2020

In MISP 2.4.134, XSS exists in the template element index view because the id parameter is mishandled.

In YzmCMS v5.5 the member contribution function in the editor contains a cross-site scripting (XSS) vulnerability.

The default installation path of the TwinCAT XAR 3.1 software in all versions is underneath C:\TwinCAT. If the directory

Endress+Hauser Ecograph T (Neutral/Private Label) (RSG35, ORSG35) and Memograph M (Neutral/Private Label) (RSG45, ORSG45

Endress+Hauser Ecograph T (Neutral/Private Label) (RSG35, ORSG35) with Firmware version prior to V2.0.0 is prone to impr

Some ZTE devices have input verification vulnerabilities. The devices support configuring a static prefix through the we

An issue exists in PrimeKey EJBCA before 7.4.3 when enrolling with EST while proxied through an RA over the Peers protoc

The participants table download in Moodle always included user emails, but should have only done so when users' emails a

In Moodle, it was possible to include JavaScript when re-naming content bank items. Versions affected: 3.9 to 3.9.2. Thi

If the upload course tool in Moodle was used to delete an enrollment method which did not exist or was not already enabl

In moodle, some database module web services allowed students to add entries within groups they did not belong to. Versi

In moodle, insufficient capability checks could lead to users with the ability to course restore adding additional capab

Users' enrollment capabilities were not being sufficiently checked in Moodle when they are restored into an existing cou

A vulnerability in specified versions of American Dynamics victor Web Client and Software House C•CURE Web Client could

IBM Jazz Reporting Service 6.0.6, 6.0.6.1, 7.0, and 7.0.1 is vulnerable to stored cross-site scripting. This vulnerabili

IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to a buffer overflo

JamoDat TSMManager Collector version up to 6.5.0.21 is vulnerable to an Authorization Bypass because the Collector compo

OvoiceManager has system permission to write vulnerability reports for arbitrary files, affected product is com.oppo.ovo

QualityProtect has a vulnerability to execute arbitrary system commands, affected product is com.oppo.qualityprotect V2.

Dynamic loading of services in the backup and restore SDK leads to elevated privileges, affected product is com.coloros.

Potential double free in Bluez 5 module of PulseAudio could allow a local attacker to leak memory or crash the program.

InfluxDB before 1.7.6 has an authentication bypass vulnerability in the authenticate function in services/httpd/handler.

Missing validation of server certificates for out-going connections in Nextcloud Social < 0.4.0 allowed a man-in-the-mid

Improper access control in Nextcloud Social app version 0.3.1 allowed to read posts of any user.

A Node.js application that allows an attacker to trigger a DNS request for a host of their choice could trigger a Denial

In versions 16.0.0-16.0.0.1 and 15.1.0-15.1.1, on specific BIG-IP platforms, attackers may be able to obtain TCP sequenc

The Terraform API in GitLab CE/EE 12.10+ exposed the object storage signed URL on the delete operation allowing a malici

An issue has been discovered in GitLab CE/EE affecting all versions starting from 8.8.9. A specially crafted request cou

An issue has been discovered in GitLab CE/EE affecting all versions starting from 8.14. A path traversal is found in LFS

A flaw in the libapreq2 v2.07 to v2.13 multipart parser can deference a null pointer leading to a process crash. A remot

Symantec Endpoint Detection & Response, prior to 4.5, may be susceptible to an information disclosure issue, which is a

In the npm package semantic-release before version 17.2.3, secrets that would normally be masked by `semantic-release` c

Jupyter Notebook before version 6.1.5 has an Open redirect vulnerability. A maliciously crafted link to a notebook serve

A cross-site scripting (XSS) vulnerability in Beijing Liangjing Zhicheng Technology Co., Ltd ljcmsshop version 1.14 allo

SuiteCRM through 7.11.13 has an Open Redirect in the Documents module via a crafted SVG document.

SuiteCRM 7.11.13 is affected by stored Cross-Site Scripting (XSS) in the Documents preview functionality. This vulnerabi

Western Digital has identified a security vulnerability in the Replay Protected Memory Block (RPMB) protocol as specifie

Cross-site Scripting (XSS) vulnerability in grocy 2.7.1 via the add recipe module, which gets executed when deleting the

SuiteCRM through 7.11.13 allows CSV Injection via registration fields in the Accounts, Contacts, Opportunities, and Lead

A vulnerability in the web-based management interface of Cisco DNA Spaces Connector could allow an unauthenticated, remo

A vulnerability in the REST API of Cisco IoT Field Network Director (FND) could allow an unauthenticated, remote attacke

A vulnerability in the Traversal Using Relays around NAT (TURN) server component of Cisco Expressway software could allo

A vulnerability in Cisco Webex Meetings and Cisco Webex Meetings Server could allow an unauthenticated, remote attacker

Multiple vulnerabilities in the API subsystem of Cisco Integrated Management Controller (IMC) could allow an unauthentic

A vulnerability in Cisco Webex Meetings and Cisco Webex Meetings Server could allow an unauthenticated, remote attacker

A vulnerability in Cisco Webex Meetings and Cisco Webex Meetings Server could allow an unauthenticated, remote attacker

A command injection vulnerability in ModifyVLANItem of Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 coul

A command injection vulnerability in AddVLANItem of Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could a

A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an authenticated, remote att

A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an unauthenticated, remote a