2020

ISPConfig 3.0.4.3: the "Add new Webdav user" can chmod and chown entire server from client interface.

mIRC before 6.35 allows attackers to cause a denial of service (crash) via a long nickname.

UNIX Symbolic Link (Symlink) Following vulnerability in the trousers package of SUSE Linux Enterprise Server 15 SP1; ope

Umbraco CMS 8.2.2 allows CSRF to enable/disable or delete user accounts.

Incorrect access control in the web interface in Ruckus Wireless Unleashed through 200.7.10.102.64 allows remote informa

SSRF in AjaxRestrictedCmdStat in zap in Ruckus Wireless Unleashed through 200.7.10.102.64 allows a remote denial of serv

In Secure Headers (RubyGem secure_headers), a directive injection vulnerability is present in versions before 3.8.0, 5.1

In Secure Headers (RubyGem secure_headers), a directive injection vulnerability is present in versions before 3.9.0, 5.2

In PrivateBin versions 1.2.0 before 1.2.2, and 1.3.0 before 1.3.2, a persistent XSS attack is possible. Under certain co

A timing vulnerability in the Scalar::check_overflow function in Parity libsecp256k1-rs before 0.3.1 potentially allows

An issue was discovered on Eaton 5P 850 devices. The Ubicacion SAI field allows XSS attacks by an administrator.

A NULL pointer dereference is present in libyang before v1.0-r3 in the function lys_extension_instances_free() due to a

A double-free is present in libyang before v1.0-r1 in the function yyparse() when an organization field is not terminate

A segmentation fault is present in yyparse in libyang before v1.0-r1 due to a malformed pattern statement value during l

A stack consumption issue is present in libyang before v1.0-r1 due to the self-referential union type containing leafref

A double-free is present in libyang before v1.0-r3 in the function yyparse() when a type statement in used in a notifica

A double-free is present in libyang before v1.0-r1 in the function yyparse() when an empty description is used. Applicat

An invalid memory access flaw is present in libyang before v1.0-r1 in the function resolve_feature_value() when an if-fe

An invalid memory access flaw is present in libyang before v1.0-r3 in the function resolve_feature_value() when an if-fe

emfd in Ruckus Wireless Unleashed through 200.7.10.102.64 allows remote attackers to execute OS commands via a POST requ

emfd in Ruckus Wireless Unleashed through 200.7.10.102.64 allows remote attackers to execute OS commands via a POST requ

A stack-based buffer overflow in zap_parse_args in zap.c in zap in Ruckus Unleashed through 200.7.10.102.64 allows remot

A Cross-Site Scripting (XSS) vulnerability exists in the admin login screen in Phorum before 5.2.18.

In uftpd before 2.11, it is possible for an unauthenticated user to perform a directory traversal attack using multiple

Incorrect access control in the web interface in Ruckus Wireless Unleashed through 200.7.10.102.64 allows remote credent

AjaxRestrictedCmdStat in zap in Ruckus Wireless Unleashed through 200.7.10.102.64 allows remote code execution via a POS

Directory Traversal in ruckus_cli2 in Ruckus Wireless Unleashed through 200.7.10.102.64 allows a remote attacker to jail

Waitress through version 1.3.1 allows request smuggling by sending the Content-Length header twice. Waitress would heade

WebKitGTK+ before 2.14.0: A use-after-free vulnerability can allow remote attackers to cause a DoS

Gallery Plugin1.4 for WordPress has a Remote File Include Vulnerability

The Chrome Plugin for Rapid7 AppSpider can incorrectly keep browser sessions active after recording a macro, even after

A reverse proxy issue exists in FluxBB before 1.4.7 when FORUM_BEHIND_REVERSE_PROXY is enabled.

An Access Control vulnerability exists in the Facebook, Twitter, and Embedded plugins in Vanilla Forums before 2.0.17.9.

An issue exists in Vanilla Forums before 2.0.17.9 due to the way cookies are handled.

Cross-Site Request Forgery (CSRF) vulnerability exists in panel.php in UseBB before 1.0.12.

The Elementor Page Builder plugin before 2.8.4 for WordPress does not sanitize data during creation of a new template.

It has been reported that cross-site scripting (XSS) is possible in Forcepoint Web Security, version 8.x, via host heade

A File Inclusion vulnerability exists in act parameter to admin.php in UseBB before 1.0.12.

A Cross-site Scripting (XSS) vulnerability exists in the Serendipity freetag plugin before 3.30 in the tagcloud paramete

Multiple Cross-site Scripting (XSS) vulnerabilities exist in Joomla! through 1.7.0 in index.php in the search word, exte

The Calculated Fields Form plugin through 1.0.353 for WordPress suffers from multiple Stored XSS vulnerabilities present

The following versions of MAXPRO VMS and NVR, MAXPRO VMS:HNMSWVMS prior to Version VMS560 Build 595 T2-Patch, HNMSWVMSLT

The following versions of MAXPRO VMS and NVR, MAXPRO VMS:HNMSWVMS prior to Version VMS560 Build 595 T2-Patch, HNMSWVMSLT

A Cross-site Request Forgery (CSRF) vulnerability exists in Advanced Electron Forums (AEF) through 1.0.9 due to inadequa

A CWE-427:Uncontrolled Search Path Element vulnerability exists in MSX Configurator (Software Version prior to V1.0.8.1)

In schema-inspector before 1.6.9, a maliciously crafted JavaScript object can bypass the `sanitize()` and the `validate(

BibTeX-ruby before 5.1.0 allows shell command injection due to unsanitized user input being passed directly to the built

The wpa_supplicant system service in Samsung Galaxy Gear series allows an unprivileged process to fully control the Wi-F

The wemail_consumer_service (from the built-in application wemail) in Samsung Galaxy Gear series allows an unprivileged

Samsung Galaxy Gear series before build RE2 includes the hcidump utility with no privilege or permission restriction. Th