2020

HUAWEI Mate 30 with versions earlier than 10.1.0.150(C00E136R5P3) have a denial of service vulnerability. The system doe

TinyMCE before 4.9.7 and 5.x before 5.1.4 allows XSS in the core parser, the paste plugin, and the visualchars plugin by

A rogue webpage could override the injected WKUserScript used by the download feature, this exploit could result in the

A rogue webpage could override the injected WKUserScript used by the logins autofill, this exploit could result in leaki

The code for downloading files did not properly take care of special characters, which led to an attacker being able to

A redirected HTTP request which is observed or modified through a web extension could bypass existing CORS checks, leadi

When in an endless loop, a website specifying a custom cursor using CSS could make it look like the user is interacting

An iframe sandbox element with the allow-popups flag could be bypassed when using noopener links. This could have led to

By observing the stack trace for JavaScript errors in web workers, it was possible to leak the result of a cross-origin

A unicode RTL order character in the downloaded file name can be used to change the file's name during the download UI f

Given an installed malicious file picker application, an attacker was able to overwrite local files and thus overwrite F

Given an installed malicious file picker application, an attacker was able to steal and upload local files of their choo

Using object or embed tags, it was possible to frame other websites, even if they disallowed framing using the X-Frame-O

Mibew Messenger before 3.2.7 allows XSS via a crafted user name.

CS2 Network P2P through 3.x, as used in millions of Internet of Things devices, suffers from an information exposure fla

A memory leak in the OCUtil.dll library used by Nextcloud Desktop Client 2.6.4 can lead to a DoS against the host system

For GitLab Runner before 13.0.12, 13.1.6, 13.2.3, by replacing dockerd with a malicious server, the Shared Runner is sus

In GitLab before 13.0.12, 13.1.6 and 13.2.3, access grants were not revoked when a user revoked access to an application

In GitLab before 13.0.12, 13.1.6 and 13.2.3 using a branch with a hexadecimal name could override an existing hash.

IBM Jazz Reporting Service 7.0 and 7.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed

IBM Jazz Reporting Service 6.0.2, 6.0.6, 6.0.6.1, 7.0, and 7.0.1 is vulnerable to cross-site scripting. This vulnerabili

IBM Jazz Reporting Service 6.0.6, 6.0.6.1, and 7.0 is vulnerable to cross-site scripting. This vulnerability allows user

Combodo iTop contains a cross-site request forgery (CSRF) vulnerability, attackers can execute specific commands via mal

Combodo iTop contains a stored Cross-site Scripting vulnerability, which can be attacked by uploading file with maliciou

flatCore before 1.5.7 allows XSS by an admin via the acp/acp.php?tn=pages&sub=edit&editpage=1 page_linkname, page_title,

Prometheus Blackbox Exporter through 0.17.0 allows /probe?target= SSRF. NOTE: follow-on discussion suggests that this mi

JetBrains TeamCity before 2019.2.3 is vulnerable to reflected XSS in the administration UI.

JetBrains TeamCity before 2019.2.3 is vulnerable to stored XSS in the administration UI.

In JetBrains TeamCity before 2019.2.3, password parameters could be disclosed via build logs.

In JetBrains TeamCity before 2020.1.1, project parameter values can be retrieved by a user without appropriate permissio

In JetBrains TeamCity before 2020.1, users are able to assign more permissions than they have.

In JetBrains YouTrack before 2020.2.6881, a user without permission is able to create an article draft.

In JetBrains YouTrack before 2020.2.6881, the markdown parser could disclose hidden file existence.

JetBrains YouTrack before 2020.2.10643 was vulnerable to SSRF that allowed scanning internal ports.

In JetBrains YouTrack before 2020.2.8527, the subtasks workflow could disclose issue existence.

DIGITUS DA-70254 4-Port Gigabit Network Hub 2.073.000.E0008 devices allow an attacker on the same network to denial-of-s

DIGITUS DA-70254 4-Port Gigabit Network Hub 2.073.000.E0008 devices allow an attacker on the same network to conduct per

Lindy 42633 4-Port USB 2.0 Gigabit Network Server 2.078.000 devices allow an attacker on the same network to denial-of-s

Lindy 42633 4-Port USB 2.0 Gigabit Network Server 2.078.000 devices allow an attacker on the same network to conduct per

TP-Link USB Network Server TL-PS310U devices before 2.079.000.t0210 allow an attacker on the same network to denial-of-s

TP-Link USB Network Server TL-PS310U devices before 2.079.000.t0210 allow an attacker on the same network to conduct per

Spring Cloud Netflix, versions 2.2.x prior to 2.2.4, versions 2.1.x prior to 2.1.6, and older unsupported versions allow

In Mahara 19.04 before 19.04.6, 19.10 before 19.10.4, and 20.04 before 20.04.1, certain places could execute file or fol

IP address spoofing when proxying using mod_remoteip and mod_rewrite For configurations using proxying with mod_remoteip

Origin Validation Error in temi Robox OS prior to 120, temi Android app up to 1.3.7931 allows remote attackers to access

A Incorrect Execution-Assigned Permissions vulnerability in the permissions package of SUSE Linux Enterprise Server 12-S

An unhandled exception in check_ignored() in apport/report.py can be exploited by a local attacker to cause a denial of

In ectd before versions 3.4.10 and 3.3.23, gateway TLS authentication is only applied to endpoints detected in DNS SRV r

In whoopsie, parse_report() from whoopsie.c allows a local attacker to cause a denial of service via a crafted file. The

etcd before versions 3.3.23 and 3.4.10 does not perform any password length validation, which allows for very short pass