2020

In PACTware before 4.1 SP6 and 5.x before 5.0.5.31, passwords are stored in an insecure manner, and may be modified by a

By crafting a special URL it is possible to make Wicket deliver unprocessed HTML templates. This would allow an attacker

The WinRing0.sys and WinRing0x64.sys drivers 1.2.0 in EVGA Precision X1 through 1.0.6 allow local users, including low i

The support bundler in Teradici PCoIP Standard Agent for Windows and Graphics Agent for Windows versions prior to 20.04.

The Management Interface of the Teradici Cloud Access Connector and Cloud Access Connector Legacy for releases prior to

Telegram Desktop through 2.1.13 allows a spoofed file type to bypass the Dangerous File Type Execution protection mechan

Firejail through 0.9.62 does not honor the -- end-of-options indicator after the --output option, which may lead to comm

SABnzbd 2.3.9 and 3.0.0Alpha2 has a command injection vulnerability in the web configuration interface that permits an a

Red Hat CloudForms 4.7 and 5 was vulnerable to Server-Side Request Forgery (SSRF) flaw. With the access to add Ansible T

Red Hat CloudForms 4.7 and 5 is affected by a role-based privilege escalation flaw. An attacker with EVM-Operator group

IBM QRadar 7.2.0 thorugh 7.2.9 could allow an authenticated user to overwrite or delete arbitrary files due to a flaw af

FusionSphere OpenStack 8.0.0 have a protection mechanism failure vulnerability. The product incorrectly uses a protectio

An SQL injection vulnerability in the Analytics component of SAINT Security Suite 8.0 through 9.8.20 allows a remote, au

An SQL injection vulnerability in the Assets component of SAINT Security Suite 8.0 through 9.8.20 allows a remote, authe

In MyBB before version 1.8.24, the custom MyCode (BBCode) for the visual editor doesn't escape input properly when rende

FusionCompute 8.0.0 have local privilege escalation vulnerability. A local, authenticated attacker could perform specifi

ECDSA/EC/Point.pm in Crypt::Perl before 0.33 does not properly consider timing attacks against the EC point multiplicati

Mozilla developers and community members reported memory safety bugs present in Firefox 78 and Firefox ESR 78.0. Some of

Firefox could be made to load attacker-supplied DLL files from the installation directory. This required an attacker tha

JIT optimizations involving the Javascript arguments object could confuse later optimizations. This risk was already mit

A Content Provider in Firefox for Android allowed local files accessible by the browser to be read by a remote webpage,

Firmware developed by Shenzhen Hichip Vision Technology (V6 through V20), as used by many different vendors in millions

CS2 Network P2P through 3.x, as used in millions of Internet of Things devices, suffers from an authentication flaw that

A code injection in Nextcloud Desktop Client 2.6.4 allowed to load arbitrary code when placing a malicious OpenSSL confi

An SQL injection vulnerability exists in the frappe.desk.reportview.get functionality of ERPNext 11.1.38. A specially cr

An exploitable code execution vulnerability exists in the file system checking functionality of fsck.f2fs 1.12.0. A spec

A security misconfiguration exists in Combodo iTop, which can expose sensitive information.

Combodo iTop does not validate inputted parameters, attackers can inject malicious commands and launch XSS attack.

A function in Combodo iTop contains a vulnerability of Broken Access Control, which allows unauthorized attacker to inje

flatCore before 1.5.7 allows upload and execution of a .php file by an admin.

In JetBrains ToolBox version 1.17 before 1.17.6856, the set of signature verifications omitted the jetbrains-toolbox.exe

In JetBrains TeamCity before 2020.1, users with the Modify Group permission can elevate other users' privileges.

In JetBrains Kotlin from 1.4-M1 to 1.4-RC (as Kotlin 1.3.7x is not affected by the issue. Fixed version is 1.4.0) there

JetBrains YouTrack before 2020.2.8873 is vulnerable to SSRF in the Workflow component.

In JetBrains YouTrack before 2020.1.1331, an external user could execute commands against arbitrary issues.

In JetBrains Upsource before 2020.1, information disclosure is possible because of an incorrect user matching algorithm.

DIGITUS DA-70254 4-Port Gigabit Network Hub 2.073.000.E0008 devices allow an attacker on the same network to bypass auth

DIGITUS DA-70254 4-Port Gigabit Network Hub 2.073.000.E0008 devices allow an attacker on the same network to elevate pri

Lindy 42633 4-Port USB 2.0 Gigabit Network Server 2.078.000 devices allow an attacker on the same network to bypass auth

Lindy 42633 4-Port USB 2.0 Gigabit Network Server 2.078.000 devices allow an attacker on the same network to elevate pri

TP-Link USB Network Server TL-PS310U devices before 2.079.000.t0210 allow an attacker on the same network to bypass auth

TP-Link USB Network Server TL-PS310U devices before 2.079.000.t0210 allow an attacker on the same network to elevate pri

A vulnerability was discovered in the web interface component of IP Office that may potentially allow a remote, unauthen

An issue was discovered in PassMark BurnInTest through 9.1, OSForensics through 7.1, and PerformanceTest through 10. The

An issue was discovered in PassMark BurnInTest through 9.1, OSForensics through 7.1, and PerformanceTest through 10. The

Two OS command injection vulnerabilities in the User Portal of Sophos XG Firewall through 2020-08-05 potentially allow a

Prism is vulnerable to Cross-Site Scripting. The easing preview of the Previewers plugin has an XSS vulnerability that a

Apache HTTP Server versions 2.4.20 to 2.4.43. A specially crafted value for the 'Cache-Digest' header in a HTTP/2 reques

hslogin2.dll ActiveX Control in Groupware contains a vulnerability that could allow remote files to be downloaded and ex

Apache HTTP Server versions 2.4.20 to 2.4.43 When trace/debug was enabled for the HTTP/2 module and on certain traffic e