2020

rConfig 3.9.5 is vulnerable to SQL injection. A remote authenticated attacker could send crafted SQL statements to the d

IBM MQ, IBM MQ Appliance, IBM MQ for HPE NonStop 8.0, 9.1 CD, and 9.1 LTS could allow an attacker to cause a denial of s

Cherokee 0.4.27 to 1.2.104 is affected by a denial of service due to a NULL pointer dereferences. A remote unauthenticat

A remote code execution vulnerability exists in the way that Microsoft Windows Codecs Library handles objects in memory,

A remoted code execution vulnerability exists in the way that Microsoft Windows Codecs Library handles objects in memory

Grundfos CIM 500 v06.16.00 stores plaintext credentials, which may allow sensitive information to be read or allow modif

SteelCentral Aternity Agent 11.0.0.120 on Windows mishandles IPC. It uses an executable running as a high privileged Win

SteelCentral Aternity Agent before 11.0.0.120 on Windows allows Privilege Escalation via a crafted file. It uses an exec

Cross-site request forgery (CSRF) vulnerability in Social Sharing Plugin versions prior to 1.2.10 allows remote attacker

LibEtPan through 1.9.4, as used in MailCore 2 through 0.6.3 and other products, has a STARTTLS buffering issue that affe

This affects all versions of package fast-http. There is no path sanitization in the path provided at fs.readFile in ind

This affects all versions of package rollup-plugin-dev-server. There is no path sanitization in readFile operation insid

This affects all versions of package rollup-plugin-server. There is no path sanitization in readFile operation performed

This affects all versions of package marked-tree. There is no path sanitization in the path provided at fs.readFile in i

This affects all versions of package marscode. There is no path sanitization in the path provided at fs.readFile in inde

In OSIsoft PI System multiple products and versions, a remote, unauthenticated attacker could crash PI Network Manager s

In OSIsoft PI System multiple products and versions, a local attacker can modify a search path and plant a binary to exp

In OSIsoft PI System multiple products and versions, a local attacker can plant a binary and bypass a code integrity che

In OSIsoft PI System multiple products and versions, a local attacker can exploit incorrect permissions set by affected

Improper access control in Citrix Workspace app for Windows 1912 CU1 and 2006.1 causes privilege escalation and code exe

napi_get_value_string_*() allows various kinds of memory corruption in node < 10.21.0, 12.18.0, and < 14.4.0.

Overwolf before 0.149.2.30 mishandles Symbolic Links during updates, causing elevation of privileges.

An unquoted service path vulnerability was reported in Lenovo Drivers Management prior to version 2.7.1128.1046 that cou

A DLL search path vulnerability was reported in Lenovo Drivers Management prior to version 2.7.1128.1046 that could allo

scp in OpenSSH through 8.3p1 allows command injection in the scp.c toremote function, as demonstrated by backtick charac

There is a SQL Injection in Mida eFramework through 2.9.0 that leads to Information Disclosure. No authentication is req

Mida eFramework through 2.9.0 allows unauthenticated ../ directory traversal.

A CWE-521: Weak Password Requirements vulnerability exists in Easergy Builder (Version 1.4.7.2 and older) which could al

A CWE-20: Improper input validation vulnerability exists in Easergy Builder (Version 1.4.7.2 and older) which could allo

A CWE-316: Cleartext Storage of Sensitive Information in Memory vulnerability exists in Easergy Builder V1.4.7.2 and pri

A CWE-321: Use of hard-coded cryptographic key stored in cleartext vulnerability exists in Easergy Builder V1.4.7.2 and

A CWE-327: Use of a Broken or Risky Cryptographic Algorithm vulnerability exists in Easergy Builder (Version 1.4.7.2 and

**VERSION NOT SUPPORTED WHEN ASSIGNED** A legacy debug port account in TCMs installed in Tricon system versions 10.2.0 t

This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-86

This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-84

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1

This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of C-MORE H

This vulnerability allows remote attackers to bypass authentication on affected installations of C-MORE HMI EA9 Firmware

A SQL injection vulnerability in softwareupdate_controller.php in the Software Update module before 1.6 for MunkiReport

A SQL injection vulnerability in reportdata_controller.php in the reportdata module before 3.5 for MunkiReport allows at

A SQL injection vulnerability in TableQuery.php in MunkiReport before 5.6.3 allows attackers to execute arbitrary SQL co

A CSRF issue in manager/delete_machine/{id} in MunkiReport before 5.6.3 allows attackers to delete arbitrary machines fr

httpRpmFs in WebCLI in Wind River VxWorks 5.5 through 7 SR0640 has no check for an escape from the web root.

The HTTP Digest Authentication in the GoAhead web server before 5.1.2 does not completely protect against replay attacks

tar/TarFileReader.cpp in Cauldron cbang (aka C-Bang or C!) before 1.6.0 allows Directory Traversal during extraction fro

A buffer overflow in the patching routine of bsdiff4 before 1.2.0 allows an attacker to write to heap memory (beyond all

In Nagios XI before 5.7.3, ajaxhelper.php allows remote authenticated attackers to execute arbitrary commands via cmdsub

IBM Verify Gateway (IVG) 1.0.0 and 1.0.1 uses an inadequate account lockout setting that could allow a remote attacker t

IBM Verify Gateway (IVG) 1.0.0 and 1.0.1 stores user credentials in plain in clear text which can be read by a local use

Adobe Photoshop versions Photoshop CC 2019, and Photoshop 2020 have an out-of-bounds write vulnerability. Successful exp