2020

Blueman is a GTK+ Bluetooth Manager. In Blueman before 2.1.4, the DhcpClient method of the D-Bus interface to blueman-me

All versions of package dat.gui are vulnerable to Regular Expression Denial of Service (ReDoS) via specifically crafted

Wire before 2020-10-16 allows remote attackers to cause a denial of service (application crash) or possibly execute arbi

Code execution with escalated privileges vulnerability in Micro Focus products Operation Bridge Manager and Operation Br

Arbitrary code execution vlnerability in Operation bridge Manager, Application Performance Management and Operations Bri

This affects the package npm-user-validate before 1.0.1. The regex that validates user emails took exponentially longer

A SQL injection vulnerability exists in Victor CMS V1.0 in the cat_id parameter of the category.php file. This parameter

Clustered Data ONTAP versions 9.7 through 9.7P7 are susceptible to a vulnerability which allows an attacker with access

Check Point ZoneAlarm before version 15.8.139.18543 allows a local actor to escalate privileges while restoring files in

Check Point ZoneAlarm before version 15.8.139.18543 allows a local actor to delete arbitrary files while restoring files

An issue exits in IOBit Malware Fighter version 8.0.2.547. Local escalation of privileges is possible by dropping a mali

An issue was discovered in beta versions of the 1Password command-line tool prior to 0.5.5 and in beta versions of the 1

All versions of package trim are vulnerable to Regular Expression Denial of Service (ReDoS) via trim().

Pulse Secure Desktop Client 9.0Rx before 9.0R5 and 9.1Rx before 9.1R4 on Windows reveals users' passwords if Save Settin

A RemoteFunctions endpoint with missing access control in konzept-ix publiXone before 2020.015 allows attackers to discl

Multiple cross-site scripting (XSS) vulnerabilities in konzept-ix publiXone before 2020.015 allow remote attackers to in

A hardcoded AES key in CipherUtils.java in the Java applet of konzept-ix publiXone before 2020.015 allows attackers to c

konzept-ix publiXone before 2020.015 allows attackers to download files by iterating over the IXCopy fileID parameter.

konzept-ix publiXone before 2020.015 allows attackers to take over arbitrary user accounts by crafting password-reset to

An XML external entity (XXE) vulnerability in Pulse Connect Secure (PCS) before 9.1R9 and Pulse Policy Secure (PPS) befo

checkpath in OpenRC through 0.42.1 might allow local users to take ownership of arbitrary files because a non-terminal p

libtac in pam_tacplus through 1.5.1 lacks a check for a failure of RAND_bytes()/RAND_pseudo_bytes(). This could lead to

An out-of-bounds read in the JavaScript Interpreter in Facebook Hermes prior to commit 8cb935cd3b2321c46aa6b7ed8454d95c7

Ruckus vRioT through 1.5.1.0.21 has an API backdoor that is hardcoded into validate_token.py. An unauthenticated attacke

Ruckus through 1.5.1.0.21 is affected by remote command injection. An authenticated user can submit a query to the API (

eMPS prior to eMPS 9.0 FireEye EX 3500 devices allows remote authenticated users to conduct SQL injection attacks via th

In Wiki.js before version 2.5.162, an XSS payload can be injected in a page title and executed via the search results. W

In the git-tag-annotation-action (open source GitHub Action) before version 1.0.1, an attacker can execute arbitrary (*)

A Denial of Service condition in Motion-Project Motion 3.2 through 4.3.1 allows remote unauthenticated users to cause a

In Octopus Deploy through 2020.4.2, an attacker could redirect users to an external site via a modified HTTP Host header

In lookatme (python/pypi package) versions prior to 2.3.0, the package automatically loaded the built-in "terminal" and

opentmpfiles through 0.3.1 allows local users to take ownership of arbitrary files because d entries are mishandled and

This affects the package systeminformation before 4.27.11. This package is vulnerable to Command Injection. The attacker

An issue was discovered in KDE Partition Manager 4.1.0 before 4.2.0. The kpmcore_externalcommand helper contains a logic

SSMC3.7.0.0 is vulnerable to remote authentication bypass. HPE StoreServ Management Console (SSMC) 3.7.0.0 is an off nod

The HPE BlueData EPIC Software Platform version 4.0 and HPE Ezmeral Container Platform 5.0 use an insecure method of han

A remote unauthenticated arbitrary code execution vulnerability was discovered in Aruba Airwave Software version(s): Pri

A remote server-side request forgery (ssrf) vulnerability was discovered in Aruba Airwave Software version(s): Prior to

A remote escalation of privilege vulnerability was discovered in Aruba Airwave Software version(s): Prior to 1.3.2.

A remote unauthorized access vulnerability was discovered in Aruba Airwave Software version(s): Prior to 1.3.2.

A ZTE product is impacted by an XSS vulnerability. The vulnerability is caused by the lack of correct verification of cl

A remote execution of arbitrary commandss vulnerability was discovered in Aruba Airwave Software version(s): Prior to 1.

A remote execution of arbitrary commands vulnerability was discovered in Aruba Airwave Software version(s): Prior to 1.3

A cross-site scripting (XSS) vulnerability AntSword v2.0.7 can remotely execute system commands.

Arista EOS before 4.21.12M, 4.22.x before 4.22.7M, 4.23.x before 4.23.5M, and 4.24.x before 4.24.2F allows remote attack

Arista’s CloudVision eXchange (CVX) server before 4.21.12M, 4.22.x before 4.22.7M, 4.23.x before 4.23.5M, and 4.24.x bef

AntSword 2.1.8.1 contains a cross-site scripting (XSS) vulnerability in the View Site funtion. When viewing an added sit

pathval before version 1.1.1 is vulnerable to prototype pollution.

An issue was discovered in illumos before 2020-10-22, as used in OmniOS before r151030by, r151032ay, and r151034y and Sm

Multiple Stored Cross Site Scripting (XSS) vulnerabilities exist in the YOURLS Admin Panel, Versions 1.5 - 1.7.10. An au