2020

Improper access control in mail module (notifications) in Odoo Community 14.0 and earlier and Odoo Enterprise 14.0 and e

Improper access control in mail module (channel partners) in Odoo Community 14.0 and earlier and Odoo Enterprise 14.0 an

Improper access control in Odoo Community 14.0 and earlier and Odoo Enterprise 14.0 and earlier, allows remote authentic

Improper access control in message routing in Odoo Community 12.0 and earlier and Odoo Enterprise 12.0 and earlier allow

Cross-site scripting (XSS) issue in web module in Odoo Community 11.0 through 14.0 and Odoo Enterprise 11.0 through 14.0

Cross-site scripting (XSS) issue in mail module in Odoo Community 13.0 and earlier and Odoo Enterprise 13.0 and earlier,

Cross-site scripting (XSS) issue in attachment management in Odoo Community 14.0 and earlier and Odoo Enterprise 14.0 an

Cross-site scripting (XSS) issue in "document" module in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and ea

This affects the package multi-ini before 2.1.2. It is possible to pollute an object's prototype by specifying the const

This affects the package multi-ini before 2.1.1. It is possible to pollute an object's prototype by specifying the proto

An issue was discovered in the SecurePoll extension for MediaWiki through 1.35.1. The non-admin vote list contains a ful

An issue was discovered in the GlobalUsage extension for MediaWiki through 1.35.1. SpecialGlobalUsage.php calls WikiMap:

async-h1 is an asynchronous HTTP/1.1 parser for Rust (crates.io). There is a request smuggling vulnerability in async-h1

DBdeployer is a tool that deploys MySQL database servers easily. In DBdeployer before version 1.58.2, users unpacking a

IBM Security Secret Server 10.6 stores potentially sensitive information in config files that could be read by an authen

IBM Security Secret Server 10.6 could allow a remote attacker to obtain sensitive information when a detailed technical

IBM Security Secret Server 10.6 could allow a remote attacker to obtain sensitive information, caused by the failure to

IBM Security Secret Server 10.6 could allow a remote attacker to conduct phishing attacks, using an open redirect attack

IBM Automation Workstream Services 19.0.3, 20.0.1, 20.0.2, IBM Business Automation Workflow 18.0, 19.0, and 20.0 and IBM

IBM FileNet Content Manager and IBM Content Navigator 3.0.CD is vulnerable to stored cross-site scripting. This vulnerab

IBM Financial Transaction Manager 3.0.6 and 3.1.0 does not invalidate session after logout which could allow an authenti

The Jupyter Server provides the backend (i.e. the core services, APIs, and REST endpoints) for Jupyter web applications

The install.c module in the Pengutronix RAUC update client prior to version 1.5 has a Time-of-Check Time-of-Use vulnerab

HCL iNotes is susceptible to a Tabnabbing vulnerability caused by improper sanitization of message content. A remote una

A flaw was found in ovirt-engine 4.4.3 and earlier allowing an authenticated user to read other users' personal informat

VMware ESXi (7.0 prior to ESXi70U1c-17325551), VMware Workstation (16.x prior to 16.0 and 15.x prior to 15.5.7), VMware

SolarWinds Web Help Desk 12.7.0 allows CSV Injection, also known as Formula Injection, via a file attached to a ticket.

Coastercms v5.8.18 is affected by cross-site Scripting (XSS). A user can steal a cookie and make the user redirect to an

DotCMS Add Template with admin panel 20.11 is affected by cross-site Scripting (XSS) to gain remote privileges. An attac

Nifty-PM CPE 2.3 is affected by stored HTML injection. The impact is remote arbitrary code execution.

The limit-login-attempts-reloaded plugin before 2.17.4 for WordPress allows wp-admin/options-general.php?page=limit-logi

Affected versions of Atlassian Crucible allow remote attackers to impact the application's availability via a Denial of

HCL iNotes v9, v10 and v11 is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability due to improper handling

HCL Verse v10 and v11 is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability due to improper handling of me

In the Pulsar manager 0.1.0 version, malicious users will be able to bypass pulsar-manager's admin, permission verificat

There is a XSS in the user login page in zzcms 2019. Users can inject js code by the referer header via user/login.php

Open Zaak is a modern, open-source data- and services-layer to enable zaakgericht werken, a Dutch approach to case manag

IBM Planning Analytics 2.0 is vulnerable to cross-site request forgery which could allow an attacker to execute maliciou

Host Header Injection in Spiceworks 7.5.7.0 allowing the attacker to render arbitrary links that point to a malicious we

A reflected Cross-site scripting (XSS) vulnerability in Xinuo (formerly SCO) Openserver version 5 and 6 allows remote at

In tangro Business Workflow before 1.18.1, knowing an attachment ID, it is possible to download workitem attachments wit

In tangro Business Workflow before 1.18.1, a user's profile contains some items that are greyed out and thus are not int

An issue was discovered in tangro Business Workflow before 1.18.1. No (or broken) access control checks exist on the /ap

In tangro Business Workflow before 1.18.1, an attacker can manipulate the value of PERSON in requests to /api/profile in

Every login in tangro Business Workflow before 1.18.1 generates the same JWT token, which allows an attacker to reuse th

In tangro Business Workflow before 1.18.1, the documentId of attachment uploads to /api/document/attachments/upload can

An issue was discovered in the GPS daemon on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) (non-Qualcomm chips

An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) software. Any application may establi

An issue was discovered in Finder on Samsung mobile devices with Q(10.0) software. A call to a non-existent provider all

SolarWinds Web Help Desk 12.7.0 allows XSS via the First Name field of a User Account.