2020

In getUiccCardsInfo of PhoneInterfaceManager.java, there is a possible permissions bypass due to improper input validati

In cdev_get of char_dev.c, there is a possible use-after-free due to a race condition. This could lead to local escalati

"HCL Marketing Platform is vulnerable to cross-site scripting during addition of new users and also while searching for

"HCL Campaign is vulnerable to cross-site scripting when a user provides XSS scripts in Campaign Description field."

When a device running Juniper Networks Junos OS with MPC7, MPC8, or MPC9 line cards installed and the system is configur

OpenNMS is accessible via port 9443

On Juniper Networks MX series, receipt of a stream of specific Layer 2 frames may cause a memory leak resulting in the p

Execution of the "show ospf interface extensive" or "show ospf interface detail" CLI commands on a Juniper Networks devi

A Race Condition vulnerability in Juniper Networks Junos OS LLDP implementation allows an attacker to cause LLDP to cras

SonicOS SSLVPN LDAP login request allows remote attackers to cause external service interaction (DNS) due to improper va

jcore/portal/ajaxPortal.jsp in Jalios JCMS 10.0.2 build-20200224104759 allows XSS via the types parameter. Note: It is a

GNU LibreDWG before 0.11 allows NULL pointer dereferences via crafted input files.

Go before 1.13.13 and 1.14.x before 1.14.5 has a data race in some net/http servers, as demonstrated by the httputil.Rev

evolution-data-server (eds) through 3.36.3 has a STARTTLS buffering issue that affects SMTP and POP3. When a server send

In Go before 1.13.13 and 1.14.x before 1.14.5, Certificate.Verify may lack a check on the VerifyOptions.KeyUsages EKU re

This affects all versions of package react-native-fast-image. When an image with source={{uri: "...", headers: { host: "

Zabbix before 3.0.32rc1, 4.x before 4.0.22rc1, 4.1.x through 4.4.x before 4.4.10rc1, and 5.x before 5.0.2rc1 allows stor

Adobe Media Encoder versions 14.2 and earlier have an out-of-bounds read vulnerability. Successful exploitation could le

An issue was found in Apache Airflow versions 1.10.10 and below. A stored XSS vulnerability was discovered in the Chart

An issue was found in Apache Airflow versions 1.10.10 and below. It was discovered that many of the admin management scr

"BigFix Platform is storing clear text credentials within the system's memory. An attacker who is able to gain administr

A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, rem

A vulnerability in the web-based management interface of Cisco Vision Dynamic Signage Director could allow an authentica

A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, rem

A vulnerability in the web-based management interface of the Cisco SD-WAN vManage Software could allow an authenticated,

A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, rem

A vulnerability in the deep packet inspection (DPI) engine of Cisco SD-WAN vEdge Routers could allow an unauthenticated,

A vulnerability in the web-based management interface for Cisco SD-WAN vManage Software could allow an authenticated, re

A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, rem

A vulnerability in URL filtering of Cisco Content Security Management Appliance (SMA) could allow an unauthenticated, re

Multiple vulnerabilities in the web-based management interface of Cisco Data Center Network Manager (DCNM) could allow a

Multiple vulnerabilities in the web-based management interface of Cisco Data Center Network Manager (DCNM) could allow a

A vulnerability in certain web pages of Cisco Webex Meetings and Cisco Webex Meetings Server could allow an unauthentica

A vulnerability in the API subsystem of Cisco Meetings App could allow an unauthenticated, remote attacker to retain and

A vulnerability in the web-based management interface of Cisco Small Business RV110W and RV215W Series Routers could all

An issue was discovered in GNU LibreDWG through 0.9.3. Crafted input will lead to denial of service in bit_calc_CRC in b

IBM Publishing Engine 6.0.6, 6.0.6.1, and 7.0 does not set the secure attribute on authorization tokens or session cooki

IBM Jazz Team Server based Applications are vulnerable to cross-site scripting. This vulnerability allows users to embed

IBM Team Concert (RTC) is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScr

An issue was discovered in drivers/acpi/acpi_configfs.c in the Linux kernel before 5.7.7. Injection of malicious ACPI ta

In openenclave before 0.10.0, enclaves that use x87 FPU operations are vulnerable to tampering by a malicious host appli

An issue was discovered in drivers/firmware/efi/efi.c in the Linux kernel before 5.4. Incorrect access permissions for t

In Eclipse OpenJ9 prior to version 0.21 on Power platforms, calling the System.arraycopy method with a length longer tha

In SilverStripe through 4.5, malicious users with a valid Silverstripe CMS login (usually CMS access) can craft profile

SilverStripe 4.5.0 allows attackers to read certain records that should not have been placed into a result set. This aff

An issue was discovered in Artica Proxy before 4.30.000000. Stored XSS exists via the Server Domain Name, Your Email Add

A Blind SQL Injection vulnerability in Kronos WebTA 3.8.x and later before 4.0 (affecting the com.threeis.webta.H352prem

Harbor prior to 2.0.1 allows SSRF with this limitation: an attacker with the ability to edit projects can scan ports of

RosarioSIS 6.7.2 is vulnerable to XSS, caused by improper validation of user-supplied input by the PrintSchedules.php sc

An issue was discovered in ajv.validate() in Ajv (aka Another JSON Schema Validator) 6.12.2. A carefully crafted JSON sc