2020

As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the

When recursing through graphical layers while scrolling, an iterator may have become invalid, resulting in a potential u

When processing surfaces, the lifetime may outlive a persistent buffer leading to memory corruption and a potentially ex

Mozilla developers reported memory safety bugs present in Firefox 80. Some of these bugs showed evidence of memory corru

Mozilla developers reported memory safety bugs present in Firefox 80 and Firefox ESR 78.2. Some of these bugs showed evi

Mozilla developers reported memory safety bugs present in Firefox for Android 79. Some of these bugs showed evidence of

When aborting an operation, such as a fetch, an abort signal may be deleted while alerting the objects to be notified. T

When processing a MAR update file, after the signature has been validated, an invalid name length could result in a heap

If Firefox is installed to a user-writable directory, the Mozilla Maintenance Service would execute updater.exe from the

Nette versions before 2.0.19, 2.1.13, 2.2.10, 2.3.14, 2.4.16, 3.0.6 are vulnerable to an code injection attack by passin

Envoy master between 2d69e30 and 3b5acb2 may fail to parse request URL that requires host canonicalization.

Envoy through 1.15.0 only considers the first value when multiple header values are present for some HTTP headers. Envoy

Unisys Stealth(core) before 4.0.134 stores passwords in a recoverable format. Therefore, a search of Enterprise Manager

IBM WebSphere Application Server 7.5, 8.0, 8.5, and 9.0 traditional could allow a remote attacker to obtain sensitive in

Upgrading Crowd via XML Data Transfer can reactivate a disabled user from OpenLDAP. The affected versions are from befor

A DLL Hijacking vulnerability in Eaton's 9000x Programming and Configuration Software v 2.0.38 and prior allows an attac

In PLC WinProladder Version 3.28 and prior, a stack-based buffer overflow vulnerability can be exploited when a valid us

In the course of work on the open source project it was discovered that authenticated users running queries against Hive

RainbowFish PacsOne Server 6.8.4 has Incorrect Access Control.

A flaw was found in dpdk in versions before 18.11.10 and before 19.11.5. A flawed bounds checking in the copy_data funct

Re:Desk 2.3 has a blind authenticated SQL injection vulnerability in the SettingsController class, in the actionEmailTem

Re:Desk 2.3 allows insecure file upload.

A flaw was found in dpdk in versions before 18.11.10 and before 19.11.5. A complete lack of validation of attacker-contr

A flaw was found in dpdk in versions before 18.11.10 and before 19.11.5. A lack of bounds checking when copying iv_data

A flaw was found in dpdk in versions before 18.11.10 and before 19.11.5. Virtio ring descriptors, and the data they desc

A vulnerability in the Pulse Connect Secure < 9.1R8.2 admin web interface could allow an authenticated attacker to uploa

BigBlueButton Greenlight before 2.5.6 allows HTTP header (Host and Origin) attacks, which can result in Account Takeover

jwt-go before 4.0.0-preview1 allows attackers to bypass intended access restrictions in situations with []string{} for m

info.php in Logaritmo Aware CallManager 2012 allows remote attackers to obtain sensitive information via a direct reques

NATS nats.js before 2.0.0-209, nats.ws before 1.0.0-111, and nats.deno before 1.0.0-9 allow credential disclosure from a

md_push_block_bytes in md4c.c in md4c 0.4.5 allows attackers to trigger use of uninitialized memory, and cause a denial

Projectworlds Visitor Management System in PHP 1.0 allows SQL Injection. The file front.php does not perform input valid

An issue was discovered in Pluck CMS 4.7.10-dev2 and 4.7.11. There is a file upload vulnerability that can cause a remot

There is an Arbitrary file deletion vulnerability in halo v1.1.3. A backup function in the background allows a user, whe

Halo V1.1.3 is affected by: Arbitrary File reading. In an interface that reads files in halo v1.1.3, a directory travers

An issue was discovered in Ozeki NG SMS Gateway through 4.17.6. It stores SMS messages in .NET serialized format on the

Attackers can use public NetTest web service of Apache OpenMeetings 4.0.0-5.0.0 to organize denial of service attack.

In Lansweeper 8.0.130.17, the web console is vulnerable to a CSRF attack that would allow a low-level Lansweeper user to

A vulnerability was discovered in GitLab versions prior 13.1. The comment section of the issue page was not restricting

A vulnerability was discovered in GitLab versions prior 13.1. Under certain conditions private merge requests could be r

A vulnerability was discovered in GitLab versions after 12.9. Due to improper verification of permissions, an unauthoriz

A vulnerability was discovered in GitLab versions prior to 13.1. Username format restrictions could be bypassed allowing

Handlebars before 4.4.5 allows Regular Expression Denial of Service (ReDoS) because of eager matching. The parser may be

Handlebars before 3.0.8 and 4.x before 4.5.3 is vulnerable to Arbitrary Code Execution. The lookup helper fails to prope

The custom GINA/CP module in ANIXIS Password Reset Client before version 3.22 allows remote attackers to execute code an

In Apache Hadoop versions 3.0.0-alpha2 to 3.0.0, 2.9.0 to 2.9.2, 2.8.0 to 2.8.5, any users can access some servlets with

Improper Authentication vulnerability in WAGO 750-8XX series with FW version <= FW07 allows an attacker to change some s

IBM Security Secret Server (IBM Security Verify Privilege Vault Remote 1.2 ) could allow a local user to bypass security

A vulnerability in the Trend Micro Apex One ServerMigrationTool component could allow an attacker to execute arbitrary c

A vulnerability in Trend Micro Apex One may allow a local attacker to manipulate the process of the security agent unloa