2020

LiveCode v9.6.1 on Windows allows local, low-privileged users to gain privileges by creating a malicious "cmd.exe" in th

A vulnerability in specified versions of American Dynamics victor Web Client and Software House CCURE Web Client could a

forma.lms 2.3.0.2 is affected by Cross Site Request Forgery (CSRF) in formalms/appCore/index.php?r=lms/profile/show&ap=s

Zoho ManageEngine Applications Manager 14780 and before allows a remote unauthenticated attacker to register managed ser

IBM Informix spatial 14.10 could allow a local user to execute commands as a privileged user due to an out of bounds wri

IBM QRadar SIEM 7.3 and 7.4 could allow a remote attacker to execute arbitrary commands on the system, caused by insecur

An issue has been discovered in GitLab affecting all versions prior to 13.2.10, 13.3.7 and 13.4.2: Stored XSS in CI Job

IBM QRadar SIEM 7.3 and 7.4 when configured to use Active Directory Authentication may be susceptible to spoofing attack

Jenkins Role-based Authorization Strategy Plugin 3.0 and earlier does not properly invalidate a permission cache when th

PyroCMS 3.7 is vulnerable to cross-site request forgery (CSRF) via the admin/addons/uninstall/anomaly.module.blocks URI:

A vulnerability in the Cisco Discovery Protocol implementation for Cisco Video Surveillance 8000 Series IP Cameras could

A vulnerability in the loading mechanism of specific DLLs in the Cisco Webex Teams client for Windows could allow an aut

A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticat

In GLPI before version 9.5.2, the `install/install.php` endpoint insecurely stores user input into the database as `url_

In GLPI before version 9.5.2, when supplying a back tick in input that gets put into a SQL query,the application does no

In GLPI before version 9.5.2, the `​pluginimage.send.php​` endpoint allows a user to specify an image from a plugin. The

Sympa through 6.2.57b.2 allows a local privilege escalation from the sympa user account to full root access by modifying

The wp-courses plugin through 2.0.27 for WordPress allows remote attackers to bypass the intended payment step (for cour

The Dynamic OOO widget for the Elementor Pro plugin through 3.0.5 for WordPress allows remote authenticated users to exe

Peplink Balance before 8.1.0rc1 allows an unauthenticated attacker to download PHP configuration files (/filemanager/php

An integer underflow in the SMB server of MikroTik RouterOS before 6.45.5 allows remote unauthenticated attackers to cra

MonoCMS Blog 1.0 is affected by: Arbitrary File Deletion. Any authenticated user can delete files on and off the webserv

This affects the package simpl-schema before 1.10.2.

An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), Q(10.0), and R(11.0) software. An attacker can ac

An issue was discovered on Samsung mobile devices with Q(10.0) and R(11.0) (Exynos chipsets) software. They allow attack

An issue was discovered in SystemUI on Samsung mobile devices with O(8.x), P(9.0), Q(10.0), and R(11.0) software. Pendin

An issue was discovered in EthernetNetwork on Samsung mobile devices with O(8.1), P(9.0), Q(10.0), and R(11.0) software.

An issue was discovered in DirEncryptService on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) software. Pendin

An issue was discovered on Samsung mobile devices with Q(10.0) software. Auto Hotspot allows attackers to obtain sensiti

An issue was discovered on LG mobile devices with Android OS 8.0, 8.1, and 9.0 software. The Network Management componen

An issue was discovered on LG mobile devices with Android OS 9.0 and 10 software. The Wi-Fi subsystem has incorrect inpu

Zoho ManageEngine Applications Manager version 14740 and prior allows an authenticated SQL Injection via a crafted jsp r

Zoho ManageEngine Applications Manager version 14740 and prior allows an authenticated SQL Injection via a crafted jsp r

An issue has been discovered in GitLab affecting all versions starting from 11.2. Unauthorized Users Can View Custom Pro

This affects all versions of package node-pdf-generator. Due to lack of user input validation and sanitization done to t

The socket.io-file package through 2.0.31 for Node.js relies on client-side validation of file types, which allows remot

A buffer overflow in WhatsApp for Android prior to v2.20.130 and WhatsApp Business for Android prior to v2.20.46 could h

A user running a quick search on a highly forwarded message on WhatsApp for Android from v2.20.108 to v2.20.140 or Whats

In Electron before versions 11.0.0-beta.1, 10.0.1, 9.3.0 or 8.5.1 the `will-navigate` event that apps use to prevent nav

"HCL AppScan Enterprise security rules update administration section of the web application console is missing HTTP Stri

D-Link DAP-1360U before 3.0.1 devices allow remote authenticated users to execute arbitrary commands via shell metachara

This affects all versions of package phantomjs-seo. It is possible for an attacker to craft a url that will be passed to

In Wireshark through 3.2.7, the Facebook Zero Protocol (aka FBZERO) dissector could enter an infinite loop. This was add

In Wireshark 3.2.0 to 3.2.6 and 3.0.0 to 3.0.13, the BLIP protocol dissector has a NULL pointer dereference because a bu

In Wireshark 3.2.0 to 3.2.6, 3.0.0 to 3.0.13, and 2.6.0 to 2.6.20, the MIME Multipart dissector could crash. This was ad

In Wireshark 3.2.0 to 3.2.6, 3.0.0 to 3.0.13, and 2.6.0 to 2.6.20, the TCP dissector could crash. This was addressed in

REDDOXX MailDepot 2032 2.2.1242 allows authenticated users to access the mailboxes of other users.

Unauthenticated RPC server on ALEOS before 4.4.9, 4.9.5, and 4.14.0 allows remote code execution.

Lack of input sanitization in UpdateRebootMgr service of ALEOS 4.11 and later allow an escalation to root from a low-pri

The PPP implementation of MPD before 5.9 allows a remote attacker who can send specifically crafted PPP authentication m