2020

A weak robustness vulnerability exists in the AWS Encryption SDKs for Java, Python, C and Javalcript prior to versions 2

This affects the package markdown-it-highlightjs before 3.3.1. It is possible insert malicious JavaScript as a value of

This affects the package @firebase/util before 0.3.4. This vulnerability relates to the deepExtend function within the D

Deserialization of untrusted data vulnerability in XooNIps 3.49 and earlier allows remote attackers to execute arbitrary

Stored cross-site scripting vulnerability in XooNIps 3.49 and earlier allows remote authenticated attackers to inject ar

Reflected cross-site scripting vulnerability in XooNIps 3.49 and earlier allows remote authenticated attackers to inject

SQL injection vulnerability in the XooNIps 3.49 and earlier allows remote authenticated attackers to execute arbitrary S

The update functionality of the Discover Media infotainment system in Volkswagen Polo 2019 vehicles allows physically pr

The WPBakery plugin before 6.4.1 for WordPress allows XSS because it calls kses_remove_filters to disable the standard W

The orbisius-child-theme-creator plugin before 1.5.2 for WordPress allows CSRF via orbisius_ctc_theme_editor_manage_file

Improper input validation in the Auto-Discovery component of Nagios XI before 5.7.5 allows an authenticated attacker to

In InfiniteWP Admin Panel before 3.1.12.3, resetPasswordSendMail generates a weak password-reset code, which makes it ea

Privilege escalation of an authenticated user to root in Citrix SD-WAN center versions before 11.2.2, 11.1.2b and 10.2.8

Authentication Bypass resulting in exposure of SD-WAN functionality in Citrix SD-WAN Center versions before 11.2.2, 11.1

Unauthenticated remote code execution with root privileges in Citrix SD-WAN Center versions before 11.2.2, 11.1.2b and 1

An unprivileged Windows user on the VDA or an SMB user can perform arbitrary command execution as SYSTEM in CVAD version

An unprivileged Windows user on the VDA can perform arbitrary command execution as SYSTEM in CVAD versions before 2009,

Insufficient protection of the server-side encryption keys in Nextcloud Server 19.0.1 allowed an attacker to replace the

Insufficient protection of the server-side encryption keys in Nextcloud Server 19.0.1 allowed an attacker to replace the

Uncontrolled resource consumption vulnerability in MELSEC iQ-R Series CPU Modules (R00/01/02CPU Firmware versions from '

If exploited, the command injection vulnerability could allow remote attackers to execute arbitrary commands. This issue

If exploited, the command injection vulnerability could allow remote attackers to execute arbitrary commands. This issue

A flaw was found in PostgreSQL versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9

A flaw was found in PostgreSQL versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9

A misconfiguration in the debug interface in Mercedes-Benz HERMES 2.1 allows an attacker with direct physical access to

An authentication bypass in the debug interface in Mercedes-Benz HERMES 2.1 allows an attacker with physical access to d

A misconfiguration in the debug interface in Mercedes-Benz HERMES 1.5 allows an attacker with direct physical access to

An authentication bypass in the debug interface in Mercedes-Benz HERMES 1.5 allows an attacker with physical access to d

A misconfiguration in the debug interface in Mercedes-Benz HERMES 1 allows an attacker with direct physical access to de

An authentication bypass in the debug interface in Mercedes-Benz HERMES 1 allows an attacker with physical access to dev

Prototype pollution vulnerability in 'controlled-merge' versions 1.0.0 through 1.2.0 allows attacker to cause a denial o

This affects the package doc-path before 2.1.2.

ask_password in Tomb 2.0 through 2.7 returns a warning when pinentry-curses is used and $DISPLAY is non-empty, causing a

An issue was discovered in PassMark BurnInTest v9.1 Build 1008, OSForensics v7.1 Build 1012, and PerformanceTest v10.0 B

Opera Touch for iOS before version 2.4.5 is vulnerable to an address bar spoofing attack. The vulnerability allows a mal

Improper preservation of permissions in Nagios XI 5.7.4 allows a local, low-privileged, authenticated user to weaken the

In Eclipse Hono version 1.3.0 and 1.4.0 the AMQP protocol adapter does not verify the size of AMQP messages received fro

lib/crud/userprocess.php in rConfig 3.9.x before 3.9.7 has an authentication bypass, leading to administrator account cr

Insufficient control flow management in the Open WebRTC Toolkit before version 4.3.1 may allow an unauthenticated user t

Insufficient control flow management in some Intel(R) PROSet/Wireless WiFi products before version 21.110 may allow an u

Improper access control in the PMC for some Intel(R) Processors may allow a privileged user to potentially enable escala

An issue was discovered in One Identity Password Manager 5.8. An attacker could enumerate valid answers for a user. It i

Radar COVID is the official COVID-19 exposure notification app for Spain. In affected versions of Radar COVID, identific

Spree is a complete open source e-commerce solution built with Ruby on Rails. In Spree from version 3.7 and before versi

Element Software versions prior to 12.2 and HCI versions prior to 1.8P1 are susceptible to a vulnerability which could a

Element Software versions prior to 12.2 and HCI versions prior to 1.8P1 are susceptible to a vulnerability which could a

Valve's Game Networking Sockets prior to version v1.2.0 improperly handles inlined statistics messages in function CConn

Dependabot is a set of packages for automated dependency management for Ruby, JavaScript, Python, PHP, Elixir, Rust, Jav

In CMSuno 1.6.2, an attacker can inject malicious PHP code as a "username" while changing his/her username & password. A

An authenticated attacker can inject malicious code into "lang" parameter in /uno/central.php file in CMSuno 1.6.2 and r