2020

Gophish before 0.11.0 allows the creation of CSV sheets that contain malicious content.

Genexis Platinum-4410 P4410-V2-1.28 devices allow stored XSS in the WLAN SSID parameter. This could allow an attacker to

An Insecure Direct Object Reference vulnerability in Citadel WebCit through 926 allows authenticated remote attackers to

Multiple cross-site scripting (XSS) vulnerabilities in Citadel WebCit through 926 allow remote attackers to inject arbit

Citadel WebCit through 926 allows unauthenticated remote attackers to enumerate valid users within the platform. NOTE: t

A Weak Session Management vulnerability in Citadel WebCit through 926 allows unauthenticated remote attackers to hijack

The God Kings application 0.60.1 for Android exposes a broadcast receiver to other apps called com.innogames.core.fronte

An issue was discovered in QSC Q-SYS Core Manager 8.2.1. By utilizing the TFTP service running on UDP port 69, a remote

An issue was discovered in Dual DHCP DNS Server 7.40. Due to insufficient access restrictions in the default installatio

An issue was discovered in Home DNS Server 0.10. Due to insufficient access restrictions in the default installation dir

Issues were discovered in Open DHCP Server (Regular) 1.75 and Open DHCP Server (LDAP Based) 0.1Beta. Due to insufficient

Issues were discovered in Open TFTP Server multithreaded 1.66 and Open TFTP Server single port 1.66. Due to insufficient

Sectona Spectra before 3.4.0 has a vulnerable SOAP API endpoint that leaks sensitive information about the configured as

Winston 1.5.4 devices have a CORS configuration that trusts arbitrary origins. This allows requests to be made and viewe

Winston 1.5.4 devices have a local www-data user that is overly permissioned, resulting in root privilege escalation.

Winston 1.5.4 devices allow a U-Boot interrupt, resulting in local root access.

Winston 1.5.4 devices do not enforce authorization. This is exploitable from the intranet, and can be combined with othe

Winston 1.5.4 devices have an SSH user account with access from bastion hosts. This is undocumented in device documents

Winston 1.5.4 devices make use of a Monit service (not managed during the normal user process) which is configured with

The API on Winston 1.5.4 devices is vulnerable to CSRF.

If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. QNAP has al

If exploited, this command injection vulnerability could allow remote attackers to run arbitrary commands. QNAP has alre

If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. QNAP has al

IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to traverse directories on the sys

IBM Sterling Connect Direct for Microsoft Windows 4.7, 4.8, 6.0, and 6.1 could allow a remote attacker to cause a denial

Winston 1.5.4 devices are vulnerable to command injection via the API.

Red Discord Bot before version 3.4.1 has an unauthorized privilege escalation exploit in the Mod module. This exploit al

Shibboleth Identify Provider 3.x before 3.4.6 has a denial of service flaw. A remote unauthenticated attacker can cause

osCommerce Phoenix CE before 1.0.5.4 allows OS command injection remotely. Within admin/mail.php, a from POST parameter

osCommerce Phoenix CE before 1.0.5.4 allows admin/define_language.php CSRF.

NeoPost Mail Accounting Software Pro 5.0.6 allows php/Commun/FUS_SCM_BlockStart.php?code= XSS.

Grafana before 7.1.0-beta 1 allows XSS via a query alias for the ElasticSearch datasource.

The Snap7 server component in version 1.4.1, when an attacker sends a crafted packet with COTP protocol the last-data-un

A vulnerability in the authenticated user web interface of Pulse Connect Secure < 9.1R9 could allow attackers to conduct

A vulnerability in the Pulse Connect Secure / Pulse Policy Secure below 9.1R9 could allow attackers to conduct Cross-Sit

A vulnerability in the Pulse Connect Secure / Pulse Policy Secure < 9.1R9 is vulnerable to arbitrary cookie injection.

A vulnerability in the Pulse Connect Secure < 9.1R9 admin web interface could allow an authenticated attacker to perform

A vulnerability in the Pulse Connect Secure < 9.1R9 admin web interface could allow an authenticated attacker to perform

A vulnerability in the Pulse Secure Desktop Client < 9.1R9 has Remote Code Execution (RCE) if users can be convinced to

A vulnerability in the Pulse Secure Desktop Client (Linux) < 9.1R9 could allow local attackers to escalate privilege.

A vulnerability in the Pulse Secure Desktop Client (Linux) < 9.1R9 could allow local attackers to perform buffer overflo

A vulnerability in the Pulse Secure Desktop Client (Linux) < 9.1R9 could allow local attackers to escalate privilege.

A vulnerability in the Pulse Secure Desktop Client < 9.1R9 could allow the attacker to perform a MITM Attack if end user

A vulnerability in the Pulse Secure Desktop Client < 9.1R9 allows a restricted user on an endpoint machine can use syste

A vulnerability in the Pulse Secure Desktop Client < 9.1R9 is vulnerable to the client registry privilege escalation att

When performing EC scalar point multiplication, the wNAF point multiplication algorithm was used; which leaked partial i

SonicWall Global VPN client version 4.10.4.0314 and earlier have an insecure library loading (DLL hijacking) vulnerabili

SonicWall Global VPN client version 4.10.4.0314 and earlier allows unprivileged windows user to elevate privileges to SY

The RandomGameUnit extension for MediaWiki through 1.35 was not properly escaping various title-related data. When certa

An Arbitrary File Upload in the Upload Image component in SourceCodester Car Rental Management System 1.0 allows the use