2020

: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in uploaditem.asp o

ext/misc/zipfile.c in SQLite 3.30.1 mishandles certain uses of INSERT INTO in situations involving embedded '\0' charact

Unrestricted file upload vulnerability in Visual Mining NetCharts Server allows remote attackers to execute arbitrary co

FontForge 20190801 has a use-after-free in SFD_GetFontMetaData in sfd.c.

Unrestricted file upload vulnerability in includes/classes/uploadify-v2.1.4/uploadify.php in HelpDEZk 1.0.1 and earlier

Cross-site request forgery (CSRF) vulnerability in the Storefront Application in DS Data Systems KonaKart before 7.3.0.0

The bindReplace function in the query factory in includes/classes/database.php in Loaded Commerce 7 does not properly ha

Cross-site scripting (XSS) vulnerability in bsi.dll in Bank Soft Systems (BSS) RBS BS-Client 3.17.9 allows remote attack

Multiple cross-site scripting (XSS) vulnerabilities in bsi.dll in Bank Soft Systems (BSS) RBS BS-Client. Private Client

Bulb Security Smartphone Pentest Framework (SPF) 0.1.2 through 0.1.4 allows remote attackers to execute arbitrary comman

Bulb Security Smartphone Pentest Framework (SPF) before 0.1.3 allows remote attackers to execute arbitrary commands via

A security vulnerability has been identified in HPE SimpliVity 380 Gen 9, HPE SimpliVity 380 Gen 10, HPE SimpliVity 380

A security vulnerability has been identified in HPE SimpliVity 380 Gen 9, HPE SimpliVity 380 Gen 10, HPE SimpliVity 380

An exploitable heap buffer overflow vulnerability exists in the data structure persistence functionality of OpenCV, befo

An exploitable heap buffer overflow vulnerability exists in the data structure persistence functionality of OpenCV 4.1.0

GitLab Enterprise Edition (EE) 9.0 and later through 12.5 allows Information Disclosure.

GitLab Enterprise Edition (EE) 8.90 and later through 12.5 has Incorrect Access Control.

GitLab Enterprise Edition (EE) 8.2 and later through 12.5 has Insecure Permissions.

GitLab Enterprise Edition (EE) 11.9 and later through 12.5 has Insecure Permissions.

GitLab Enterprise Edition (EE) 6.7 and later through 12.5 allows SSRF.

GitLab Community Edition (CE) and Enterprise Edition (EE) through 12.5 has Incorrect Access Control (issue 2 of 2).

GitLab Enterprise Edition (EE) 11.3 and later through 12.5 allows an Insecure Direct Object Reference (IDOR).

GitLab Enterprise Edition (EE) 10.8 and later through 12.5 has Incorrect Access Control.

GitLab Community Edition (CE) and Enterprise Edition (EE) through 12.5 has Incorrect Access Control (issue 1 of 2).

GitLab Enterprise Edition (EE) 12.2 and later through 12.5 has Incorrect Access Control.

GitLab Enterprise Edition (EE) 12.3 and later through 12.5 has Incorrect Access Control.

Multiple cross-site scripting (XSS) vulnerabilities in Zend Framework 2.0.x before 2.0.1 allow remote attackers to injec

GitLab EE 8.14 through 12.5, 12.4.3, and 12.3.6 allows XSS in group and profile fields.

GitLab Community Edition (CE) and Enterprise Edition (EE). 9.6 and later through 12.5 has Incorrect Access Control.

Gitlab Enterprise Edition (EE) 11.3 through 12.4.2 allows Directory Traversal.

Gitlab Enterprise Edition (EE) before 12.5.1 has Insecure Permissions (issue 2 of 2).

Gitlab Enterprise Edition (EE) before 12.5.1 has Insecure Permissions (issue 1 of 2).

USG9500 with software of V500R001C30SPC100; V500R001C30SPC200; V500R001C30SPC600; V500R001C60SPC500; V500R005C00SPC100;

Mate 10 Pro;Honor V10;Honor 10;Nova 4 smartphones have a denial of service vulnerability. The system does not properly c

Some Huawei products have a buffer error vulnerability. An unauthenticated, remote attacker could send specific MPLS Ech

HUAWEI P30 smart phones with versions earlier than 10.0.0.166(C00E66R1P11) have an information leak vulnerability. An at

FasterXML jackson-databind 2.x before 2.9.10.2 lacks certain net.sf.ehcache blocking.

libImaging/FliDecode.c in Pillow before 6.2.2 has an FLI buffer overflow.

libImaging/PcxDecode.c in Pillow before 6.2.2 has a PCX P mode buffer overflow.

libImaging/SgiRleDecode.c in Pillow before 6.2.2 has an SGI buffer overflow.

libImaging/TiffDecode.c in Pillow before 6.2.2 has a TIFF decoding integer overflow, related to realloc.

OpenLambda 2019-09-10 allows DNS rebinding attacks against the OL server for the REST API on TCP port 5000.

Pivotal Spring Framework through 5.3.16 suffers from a potential remote code execution (RCE) issue if used for Java dese

An off-by-one error leading to a crash was discovered in openldap 2.4 when processing DNS SRV messages. If slapd was con

FusionForge before 5.3.2 use scripts that run under the shared Apache user, which is also used by project homepages by d

Multiple cross-site scripting (XSS) vulnerabilities in QuiXplorer before 2.5.5 allow remote attackers to inject arbitrar

Multiple cross-site scripting (XSS) vulnerabilities in GetSimple CMS before 3.2.1 allow remote attackers to inject arbit

Cross-site scripting (XSS) vulnerability in BoltWire 3.5 and earlier allows remote attackers to inject arbitrary web scr

Versions of Foreman as shipped with Red Hat Satellite 6 does not check for a correct CSRF token in the logout action. Th

It was found that the implementation of the GTNSubjectCreatingInterceptor class in gatein-wsrp was not thread safe. For