2020

An issue was discovered in picoTCP through 1.7.0. The DNS domain name record decompression functionality in pico_dns_dec

An issue was discovered in Contiki through 3.0 and Contiki-NG through 4.5. The code for parsing Type A domain name answe

An issue was discovered in FNET through 4.6.4. The code for processing the hostname from an LLMNR request doesn't check

An issue was discovered in picoTCP 1.7.0. The code for processing the IPv6 headers does not validate whether the IPv6 pa

An issue was discovered in uIP 1.0, as used in Contiki 3.0 and other products. The code that reassembles fragmented pack

In versions 3.0.0-3.9.0, 2.0.0-2.9.0, and 1.0.1, the NGINX Controller Agent does not use absolute paths when calling sys

On BIG-IP versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, 14.1.0-14.1.2.7, 13.1.0-13.1.3.4, 12.1.0-12.1.5.2, and 11.6.1-11.6.

PHPSHE 1.7 has SQL injection via the admin.php?mod=user&userlevel_id=1 userlevel_id[] parameter.

An SQL injection vulnerability in the WebAdmin of Cyberoam OS through 2020-12-04 allows unauthenticated attackers to exe

All versions of package corenlp-js-interface are vulnerable to Command Injection via the main function.

This affects all versions of package corenlp-js-prefab. The injection point is located in line 10 in 'index.js.' It depe

Multiple vulnerabilities in Cisco Jabber for Windows, Jabber for MacOS, and Jabber for mobile platforms could allow an a

Multiple vulnerabilities in Cisco Jabber for Windows, Jabber for MacOS, and Jabber for mobile platforms could allow an a

Multiple vulnerabilities in Cisco Jabber for Windows, Jabber for MacOS, and Jabber for mobile platforms could allow an a

Multiple vulnerabilities in Cisco Jabber for Windows, Jabber for MacOS, and Jabber for mobile platforms could allow an a

Network Analysis functionality in Askey AP5100W_Dual_SIG_1.01.097 and all prior versions allows remote attackers to exec

Versions of the Official registry Docker images through 2.7.0 contain a blank password for the root user. Systems deploy

An out-of-bounds write vulnerability exists in the Ethernet/IP server functionality of EIP Stack Group OpENer 2.3 and de

An attacker is able to remotely inject arbitrary commands by sending especially crafted packets destined to the PAPI (Ar

There are multiple buffer overflow vulnerabilities that could lead to unauthenticated remote code execution by sending e

Forced OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution. Affected

A CWE-306: Missing Authentication for Critical Function vulnerability exists in the Web Server on Modicon M340, Legacy O

A CWE-862: Missing Authorization vulnerability exists in Easergy T300 (firmware 2.7 and older), that could cause a wide

Ubilling v1.0.9 allows Remote Command Execution as Root user by executing a malicious command that is injected inside th

Askey AP5100W_Dual_SIG_1.01.097 and all prior versions use a weak password at the Operating System (rlx-linux) level. Th

iCMS 7.0.14 attackers to execute arbitrary OS commands via shell metacharacters in the DB_NAME parameter to install/inst

iCMS 7 attackers to execute arbitrary OS commands via shell metacharacters in the DB_PREFIX parameter to install/install

Notable 1.8.4 allows XSS via crafted Markdown text, with resultant remote code execution (because nodeIntegration in web

In Lan ATMService M3 ATM Monitoring System 6.1.0, a remote attacker able to use a default cookie value, such as PHPSESSI

AEM's Cloud Service offering, as well as version 6.5.6.0 (and below), are affected by a stored Cross-Site Scripting (XSS

This command injection vulnerability allows attackers to execute arbitrary commands in a compromised application. QNAP h

Microsoft Exchange Remote Code Execution Vulnerability

Microsoft Exchange Remote Code Execution Vulnerability

A buffer overflow in the web server of Flexense DupScout Enterprise 10.0.18 allows a remote anonymous attacker to execut

SAP Business Warehouse, versions - 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 782, and SAP BW4HANA, versions

SAP Solution Manager 7.2 (User Experience Monitoring), version - 7.2, allows an authenticated user to upload a malicious

SAP BusinessObjects BI Platform (Crystal Report), versions - 4.1, 4.2, 4.3, does not sufficiently validate uploaded XML

SAP NetWeaver AS JAVA (P2P Cluster Communication), versions - 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, allows arbitrary conne

Out-of-bounds Write vulnerability in TCP Stack of Apache NuttX (incubating) versions up to and including 9.1.0 and 10.0.

Out-of-bounds Write vulnerability in TCP stack of Apache NuttX (incubating) versions up to and including 9.1.0 and 10.0.

In JerryScript 2.3.0, there is an out-of-bounds read in main_print_unhandled_exception in the main-utils.c file.

Prototype pollution vulnerability in 'deepref' versions 1.1.1 through 1.2.1 allows attacker to cause a denial of service

The official irssi docker images before 1.1-alpine (Alpine specific) contain a blank password for a root user. System us

The official notary docker images before signer-0.6.1-1 contain a blank password for a root user. System using the notar

The official spiped docker images before 1.5-alpine contain a blank password for a root user. Systems using the spiped d

The official storm Docker images before 1.2.1 contain a blank password for a root user. Systems using the Storm Docker c

The official Express Gateway Docker images before 1.14.0 contain a blank password for a root user. Systems using the Exp

The official znc docker images before 1.7.1-slim contain a blank password for a root user. Systems using the znc docker

The official eggdrop Docker images before 1.8.4rc2 contain a blank password for a root user. Systems using the Eggdrop D

The official elixir Docker images before 1.8.0-alpine (Alpine specific) contain a blank password for a root user. System