2020

A logic error in Nextcloud Server 19.0.0 caused a plaintext storage of the share password when it was given on the initi

A too small set of random characters being used for encryption in Nextcloud Server 18.0.4 allowed decryption in shorter

Check Point Endpoint Security Client for Windows, with Anti-Bot or Threat Emulation blades installed, before version E83

Resource Management Errors vulnerability in TCP/IP function included in the firmware of MELSEC iQ-R series (RJ71EIP91 Et

Improper neutralization of argument delimiters in a command ('Argument Injection') vulnerability in TCP/IP function incl

Improper access control vulnerability in TCP/IP function included in the firmware of MELSEC iQ-R series (RJ71EIP91 Ether

NULL pointer dereferences vulnerability in TCP/IP function included in the firmware of MELSEC iQ-R series (RJ71EIP91 Eth

Session fixation vulnerability in TCP/IP function included in the firmware of MELSEC iQ-R series (RJ71EIP91 EtherNet/IP

Buffer overflow vulnerability in TCP/IP function included in the firmware of MELSEC iQ-R series (RJ71EIP91 EtherNet/IP N

Uncontrolled resource consumption vulnerability in Ethernet Port on MELSEC iQ-R, Q and L series CPU modules (R 00/01/02

An issue was discovered in ProlinOS through 2.4.161.8859R. An attacker with local code execution privileges as a normal

An unsigned-library issue was discovered in ProlinOS through 2.4.161.8859R. This OS requires installed applications and

An attacker with physical access to a PAX Point Of Sale device with ProlinOS through 2.4.161.8859R can boot it in manage

MISP through 2.4.133 allows SSRF in the REST client via the use_full_path parameter with an arbitrary URL.

ServiceStack before 5.9.2 mishandles JWT signature verification unless an application has a custom ValidateToken functio

The SIP ALG implementation on NETGEAR Nighthawk R7000 1.0.9.64_10.2.64 devices allows remote attackers to communicate wi

WordPress before 5.5.2 allows CSRF attacks that change a theme's background image.

is_protected_meta in wp-includes/meta.php in WordPress before 5.5.2 allows arbitrary file deletion because it does not p

WordPress before 5.5.2 allows stored XSS via post slugs.

is_blog_installed in wp-includes/functions.php in WordPress before 5.5.2 improperly determines whether WordPress is alre

wp-includes/class-wp-xmlrpc-server.php in WordPress before 5.5.2 allows attackers to gain privileges by using XML-RPC to

WordPress before 5.5.2 allows attackers to gain privileges via XML-RPC.

WordPress before 5.5.2 allows XSS associated with global variables.

WordPress before 5.5.2 mishandles embeds from disabled sites on a multisite network, as demonstrated by allowing a spam

WordPress before 5.5.2 mishandles deserialization requests in wp-includes/Requests/Utility/FilteredIterator.php.

eramba through c2.8.1 allows HTTP Host header injection with (for example) resultant wkhtml2pdf PDF printing by authenti

In Wireshark 3.2.0 to 3.2.7, the GQUIC dissector could crash. This was addressed in epan/dissectors/packet-gquic.c by co

In SonarQube 8.4.2.36762, an external attacker can achieve authentication bypass through SonarScanner. With an empty val

Dr.Fone 3.0.0 allows local users to gain privileges via a Trojan horse DriverInstall.exe because %PROGRAMFILES(X86)%\Won

IceWarp 11.4.5.0 allows XSS via the language parameter.

A vulnerability exists in the Origin Client that could allow a non-Administrative user to elevate their access to either

A cross-site scripting (XSS) issue in REDCap 8.11.6 through 9.x before 10 allows attackers to inject arbitrary JavaScrip

An issue was discovered in REDCap 8.11.6 through 9.x before 10. The messenger's CSV feature (that allows users to export

A memory leak flaw was found in WildFly in all versions up to 21.0.0.Final, where host-controller tries to reconnect in

SSRF exists in osTicket before 1.14.3, where an attacker can add malicious file to server or perform port scanning.

A command injection vulnerability exists in Moxa Inc VPort 461 Series Firmware Version 3.4 or lower that could allow a r

A cross-site scripting (XSS) vulnerability exists in the Origin Client for Mac and PC 10.5.86 or earlier that could allo

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions

Foxit Reader before 10.0 allows Remote Command Execution via the app.opencPDFWebPage JavsScript API. An attacker can exe

An issue was discovered in IPFS (aka go-ipfs) 0.4.23. An attacker can generate ephemeral identities (Sybils) and leverag

In JUUKO K-808, an attacker could specially craft a packet that encodes an arbitrary command, which could be executed on

JUUKO K-800 (Firmware versions prior to numbers ending ...9A, ...9B, ...9C, etc.) is vulnerable to a replay attack and c

The cross-site scripting vulnerability has been reported to affect earlier versions of Photo Station. If exploited, the

The cross-site scripting vulnerability has been reported to affect earlier versions of Photo Station. If exploited, the

The cross-site scripting vulnerability has been reported to affect earlier versions of Photo Station. If exploited, the

If exploited, this SQL injection vulnerability could allow remote attackers to obtain application information. This issu

If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. This issue

If exploited, this command injection vulnerability could allow remote attackers to execute arbitrary commands. This issu

u'While processing invalid connection request PDU which is nonstandard (interval or timeout is 0) from central device ma

u'Buffer over-read issue in Bluetooth peripheral firmware due to lack of check for invalid opcode and length of opcode r