2020

In mruby 2.1.0, there is a stack-based buffer overflow in mrb_str_len_to_dbl in string.c.

In mruby 2.1.0, there is a use-after-free in hash_values_at in mrbgems/mruby-hash-ext/src/hash-ext.c.

ganglia-web (aka Ganglia Web Frontend) through 3.7.5 allows XSS via the header.php cs parameter.

ganglia-web (aka Ganglia Web Frontend) through 3.7.5 allows XSS via the header.php ce parameter.

grammar-parser.jison in the hot-formula-parser package before 3.0.1 for Node.js is vulnerable to arbitrary code injectio

Use after free in audio in Google Chrome prior to 79.0.3945.117 allowed a remote attacker to potentially exploit heap co

An issue was discovered in ManageEngine Applications Manager 14 with Build 14360. Integrated PostgreSQL which is built-i

Use after free in media picker in Google Chrome prior to 79.0.3945.88 allowed a remote attacker who had compromised the

An issue was discovered in Bftpd before 5.4. There is a heap-based off-by-one error during file-transfer error checking.

Citrix XenApp Online Plug-in for Windows 12.1 and earlier, and Citrix Receiver for Windows 3.2 and earlier could allow r

A Privilege Escalation vulnerability exists in Viscosity 1.4.1 on Mac OS X due to a path name validation issue in the se

A Security Bypass vulnerability exists in the activate.asp page in Arial Software Campaign Enterprise 11.0.551, which co

Dell EMC Unisphere for PowerMax versions prior to 9.1.0.9, Dell EMC Unisphere for PowerMax versions prior to 9.0.2.16, a

An SQL Injection vulnerability exists in the ID parameter in Online TV Database 2011.

The JBIG2Globals library in npdf.dll in Nitro Free PDF Reader 12.0.0.112 has a CAPPDAnnotHandlerUtils::PDAnnotHandlerDes

The JBIG2Decode library in npdf.dll in Nitro Free PDF Reader 12.0.0.112 has a CAPPDAnnotHandlerUtils::PDAnnotHandlerDest

TotalAV 2020 4.14.31 has a quarantine flaw that allows privilege escalation. Exploitation uses an NTFS directory junctio

Ricoh SP C250DN 1.06 devices have Incorrect Access Control (issue 2 of 2).

Ricoh SP C250DN 1.06 devices allow CSRF.

On Ricoh SP C250DN 1.06 devices, a debug port can be used.

Ricoh SP C250DN 1.06 devices have Incorrect Access Control (issue 1 of 2).

An issue was discovered in Bftpd 5.3. Under certain circumstances, an out-of-bounds read is triggered due to an uninitia

An invalid pointer vulnerability in IOCTL Handling in the kyrld.sys driver in Kyrol Internet Security 9.0.6.9 allows an

Chamilo before 1.8.8.6 does not adequately handle user supplied input by the index.php script, which could allow remote

In Arial Campaign Enterprise before 11.0.551, multiple pages are accessible without authentication or authorization.

Arial Campaign Enterprise before 11.0.551 stores passwords in clear text and these may be retrieved.

Arial Campaign Enterprise before 11.0.551 has unauthorized access to the User-Edit.asp page, which allows remote attacke

IBM QRadar SIEM 7.3.0 through 7.3.3 discloses sensitive information to unauthorized users. The information can be used t

IBM QRadar SIEM 7.3.0 through 7.3.3 uses weak credential storage in some instances which could be decrypted by a local a

Agent A is able to save a draft (i.e. for customer reply). Then Agent B can open the draft, change the text completely a

Due to improper handling of uploaded images it is possible in very unlikely and rare conditions to force the agents brow

An improper control of parameters allows the spoofing of the from fields of the following screens: AgentTicketCompose, A

Status2k does not remove the install directory allowing credential reset.

Status2k allows Remote Command Execution in admin/options/editpl.php.

The ultimate-weather plugin 1.0 for WordPress has XSS

The Etherpad Lite ep_imageconvert Plugin has a Remote Command Injection Vulnerability

The JavaScriptUtils.javaScriptEscape method in web/util/JavaScriptUtils.java in Spring MVC in Spring Framework before 3.

SpagoBI before 4.1 has Privilege Escalation via an error in the AdapterHTTP script

Pretty-Link WordPress plugin 1.5.2 has XSS

sphider prior to 1.3.6, sphider-pro prior to 3.2, and sphider-plus prior to 3.2 allow authentication bypass

Déjà Vu Crescendo Sales CRM has remote SQL Injection

LPAR2RRD ≤ 4.53 and ≤ 3.5 has arbitrary command injection on the application server.

flog plugin 0.1 for WordPress has XSS

DOMPDF before 0.6.2 allows remote code execution, a related issue to CVE-2014-2383.

DOMPDF before 0.6.2 allows denial of service.

DOMPDF before 0.6.2 allows Information Disclosure.

A cross-site scripting (XSS) vulnerability in Electronic Logbook (ELOG) 3.1.4 allows remote attackers to inject arbitrar

A cross-site scripting (XSS) vulnerability in Electronic Logbook (ELOG) 3.1.4 allows remote attackers to inject arbitrar

A cross-site scripting (XSS) vulnerability in Option/optionsAll.php in Rasilient PixelStor 5000 K:4.0.1580-20150629 (KDI

contentHostProperties.php in Rasilient PixelStor 5000 K:4.0.1580-20150629 (KDI Version) allows authenticated attackers t