2020

The wnoti system service in Samsung Galaxy Gear series allows an unprivileged process to take over the internal notifica

The SoundServer/FocusServer system services in Tizen allow an unprivileged process to perform media-related system actio

The system-popup system service in Tizen allows an unprivileged process to perform popup-related system actions, due to

The Enlightenment system service in Tizen allows an unprivileged process to fully control or capture windows, due to imp

The bt/bt_core system service in Tizen allows an unprivileged process to create a system user interface and control the

The BlueZ system service in Tizen allows an unprivileged process to partially control Bluetooth or acquire sensitive inf

The PulseAudio system service in Tizen allows an unprivileged process to control its A2DP MediaEndpoint, due to improper

The pkgmgr system service in Tizen allows an unprivileged process to perform package management actions, due to improper

ImpressPages CMS v1.0.12 has Unspecified Remote Code Execution (fixed in v1.0.13)

An issue was discovered in Simple Machines Forum (SMF) before 2.0.16. Reverse tabnabbing can occur because of use of _bl

In postfix-mta-sts-resolver before 0.5.1, All users can receive incorrect response from daemon under rare conditions, re

Lifesize Express ls ex2_4.7.10 2000 (14) devices allow XSS via the interface/interface.php brand parameter.

xmlStringLenDecodeEntities in parser.c in libxml2 2.9.10 has an infinite loop in a certain end-of-file situation.

Honor V30 smartphones with versions earlier than 10.0.1.135(C00E130R4P1) have an improper authentication vulnerability.

xmlSchemaPreRun in xmlschemas.c in libxml2 2.9.10 allows an xmlSchemaValidateStream memory leak.

repodata_schema2id in repodata.c in libsolv before 0.7.6 has a heap-based buffer over-read via a last schema whose lengt

There is an integer overflow vulnerability in LDAP server of some Huawei products. Due to insufficient input validation,

There is an integer overflow vulnerability in LDAP client of some Huawei products. Due to insufficient input validation,

MultiTech Conduit MTCDT-LVW2-24XX 1.4.17-ocea-13592 devices allow remote authenticated administrators to execute arbitra

Trustwave ModSecurity 3.0.0 through 3.0.3 allows an attacker to send crafted requests that may, when sent quickly in lar

storeBackup.pl in storeBackup through 3.5 relies on the /tmp/storeBackup.lock pathname, which allows symlink attacks tha

A vulnerability in WhatsApp Desktop versions prior to 0.3.9309 when paired with WhatsApp for iPhone versions prior to 2.

Grin through 2.1.1 has Insufficient Validation.

The Meinberg SyncBox/PTP/PTPv2 devices have default SSH keys which allow attackers to get root access to the devices. Al

The marketo-forms-and-tracking plugin through 1.0.2 for WordPress allows wp-admin/admin.php?page=marketo_fat CSRF with r

HUAWEI Mate 20 smart phones with versions earlier than 10.0.0.175(C00E70R3P8) have an insufficient authentication vulner

Jama Connect 8.44.0 is vulnerable to stored Cross-Site Scripting

USG9500 with versions of V500R001C30SPC100, V500R001C30SPC200, V500R001C30SPC600, V500R001C60SPC500, V500R005C00SPC100,

Cacti through 1.2.7 is affected by a graphs.php?template_id= SQL injection vulnerability affecting how template identifi

An issue was discovered in the Huge-IT gallery-images plugin before 1.9.0 for WordPress. The headers Client-Ip and X-For

The update process in Xmind 3.4.1 and earlier allow remote attackers to execute arbitrary code via a man-in-the-middle a

apt-cacher-ng through 3.3 allows local users to obtain sensitive information by hijacking the hardcoded TCP port. The /u

There is a use-after-free issue in all samba 4.9.x versions before 4.9.18, all samba 4.10.x versions before 4.10.12 and

log.c in Squid Analysis Report Generator (sarg) through 2.3.11 allows local privilege escalation. By default, it uses a

All samba versions 4.9.x before 4.9.18, 4.10.x before 4.10.12 and 4.11.x before 4.11.5 have an issue where if it is set

There is an issue in all samba 4.11.x versions before 4.11.5, all samba 4.10.x versions before 4.10.12 and all samba 4.9

The papercrop gem before 0.3.0 for Ruby on Rails does not properly handle crop input.

An issue was discovered in Simplejobscript.com SJS before 1.65. There is unauthenticated SQL injection via the search en

Parallels 13 uses cleartext HTTP as part of the update process, allowing man-in-the-middle attacks. Users of out-of-date

tftp.c in libslirp 4.1.0, as used in QEMU 4.2.0, does not prevent ..\ directory traversal on Windows.

CarbonFTP v1.4 uses insecure proprietary password encryption with a hard-coded weak encryption key. The key for local FT

The forDNN.UsersExportImport module before 1.2.0 for DNN (formerly DotNetNuke) allows an unprivileged user to import (cr

A vulnerability was discovered in all quay-2 versions before quay-3.0.0, in the Quay web GUI where POST requests include

An Arbitrary File Upload issue in the file browser of DIMO YellowBox CRM before 6.3.4 allows a standard authenticated us

In DIMO YellowBox CRM before 6.3.4, Path Traversal in images/Apparence (dossier=../) and servletrecuperefichier (documen

Path Traversal in the file browser of DIMO YellowBox CRM before 6.3.4 allows a standard authenticated user to browse the

Incorrect Access Control in AfficheExplorateurParam() in DIMO YellowBox CRM before 6.3.4 allows a standard authenticated

Prizm Content Connect 5.1 has an Arbitrary File Upload Vulnerability

mIRC prior to 7.22 has a message leak because chopping of outbound messages is mishandled.

Sonoff TH 10 and 16 devices with firmware 6.6.0.21 allows XSS via the Friendly Name 1 field (after a successful login wi