2020

Relative Path Traversal in Teltonika firmware TRB2_R_00.02.04.3 allows a remote, authenticated attacker to delete arbitr

Relative Path Traversal in Teltonika firmware TRB2_R_00.02.04.3 allows a remote, authenticated attacker to delete arbitr

Insufficient output sanitization in Teltonika firmware TRB2_R_00.02.04.3 allows an unauthenticated attacker to conduct r

Server-Side Request Forgery in Teltonika firmware TRB2_R_00.02.04.3 allows a low privileged user to cause the applicatio

HCL Digital Experience 8.5, 9.0, 9.5 is susceptible to cross-site scripting (XSS). The vulnerability could be employed i

In Apache NiFi 1.0.0 to 1.11.4, the notification service manager and various policy authorizer and user group provider o

By exploiting an Open Redirect vulnerability on a website, an attacker could have spoofed the site displayed in the down

Firefox sometimes ran the onload handler for SVG elements that the DOM sanitizer decided to remove, resulting in JavaScr

A lock was missing when accessing a data structure and importing certificate information into the trust database. This v

When trying to load a non-video in an audio/video context the exact status code (200, 302, 404, 500, 412, 403, etc.) was

Firefox did not reset the address bar after the beforeunload dialog was shown if the user chose to remain on the page. T

By holding a reference to the eval() function from an about:blank window, a malicious webpage could have gained access t

Pritunl 1.29.2145.25 allows attackers to enumerate valid VPN usernames via a series of /auth/session login attempts. Ini

In Istio 1.5.0 though 1.5.8 and Istio 1.6.0 through 1.6.7, when users specify an AuthorizationPolicy resource with DENY

The Web application on Rittal CMC PU III 7030.000 V3.00 V3.11.00_2 to V3.15.70_4 devices fails to sanitize user input on

GetSimple CMS 3.3.16 allows in parameter 'permalink' on the Settings page persistent Cross Site Scripting which is execu

CMS Made Simple 2.2.14 allows an authenticated user with access to the Content Manager to edit content and put persisten

A vulnerability has been discovered in the ace.xmd parser that results from a lack of proper validation of user-supplied

The hyperlinks functionality in atlaskit/editor-core in before version 113.1.5 allows remote attackers to inject arbitra

An issue was discovered in MantisBT before 2.24.3. Improper escaping of a custom field's name allows an attacker to inje

An issue was discovered in file_download.php in MantisBT before 2.24.3. Users without access to view private issue notes

An issue was discovered in MantisBT before 2.24.3. When editing an Issue in a Project where a Custom Field with a crafte

An issue has been discovered in GitLab affecting versions from 11.8 before 12.10.13. GitLab was vulnerable to a stored X

RainbowFish PacsOne Server 6.8.4 allows XSS.

HashiCorp Vault and Vault Enterprise versions 1.0 and newer allowed leases created with a batch token to outlive their T

A flaw was found in Django REST Framework versions before 3.12.0 and before 3.11.2. When using the browseable API viewer

A vulnerability in the Pulse Connect Secure < 9.1R8.2 admin web interface could allow an authenticated attacker to gain

A vulnerability in the authenticated user web interface of Pulse Connect Secure and Pulse Policy Secure < 9.1R8.2 could

urllib3 before 1.25.9 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserti

An issue was discovered in Hoosk CMS v1.8.0. There is a XSS vulnerability in install/index.php

Projectworlds Visitor Management System in PHP 1.0 allows XSS. The file myform.php does not perform input validation on

An issue was discovered in the GAEN (aka Google/Apple Exposure Notifications) protocol through 2020-09-29, as used in CO

An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.1. There is a CSRF issue (with resu

An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.1. There is a blind SQL injection i

CMS Made Simple before 2.2.15 allows XSS via the m1_mod parameter in a ModuleManager local_uninstall action to admin/mod

An issue was discovered in HFish 0.5.1. When a payload is inserted where the password is entered, XSS code is triggered

An issue was discovered in FrontAccounting 2.4.7. There is a Directory Traversal vulnerability that can empty folder via

Nacos 1.1.4 is affected by: Incorrect Access Control. An environment can be set up locally to get the service details in

In Niushop B2B2C Multi-Business Basic Edition V1.11, authentication can be bypassed, causing administrators to reset any

An issue was discovered in Zoho Application Control Plus before version 10.0.511. The Element Configuration feature (to

An SSRF issue was discovered in Zoho Application Control Plus before version 10.0.511. The mail gateway configuration fe

In Apache Tapestry from 5.4.0 to 5.5.0, crafting specific URLs, an attacker can download files inside the WEB-INF folder

Harbor 1.9.* 1.10.* and 2.0.* allows Exposure of Sensitive Information to an Unauthorized Actor.

An issue has been discovered in GitLab affecting versions prior to 12.10.13. GitLab was vulnerable to a stored XSS by in

An issue has been discovered in GitLab affecting versions prior to 12.10.13. GitLab was vulnerable to a stored XSS in im

An issue has been discovered in GitLab affecting versions from 12.6.2 prior to 12.10.13. GitLab was vulnerable to a stor

An issue has been discovered in GitLab affecting versions prior to 13.1.2, 13.0.8 and 12.10.13. GitLab was vulnerable to

A vulnerability was discovered in GitLab versions prior to 13.1. Under certain conditions the restriction for Github pro

A vulnerability was discovered in GitLab versions prior to 13.1. Under certain conditions the private activity of a user

An issue has been discovered in GitLab before version 12.10.13 that allowed a project member with limited permissions to