2020

Certain NETGEAR devices are affected by lack of access control at the function level. This affects JGS516PE before 2.6.0

NETGEAR NMS300 devices before 1.6.0.27 are affected by denial of service.

NETGEAR NMS300 devices before 1.6.0.27 are affected by denial of service.

NETGEAR NMS300 devices before 1.6.0.27 are affected by denial of service.

Certain NETGEAR devices are affected by CSRF. This affects GS716Tv3 before 6.3.1.36 and GS724Tv4 before 6.3.1.36.

NETGEAR DGN2200v1 devices before v1.0.0.58 are affected by command injection.

Command Injection in the CPE WAN Management Protocol (CWMP) registration in Amino Communications AK45x series, AK5xx ser

Command Injection in EntoneWebEngine in Amino Communications AK45x series, AK5xx series, AK65x series, Aria6xx series, A

Use of a Hard-coded Password in VNCserver in Amino Communications AK45x series, AK5xx series, AK65x series, Aria6xx seri

Because of hard-coded SSH keys for the root user in Amino Communications AK45x series, AK5xx series, AK65x series, Aria6

Use of Hard-coded Credentials in EntoneWebEngine in Amino Communications AK45x series, AK5xx series, AK65x series, Aria6

The SolarWinds Orion API is vulnerable to an authentication bypass that could allow a remote attacker to execute API com

The Inventory module of the 1E Client 5.0.0.745 doesn't handle an unquoted path when executing %PROGRAMFILES%\1E\Client\

The Inventory module of the 1E Client 5.0.0.745 doesn't handle an unquoted path when executing %PROGRAMFILES%\1E\Client\

The %PROGRAMDATA%\1E\Client directory in 1E Client 5.0.0.745 and 4.1.0.267 allows remote authenticated users and local u

The MSI installer in 1E Client 4.1.0.267 and 5.0.0.745 allows remote authenticated users and local users to gain elevate

Vidyo 02-09-/D allows clickjacking via the portal/ URI.

There is a denial of service vulnerability in some Huawei smartphones. Due to the improper processing of received abnorm

There is an information leak vulnerability in iManager NetEco 6000 versions V600R021C00. A module is lack of authenticat

There is an improper authentication vulnerability in some verisons of Huawei CloudEngine product. A module does not veri

There is an out-of-bound read vulnerability in huawei smartphone Mate 30 versions earlier than 10.1.0.156 (C00E155R7P2).

There is a memory leak vulnerability in some versions of Huawei CloudEngine product. An unauthenticated, remote attacker

There is an out of bound read vulnerability in some verisons of Huawei CloudEngine product. A module does not deal with

There is a use after free vulnerability in Taurus-AL00A versions 10.0.0.1(C00E1R1P1). A module does not deal with specif

server/handler/HistogramQueryHandler.scala in Twitter TwitterServer (aka twitter-server) before 20.12.0, in some configu

The site-offline plugin before 1.4.4 for WordPress lacks certain wp_create_nonce and wp_verify_nonce calls, aka CSRF.

Prototype pollution vulnerability in 'libnested' versions 0.0.0 through 1.5.0 allows an attacker to cause a denial of se

Prototype pollution vulnerability in 'getobject' version 0.1.0 allows an attacker to cause a denial of service and may l

Prototype pollution vulnerability in 'set-object-value' versions 0.0.0 through 0.0.5 allows an attacker to cause a denia

Prototype pollution vulnerability in 'predefine' versions 0.0.0 through 0.1.2 allows an attacker to cause a denial of se

Prototype pollution vulnerability in 'flattenizer' versions 0.0.5 through 1.0.5 allows an attacker to cause a denial of

Prototype pollution vulnerability in 'shvl' versions 1.0.0 through 2.0.1 allows an attacker to cause a denial of service

There is a resource management error vulnerability in Jackman-AL00D versions 8.2.0.185(C00R2P1). Local attackers constru

OpenCart 3.0.3.6 is affected by cross-site scripting (XSS) in the Profile Image. An admin can upload a profile image as

OpenCart 3.0.3.6 is affected by cross-site scripting (XSS) in the Subject field of mail. This vulnerability can allow an

Prototype pollution vulnerability in 'dset' versions 1.0.0 through 2.0.1 allows attacker to cause a denial of service an

Prototype pollution vulnerability in 'deep-set' versions 1.0.0 through 1.0.1 allows attacker to cause a denial of servic

An unauthenticated remote attacker can send data to RsvcHost.exe listening on TCP port 5241 to add entries in the Factor

An attacker-controlled memory allocation size can be passed to the C++ new operator in the CServerManager::HandleBrowseL

An attacker-controlled memory allocation size can be passed to the C++ new operator in RnaDaSvr.dll by sending a special

An attacker can craft and send an OpenNamespace message to port 4241 with valid session-id that triggers an unhandled ex

nopCommerce Store 4.30 is affected by cross-site scripting (XSS) in the Schedule tasks name field. This vulnerability ca

Apache Accumulo versions 1.5.0 through 1.10.0 and version 2.0.0 do not properly check the return value of some policy en

This command injection vulnerability allows attackers to execute arbitrary commands in a compromised application. QNAP h

miniserv.pl in Webmin 1.962 on Windows mishandles special characters in query arguments to the CGI program.

HedgeDoc is a collaborative platform for writing and sharing markdown. In HedgeDoc before version 1.7.1 an attacker can

HedgeDoc is a collaborative platform for writing and sharing markdown. In HedgeDoc before version 1.7.1 an unauthenticat

NCH Express Invoice 8.06 to 8.24 is vulnerable to Reflected XSS in the Quotes List module.

In NCH Express Accounts 8.24 and earlier, an authenticated low-privilege user can enter a crafted URL to access higher-p

NCH Express Accounts 8.24 and earlier allows local users to discover the cleartext password by reading the configuration