2020

FruityWifi through 2.4 has an unsafe Sudo configuration [(ALL : ALL) NOPASSWD: ALL]. This allows an attacker to perform

A Cross-Site Request Forgery (CSRF) vulnerability is identified in FruityWifi through 2.4. Due to a lack of CSRF protect

NVIDIA GeForce Experience, all versions prior to 3.20.5.70, contains a vulnerability in the ShadowPlay component which m

NVIDIA GeForce Experience, all versions prior to 3.20.5.70, contains a vulnerability in its services in which a folder i

NVIDIA GeForce Experience, all versions prior to 3.20.5.70, contains a vulnerability in NVIDIA Web Helper NodeJS Web Ser

An arbitrary command execution vulnerability exists in the fopen() function of file writes of UCMS v1.4.8, where an atta

A SSRF vulnerability exists in the downloadimage interface of CRMEB 3.0, which can remotely download arbitrary files on

VMware Horizon Client for Windows (5.x prior to 5.5.0) contains an information disclosure vulnerability. A malicious att

VMware Horizon Server (7.x prior to 7.10.3 or 7.13.0) contains a Cross Site Scripting (XSS) vulnerability. Successful ex

In Eclipse Jetty versions 1.0 thru 9.4.32.v20200930, 10.0.0.alpha1 thru 10.0.0.beta2, and 11.0.0.alpha1 thru 11.0.0.beta

Belkin LINKSYS WRT160NL 1.0.04.002_US_20130619 devices have a stack-based buffer overflow vulnerability because of sprin

CryptoPro CSP through 5.0.0.10004 on 64-bit platforms allows local users with the SeChangeNotifyPrivilege right to cause

CryptoPro CSP through 5.0.0.10004 on 32-bit platforms allows Local Privilege Escalation (by local users with the SeChang

FRITZ!OS before 7.21 on FRITZ!Box devices allows a bypass of a DNS Rebinding protection mechanism.

OX App Suite through 7.10.3 allows stats/diagnostic?param= XSS.

OX App Suite through 7.10.3 allows Information Exposure because a user can obtain the IP address and User-Agent string o

OX App Suite through 7.10.3 allows SSRF via the the /ajax/messaging/message message API.

Verifone MX900 series Pinpad Payment Terminals with OS 30251000 allow multiple arbitrary command injections, as demonstr

Verifone MX900 series Pinpad Payment Terminals with OS 30251000 have Insecure Permissions, with resultant svc_netcontrol

Verifone Verix OS on VerixV Pinpad Payment Terminals with QT000530 have a Buffer Overflow via the Run system call.

Verifone VerixV Pinpad Payment Terminals with QT000530 have an undocumented physical access mode (aka VerixV shell.out).

Verifone Pinpad Payment Terminals allow undocumented physical access to the system via an SBI bootloader memory write op

Verifone MX900 series Pinpad Payment Terminals with OS 30251000 allow installation of unsigned packages.

Verifone VerixV Pinpad Payment Terminals with QT000530 allow bypass of integrity and origin control for S1G file generat

Verifone MX900 series Pinpad Payment Terminals with OS 30251000 have a race condition for RBAC bypass.

A cross-site scripting (XSS) vulnerability on Comtrend AR-5387un devices with A731-410JAZ-C04_R02.A2pD035g.d23i firmware

Parse Server (npm package parse-server) broadcasts events to all clients without checking if the session token is valid.

Velero (prior to 1.4.3 and 1.5.2) in some instances doesn’t properly manage volume identifiers which may result in infor

An issue was discovered in the Linux kernel through 5.9.1, as used with Xen through 4.14.x. drivers/xen/events/events_ba

An issue was discovered in Xen through 4.14.x allowing x86 PV guest OS users to gain guest OS privileges by modifying ke

An issue was discovered in the Linux kernel through 5.9.1, as used with Xen through 4.14.x. Guest OS users can cause a d

An issue was discovered in Xen through 4.14.x allowing x86 guest OS users to cause a host OS denial of service, achieve

An issue was discovered in Xen through 4.14.x allowing x86 HVM and PVH guest OS users to cause a denial of service (data

An issue was discovered in Xen through 4.14.x allowing x86 guest OS users to cause a denial of service (data corruption)

An XXE vulnerability exists within LeviStudioU Release Build 2019-09-21 and prior when processing parameter entities, wh

A CSRF vulnerability in Eyoucms v1.2.7 allows an attacker to add an admin account via login.php.

Mozilla developers reported memory safety bugs present in Firefox 81. Some of these bugs showed evidence of memory corru

Mozilla developers and community members reported memory safety bugs present in Firefox 81 and Firefox ESR 78.3. Some of

When a link to an external protocol was clicked, a prompt was presented that allowed the user to choose what application

When multiple WASM threads had a reference to a module, and were looking up exported functions, one WASM thread could ha

If a valid external protocol handler was referenced in an image tag, the resulting broken image size could be distinguis

An issue has been discovered in GitLab Runner affecting all versions starting from 13.4.0 before 13.4.2, all versions st

Arbitrary code execution vulnerability affecting multiple Micro Focus products. 1.) Operation Bridge Manager affecting v

In Network Security Services before 3.44, a malformed Netscape Certificate Sequence can cause NSS to crash, resulting in

In Network Security Services (NSS) before 3.46, several cryptographic primitives had missing length checks. In cases whe

In Network Security Services (NSS) before 3.36.7 and before 3.41.1, a malformed signature can cause a crash due to a nul

A flaw was found in the fabric8-maven-plugin 4.0.0 and later. When using a wildfly-swarm or thorntail custom configurati

Microchip CryptoAuthentication Library CryptoAuthLib prior to 20191122 has a Buffer Overflow (issue 1 of 2).

An information disclosure issue was addressed with improved state management. This issue is fixed in macOS Catalina 10.1

A path handling issue was addressed with improved validation. This issue is fixed in iOS 13.5 and iPadOS 13.5, macOS Cat