2020

Advantech WebAccess HMI Designer, Versions 2.1.9.31 and prior. An out-of-bounds read vulnerability may be exploited by p

MyBrowserPlus downloads the files needed to run the program through the setup file (Setup.inf). At this time, there is a

In FreeBSD 12.1-STABLE before r362166, 12.1-RELEASE before p8, 11.4-STABLE before r362167, 11.4-RELEASE before p2, and 1

Jeedom through 4.0.38 allows XSS.

In Sulu before versions 1.6.35, 2.0.10, and 2.1.1, when the "Forget password" feature on the login screen is used, Sulu

The Chartkick gem through 3.3.2 for Ruby allows Cascading Style Sheets (CSS) Injection (without attribute).

In etcd before versions 3.3.23 and 3.4.10, certain directory paths are created (etcd data directory and the directory pa

In etcd before versions 3.3.23 and 3.4.10, it is possible to have an entry index greater then the number of entries in t

In etcd before versions 3.3.23 and 3.4.10, a large slice causes panic in decodeRecord method. The size of a record is st

LimeSurvey 4.3.2 allows reflected XSS because application/controllers/LSBaseController.php lacks code to validate parame

USVN (aka User-friendly SVN) before 1.0.9 allows XSS via SVN logs.

An input validation vulnerability found in multiple Trend Micro products utilizing a particular version of a specific ro

The Field Test gem 0.2.0 through 0.3.2 for Ruby allows CSRF.

A flaw was found in the way xserver memory was not properly initialized. This could leak parts of server memory to the X

An integer overflow leading to a heap-buffer overflow was found in The X Input Method (XIM) client was implemented in li

Extreme EAC Appliance 8.4.1.24 allows unauthenticated reflected XSS via a parameter in a GET request.

Affected versions of Atlassian Fisheye allow remote attackers to view the HTTP password of a repository via an Informati

In solidus before versions 2.8.6, 2.9.6, and 2.10.2, there is an bility to change order address without triggering addre

Extreme Analytics in Extreme Management Center before 8.5.0.169 allows unauthenticated reflected XSS via a parameter in

save-server (npm package) before version 1.05 is affected by a CSRF vulnerability, as there is no CSRF mitigation (Token

In Firecracker 0.20.x before 0.20.1 and 0.21.x before 0.21.2, the network stack can freeze under heavy ingress traffic.

An issue was discovered in the Gantt-Chart module before 5.5.5 for Jira. Due to missing validation of user input, it is

IBM Spectrum Protect Plus 10.1.0 through 10.1.6 agent files, in non-default configurations, on Windows are assigned acce

IBM Jazz Foundation and IBM Engineering products are vulnerable to cross-site scripting. This vulnerability allows users

IBM Jazz Foundation and IBM Engineering products are vulnerable to cross-site scripting. This vulnerability allows users

IBM Jazz Foundation and IBM Engineering products could allow an authenticated user to send a specially crafted HTTP GET

IBM Jazz Foundation and IBM Engineering products are vulnerable to cross-site scripting. This vulnerability allows users

A GET-based XSS reflected vulnerability in Plesk Onyx 17.8.11 allows remote unauthenticated users to inject arbitrary Ja

A GET-based XSS reflected vulnerability in Plesk Obsidian 18.0.17 allows remote unauthenticated users to inject arbitrar

Active IQ Unified Manager for VMware vSphere and Windows versions prior to 9.5 are susceptible to a vulnerability which

Tiki before 21.2 allows XSS because [\s\/"\'] is not properly considered in lib/core/TikiFilter/PreventXss.php.

It was found that the AMQ Online console is vulnerable to a Cross-Site Request Forgery (CSRF) which is exploitable in ca

Extreme Management Center 8.4.1.24 allows unauthenticated reflected XSS via a parameter in a GET request.

A denial-of-service vulnerability in the Fanuc i Series CNC (0i-MD and 0i Mate-MD) could allow an unauthenticated, remot

radare2 4.5.0 misparses DWARF information in executable files, causing a segmentation fault in parse_typedef in type_dwa

A reflected Cross-site Scripting (XSS) vulnerability exists in OcPortal 9.0.20 via the OCF_EMOTICON_CELL.tpl FIELD_NAME

Wowza Streaming Engine before 4.8.5 allows XSS (issue 1 of 2). An authenticated user, with access to the proxy license e

IBM Financial Transaction Manager 3.2.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed

IBM Financial Transaction Manager 3.2.4 is vulnerable to SQL injection. A remote attacker could send specially-crafted S

IBM Cognos Analytics 11.0 and 11.1 is vulnerable to privlege escalation where the "My schedules and subscriptions" page

IBM Cognos Analytics 11.0 and 11.1 is susceptible to an information disclosure vulnerability where an attacker could gai

There is an issue with grub2 before version 2.06 while handling symlink on ext filesystems. A filesystem containing a sy

There is an issue on grub2 before version 2.06 at function read_section_as_string(). It expects a font name to be at max

VMware Tanzu Application Service for VMs (2.7.x versions prior to 2.7.19, 2.8.x versions prior to 2.8.13, and 2.9.x vers

Sonatype Nexus Repository Manager OSS/Pro versions before 3.25.1 allow XSS (Issue 2 of 2).

Sonatype Nexus Repository Manager OSS/Pro versions before 3.25.1 allow XSS (issue 1 of 2).

In OctoberCMS before version 1.0.468, encrypted cookie values were not tied to the name of the cookie the value belonged

HUAWEI P30 smartphones with versions earlier than 10.1.0.160(C00E160R2P11) have a denial of service vulnerability. A mod

Huawei FusionComput 8.0.0 have an improper authorization vulnerability. A module does not verify some input correctly an

A data exposure flaw was found in Tower, where sensitive data was revealed from the HTTP return error codes. This flaw a