-cacher-ng package of openSUSE Leap 15.1 runs operations in user owned directory /run/apt-cacher-ng with root pri

FastTrack Admin By Request 6.1.0.0 supports group policies that are supposed to allow only a select range of users to el

FastTrack Admin By Request 6.1.0.0 supports group policies that are supposed to allow only a select range of users to el

sanitize-html before 1.4.3 has XSS.

The WordPress plugin Contact Form Integrated With Google Maps 1.0-2.4 has Stored XSS

Google Android prior to 4.4 has an APK Signature Security Bypass Vulnerability

Directory traversal vulnerability in url_redirect.cgi in Supermicro IPMI before SMT_X9_315 allows authenticated attacker

Splunk 5.0.3 has an Unquoted Service Path in Windows for Universal Forwarder which can allow an attacker to escalate pri

Splunk before 5.0.4 lacks X-Frame-Options which can allow Clickjacking

PrestaShop 1.5.5 allows remote authenticated attackers to execute arbitrary code by uploading a crafted profile and then

mysecureshell 1.31: Local Information Disclosure Vulnerability

MySecureShell 1.31 has a Local Denial of Service Vulnerability

HT Editor 2.0.20 has a Remote Stack Buffer Overflow Vulnerability

BabyGekko before 1.2.4 allows PHP file inclusion.

BabyGekko before 1.2.4 has SQL injection.

Toshiba ConfigFree 8.0.38 has a CF7 File Remote Command Execution Vulnerability

Corel WordPerfect Office X6 16.0.0.388 has a DoS Vulnerability via untrusted pointer dereference

IBM WebSphere MQ 7.1 and 7.5: Queue manager has a DoS vulnerability