2020

In various functions in fscrypt_ice.c and related files in some implementations of f2fs encryption that use encryption h

In uvc_scan_chain_forward of uvc_driver.c, there is a possible linked list corruption due to an unusual root cause. This

In showLimitedSimFunctionWarningNotification of NotificationMgr.java, there is a possible permission bypass due to an un

In getNotificationBuilder of CarrierServiceStateTracker.java, there is a possible permission bypass due to an unsafe Pen

In various places in Telephony, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to

In showNotification of EmergencyCallbackModeService.java, there is a possible permission bypass due to an unsafe Pending

In decrypt and decrypt_1_2 of CryptoPlugin.cpp, there is a possible out of bounds read due to a missing bounds check. Th

In the app zygote SE Policy, there is a possible permissions bypass. This could lead to local information disclosure wit

In createSaveNotification of RecordingService.java, there is a possible permission bypass due to an unsafe PendingIntent

In onCreate of RequestPermissionActivity.java, there is a possible tapjacking vector due to an insecure default value. T

In Parse_insh of eas_mdls.c, there is a possible out of bounds write due to an incorrect bounds check. This could lead t

In Parse_art of eas_mdls.c, there is a possible out of bounds write due to an incorrect bounds check. This could lead to

In Parse_ins of eas_mdls.c, there is a possible out of bounds write due to a missing bounds check. This could lead to re

In the Bluetooth service, there is a possible spoofing attack due to a logic error. This could lead to remote informatio

A flaw was found in Wildfly's implementation of Xerces, specifically in the way the XMLSchemaValidator class in the JAXP

In Apache Airflow < 1.10.12, the "origin" parameter passed to some of the endpoints like '/trigger' was vulnerable to XS

Affected versions of Atlassian Jira Server and Data Center allow an unauthenticated user to enumerate users via an Infor

A stored XSS vulnerability exists in the Custom Link Attributes control Affect function in Elementor Page Builder 2.9.2

Improper certificate validation for certain connections in the Bosch Smart Home System App for iOS prior to version 9.17

A flaw was found in all versions of Keycloak before 10.0.0, where the NodeJS adapter did not support the verify-token-au

A specific router allows changing the Wi-Fi password remotely. Genexis Platinum 4410 V2-1.28, a compact router generally

It was found in AMQ Online before 1.5.2 that injecting an invalid field to a user's AddressSpace configuration of the us

Apache Atlas before 2.1.0 contain a XSS vulnerability. While saving search or rendering elements values are not sanitize

A flaw was found in Keycloak's data filter, in version 10.0.1, where it allowed the processing of data URLs in some circ

A content spoofing vulnerability was found in the openshift/console 3.11 and 4.x. This flaw allows an attacker to craft

VMware Workstation (15.x) and Horizon Client for Windows (5.x before 5.4.4) contain an information disclosure vulnerabil

VMware Workstation (15.x) and Horizon Client for Windows (5.x before 5.4.4) contain an out-of-bounds read vulnerability

VMware Workstation (15.x) and Horizon Client for Windows (5.x before 5.4.4) contain an out-of-bounds read vulnerability

VMware Workstation (15.x) and Horizon Client for Windows (5.x before 5.4.4) contain an out-of-bounds read vulnerability

VMware Fusion (11.x) contains a privilege escalation vulnerability due to the way it allows configuring the system wide

A CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Transversal') vulnerability exists in SCADAP

IBM Security Trusteer Pinpoint Detect 11.6.5 could disclose some information due to using a wildcard in the Access-Contr

An issue was discovered in the DBI module through 1.643 for Perl. DBD::File drivers can open files from folders other th

libraw 20.0 has a null pointer dereference vulnerability in parse_tiff_ifd in src/metadata/tiff.cpp, which may result in

The issue appears to be that JBoss EAP 6.4.21 does not parse the field-name in accordance to RFC7230[1] as it returns a

Jenkins Storable Configs Plugin 1.0 and earlier does not restrict the user-specified file name, allowing attackers with

Jenkins Storable Configs Plugin 1.0 and earlier allows users with Job/Read permission to read arbitrary files on the Jen

Jenkins Copy data to workspace Plugin 1.0 and earlier does not limit which directories can be copied from the Jenkins co

Jenkins ElasTest Plugin 1.2.1 and earlier stores its server password unencrypted in its global configuration file on the

A cross-site request forgery (CSRF) vulnerability in Jenkins ElasTest Plugin 1.2.1 and earlier allows attackers to conne

A missing permission check in Jenkins ElasTest Plugin 1.2.1 and earlier allows attackers with Overall/Read permission to

Jenkins Locked Files Report Plugin 1.6 and earlier does not escape locked files' names in tooltips, resulting in a store

Jenkins ClearCase Release Plugin 0.3 and earlier does not escape the composite baseline in badge tooltip, resulting in a

Jenkins chosen-views-tabbar Plugin 1.2 and earlier does not escape view names in the dropdown to select views, resulting

A missing permission check in Jenkins MongoDB Plugin 1.3 and earlier allows attackers with Overall/Read permission to ga

Jenkins Description Column Plugin 1.3 and earlier does not escape the job description in the column tooltip, resulting i

Jenkins Coverage/Complexity Scatter Plot Plugin 1.1.1 and earlier does not escape the method information in tooltips, re

Jenkins Custom Job Icon Plugin 0.2 and earlier does not escape the job descriptions in tooltips, resulting in a stored c

Jenkins Radiator View Plugin 1.29 and earlier does not escape the full name of the jobs in tooltips, resulting in a stor

Jenkins Android Lint Plugin 2.6 and earlier does not escape the annotation message in tooltips, resulting in a stored cr