2020

IBM Spectrum Scale 5.0.0 through 5.0.5.2 does not set the secure attribute on authorization tokens or session cookies. A

IBM Spectrum Scale 5.0.0 through 5.0.5.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed

IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 6.0.3.1 and IBM Sterling File Gateway 2.2.0.0 through 6.0.3

IBM Spectrum Scale V4.2.0.0 through V4.2.3.22 and V5.0.0.0 through V5.0.5 could allow a local attacker to cause a denial

The affected Reason S20 Ethernet Switch is vulnerable to cross-site scripting (XSS), which may allow attackers to trick

IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 6.0.2.2 is vulnerable to SQL injection. A remote attacker c

SAP NetWeaver Design Time Repository (DTR), versions - 7.11, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user-c

SAP Solution Manager and SAP Focused Run (update provided in WILY_INTRO_ENTERPRISE 9.7, 10.1, 10.5, 10.7), allows an una

There is a reflected cross site scripting vulnerability in SAP NetWeaver Composite Application Framework, versions - 7.2

SAP NetWeaver (Compare Systems) versions - 7.20, 7.30, 7.40, 7.50, does not sufficiently validate uploaded XML documents

SAP Banking Services version 500, use an incorrect authorization object in some of its reports. Although the affected re

SAP 3D Visual Enterprise Viewer, version 9, allows an attacker to send certain manipulated file to the victim, which can

SAP BusinessObjects Business Intelligence Platform (Web Services) versions - 410, 420, 430, allows an unauthenticated at

This affects all versions of package osm-static-maps. User input given to the package is passed directly to a template w

This affects the package @tsed/core before 5.65.7. This vulnerability relates to the deepExtend function which is used a

This affects all versions of package lightning-server. It is possible to inject malicious JavaScript code as part of a s

Local file inclusion vulnerability in OneThird CMS v1.96c and earlier allows a remote unauthenticated attacker to execut

On Windows the Veyon Service before version 4.4.2 contains an unquoted service path vulnerability, allowing locally auth

A prototype pollution vulnerability has been found in `object-path` <= 0.11.4 affecting the `set()` method. The vulnerab

An exploitable denial of service vulnerability exists in the ENIP Request Path Logical Segment functionality of Allen-Br

An exploitable denial of service vulnerability exists in the ENIP Request Path Logical Segment functionality of Allen-Br

In platform before version 9.4.4, inline attributes are not properly escaped. If the data that came from users was not e

In Sylius before versions 1.6.9, 1.7.9 and 1.8.3, the user may register in a shop by email [email protected], verify it,

Apache Kylin 2.0.0, 2.1.0, 2.2.0, 2.3.0, 2.3.1, 2.3.2, 2.4.0, 2.4.1, 2.5.0, 2.5.1, 2.5.2, 2.6.0, 2.6.1, 2.6.2, 2.6.3, 2.

A flaw was found in Infinispan (org.infinispan:infinispan-server-runtime) version 10, where it permits local access to c

HUAWEI Mate 30 versions earlier than 10.1.0.150(C00E136R5P3) and HUAWEI P30 version earlier than 10.1.0.160(C00E160R2P11

HUAWEI Mate 20 versions earlier than 10.0.0.188(C00E74R3P8) have a buffer overflow vulnerability in the Bluetooth module

Taurus-AN00B versions earlier than 10.1.0.156(C00E155R7P2) have a privilege elevation vulnerability. Due to lack of priv

E6878-370 versions 10.0.3.1(H557SP27C233),10.0.3.1(H563SP21C233) and E6878-870 versions 10.0.3.1(H557SP27C233),10.0.3.1(

HUAWEI Mate 20 versions earlier than 10.1.0.163(C00E160R3P8) have a JavaScript injection vulnerability. A module does no

An issue was discovered in the _send_secure_msg() function of yubihsm-shell through 2.0.2. The function does not validat

An issue was discovered in the yh_create_session() function of yubihsm-shell through 2.0.2. The function does not explic

In webpack-subresource-integrity before version 1.5.1, all dynamically loaded chunks receive an invalid integrity hash t

Blinger.io v.1.0.2519 is vulnerable to Blind/Persistent XSS. An attacker can send arbitrary JavaScript code via a built-

A DNS rebinding vulnerability in the UPnP MediaServer implementation in Freebox Server before 4.2.3.

In JetBrains YouTrack before 2020.2.10514, SSRF is possible because URL filtering can be escaped.

Sprecher SPRECON-E firmware prior to 8.64b might allow local attackers with access to engineering data to insert arbitra

A iccselectrules expression language injection remote code execution vulnerability was discovered in HPE Intelligent Man

A perfaddormoddevicemonitor expression language injection remote code execution vulnerability was discovered in HPE Inte

A ictexpertcsvdownload expression language injection remote code execution vulnerability was discovered in HPE Intellige

A devicethresholdconfig expression language injection remote code execution vulnerability was discovered in HPE Intellig

A devsoftsel expression language injection remote code execution vulnerability was discovered in HPE Intelligent Managem

A deviceselect expression language injection remote code execution vulnerability was discovered in HPE Intelligent Manag

A faultflasheventselectfact expression language injectionremote code execution vulnerability was discovered in HPE Intel

A userselectpagingcontent expression language injection remote code execution vulnerability was discovered in HPE Intell

A reportpage index expression language injection remote code execution vulnerability was discovered in HPE Intelligent M

A powershellconfigcontent expression language injection remote code execution vulnerability was discovered in HPE Intell

A tvxlanlegend expression language injection remote code execution vulnerability was discovered in HPE Intelligent Manag

A viewbatchtaskresultdetailfact expression language injection remote code execution vulnerability was discovered in HPE

A forwardredirect expression language injection remote code execution vulnerability was discovered in HPE Intelligent Ma