2020

An issue was discovered in G-Data before 25.5.9.25 using Symbolic links, it is possible to abuse the infected-file resto

The test suite in libopendkim in OpenDKIM through 2.10.3 allows local users to gain privileges via a symlink attack agai

An XSS issue was discovered in Roundcube Webmail before 1.2.13, 1.3.x before 1.3.16, and 1.4.x before 1.4.10. The attack

An issue was discovered in Joomla! 1.7.0 through 3.9.22. Lack of input validation while handling ACL rulesets can cause

An issue was discovered in Joomla! 2.5.0 through 3.9.22. A missing token check in the emailexport feature of com_privacy

An issue was discovered in Joomla! 3.9.0 through 3.9.22. Improper handling of the username leads to a user enumeration a

An issue was discovered in Joomla! 3.0.0 through 3.9.22. Improper filter blacklist configuration leads to a SQL injectio

An issue was discovered in Joomla! 2.5.0 through 3.9.22. The folder parameter of mod_random_image lacked input validatio

An issue was discovered in Joomla! 2.5.0 through 3.9.22. The globlal configuration page does not remove secrets from the

An issue was discovered in Joomla! 2.5.0 through 3.9.22. The autosuggestion feature of com_finder did not respect the ac

Dex is a federated OpenID Connect provider written in Go. In Dex before version 2.27.0 there is a critical set of vulner

An incorrect permission assignment during the installation script of TeamworkCloud 18.0 thru 19.0 allows a local unprivi

HCL Domino is susceptible to a Denial of Service (DoS) vulnerability due to insufficient validation of input to its publ

A flaw was found in GDM in versions prior to 3.38.2.1. A race condition in the handling of session shutdown makes it pos

date-and-time is an npm package for manipulating date and time. In date-and-time before version 0.14.2, there a regular

An issue with ARP packets in Arista’s EOS affecting the 7800R3, 7500R3, and 7280R3 series of products may result in issu

In Arista EOS malformed packets can be incorrectly forwarded across VLAN boundaries in one direction. This vulnerability

In EVPN VxLAN setups in Arista EOS, specific malformed packets can lead to incorrect MAC to IP bindings and as a result

Ultimate WooCommerce Gift Cards 3.0.2 is affected by a file upload vulnerability in the Custom GiftCard Template that ca

dhowden tag before 2020-11-19 allows "panic: runtime error: slice bounds out of range" via readAtomData.

dhowden tag before 2020-11-19 allows "panic: runtime error: slice bounds out of range" via readTextWithDescrFrame.

dhowden tag before 2020-11-19 allows "panic: runtime error: index out of range" via readAPICFrame.

dhowden tag before 2020-11-19 allows "panic: runtime error: index out of range" via readPICFrame.

An issue was discovered in Zammad before 3.5.1. A REST API call allows an attacker to change Ticket Article data in a wa

An issue was discovered in Zammad before 3.5.1. The default signup Role (for newly created Users) can be a privileged Ro

An issue was discovered in Zammad before 3.5.1. An Agent with Customer permissions in a Group can bypass intended access

An issue was discovered in Zammad before 3.4.1. There is Stored XSS via a Tags element in a TIcket.

An account-enumeration issue was discovered in Zammad before 3.4.1. The Create User functionality is implemented in a wa

An issue was discovered in Zammad before 3.4.1. The Tag and Link REST API endpoints (for add and delete) lack a CSRF tok

An SSRF issue was discovered in Zammad before 3.4.1. The SMS configuration interface for Massenversand is implemented in

An issue was discovered in Zammad before 3.4.1. The global-search feature leaks Knowledge Base drafts to Knowledge Base

An issue was discovered in Zammad before 3.4.1. There is an authentication bypass in the SSO endpoint via a crafted head

An issue was discovered in Zammad before 3.4.1. There are wrong authorization checks for impersonation requests via X-On

An issue was discovered in Zammad before 3.4.1. Admin Users without a ticket.* permission can access Tickets.

Panasonic Security System WV-S2231L 4.25 allows a denial of service of the admin control panel (which will require a phy

Panasonic Security System WV-S2231L 4.25 has an insecure hard-coded password of lkjhgfdsa (which is just the asdf keyboa

FOSCAM FHD X1 1.14.2.4 devices allow attackers (with physical UART access) to login via the ipc.fos~ password.

On Tenda AC1200 (Model AC6) 15.03.06.51_multi devices, the default settings for the router speed test contain links to d

On Tenda AC1200 (Model AC6) 15.03.06.51_multi devices, admin, support, user, and nobody have a password of 1234.

WavPack 5.3.0 has an out-of-bounds write in WavpackPackSamples in pack_utils.c because of an integer overflow in a mallo

GateOne 1.1 allows arbitrary file download without authentication via /downloads/.. directory traversal because os.path.

The WooCommerce plugin before 4.7.0 for WordPress allows remote attackers to view the status of arbitrary orders via the

CXUUCMS V3 allows XSS via the first and third input fields to /public/admin.php.

CXUUCMS V3 allows class="layui-input" XSS.

Certain Zyxel products allow command injection by an admin via an input string to chg_exp_pwd during a password-change a

XXL-JOB 2.2.0 allows Stored XSS (in Add User) to bypass the 20-character limit via xxl-job-admin/src/main/java/com/xxl/j

KLog Server 2.4.1 allows OS command injection via shell metacharacters in the actions/authenticate.php user parameter.

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, rela

An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.35.1.

Backblaze for Windows and Backblaze for macOS before 7.0.0.439 suffer from improper privilege management in `bztransmit`