2020

In Conjur OSS Helm Chart before 2.0.0, a recently identified critical vulnerability resulted in the installation of the

documents_add.php in Kordil EDMS through 2.2.60rc3 allows Remote Command Execution because .php files can be uploaded to

Client side code execution in gitlab-vscode-extension v2.2.0 allows attacker to execute code on user system

A vulnerability in Google Cloud Platform's guest-oslogin versions between 20190304 and 20200507 allows a user that is on

A vulnerability in Google Cloud Platform's guest-oslogin versions between 20190304 and 20200507 allows a user that is on

A vulnerability in Google Cloud Platform's guest-oslogin versions between 20190304 and 20200507 allows a user that is on

Zyxel Armor X1 WAP6806 1.00(ABAL.6)C0 devices allow Directory Traversal via the images/eaZy/ URI.

In WebFOCUS Business Intelligence 8.0 (SP6), the administration portal allows remote attackers to read arbitrary local f

WebFOCUS Business Intelligence 8.0 (SP6) allows a Cross-Site Request Forgery (CSRF) attack against administrative users

app/Model/Attribute.php in MISP 2.4.127 lacks an ACL lookup on attribute correlations. This occurs when querying the att

An issue was discovered in the jsrsasign package through 8.0.18 for Node.js. It allows a malleability in ECDSA signature

Improper Input Validation vulnerability in the Safepay browser component of Bitdefender Total Security 2020 allows an ex

Possible memory corruption in perfservice due to improper validation array length taken from user application. in Snapdr

A possible buffer overflow would occur while processing command from firmware due to the group_id obtained from the firm

Use after free issue in camera applications when used randomly over multiple operations due to pointer not set to NULL a

Stack based overflow If the maximum number of arguments allowed per request in perflock exceeds in Snapdragon Auto, Snap

Any application can bind to it and exercise the APIs due to no protection for AIDL uimlpaservice in Snapdragon Auto, Sna

Double free issue in kernel memory mapping due to lack of memory protection mechanism in Snapdragon Compute, Snapdragon

Integer overflow in diag command handler when user inputs a large value for number of tasks field in the request packet

Double free issue in NPU due to lack of resource locking mechanism to avoid race condition in Snapdragon Auto, Snapdrago

Buffer overflow occurs while processing an subsample data length out of range due to lack of user input validation in Sn

While IPA driver processes route add rule IOCTL, there is no input validation of the rule ID prior to adding the rule to

kernel writes to user passed address without any checks can lead to arbitrary memory write in Snapdragon Auto, Snapdrago

A SQL injection vulnerability in PHP-Fusion 9.03.50 affects the endpoint administration/comments.php via the ctype param

aaPanel through 6.6.6 allows remote authenticated users to execute arbitrary commands via shell metacharacters in a modi

compose.php in SquirrelMail 1.4.22 calls unserialize for the $attachments value, which originates from an HTTP POST requ

An authorization issue relating to project maintainer impersonation was identified in GitLab EE 9.5 and later through 13

User is allowed to set an email as a notification email even without verifying the new email in all previous GitLab CE/E

A user with an unverified email address could request an access to domain restricted groups in GitLab EE 12.2 and later

A security issue allowed achieving Denial of Service attacks through memory exhaustion by uploading malicious artifacts

A Denial of Service vulnerability allowed exhausting the system resources in GitLab CE/EE 12.0 and later through 13.0.1

OAuth flow missing verification checks CE/EE 12.3 and later through 13.0.1 allows unverified user to use OAuth authoriza

An issue was discovered in BT CTROMS Terminal OS Port Portal CT-464. Account takeover can occur because the password-res

WooCommerce before 3.6.5, when it handles CSV imports of products, has a cross-site request forgery (CSRF) issue with re

Sensitive information written to a log file vulnerability was found in jaegertracing/jaeger before version 1.18.1 when t

An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. Weak hashing was used for e-mail invitation

An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2, when Single Sign-On OAuth2 is used. An att

An issue was discovered in Mattermost Server before 3.2.0. It mishandles brute-force attempts at password change.

An issue was discovered in Mattermost Server before 3.2.0. The initial_load API disclosed unnecessary personal informati

An issue was discovered in Mattermost Server before 1.2.0. It allows attackers to cause a denial of service (memory cons

Alpine before 2.23 silently proceeds to use an insecure connection after a /tls is sent in certain circumstances involvi

An issue was discovered in Mattermost Server before 3.9.0 when SAML is used. Encryption and signature verification are n

An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2. CSRF can occur if CORS is enabled.

An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5, when used as an OAuth 2.0 service provider.

An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It allows a bypass of restrictions on use o

An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It allows attackers to gain privileges by u

An issue was discovered in Mattermost Server before 4.7.0, 4.6.2, and 4.5.2. It did not enforce the expiration date of a

A reliance on cookies without validation/integrity check security vulnerability exists in rack < 2.2.3, rack < 2.1.4 tha

A deserialization of untrusted data vulnerability exists in rails < 5.2.4.3, rails < 6.0.3.1 which can allow an attacker

A client side enforcement of server side security vulnerability exists in rails < 5.2.4.2 and rails < 6.0.3.1 ActiveStor