2020

IBM Security Secret Server 10.7 could allow a remote attacker to obtain sensitive information, caused by the failure to

IBM Security Secret Server 10.7 could disclose sensitive information included in installation files to an unauthorized u

IBM Security Secret Server 10.7 could allow a remote attacker to obtain sensitive information when a detailed technical

IBM Security Secret Server 10.7 could allow a remote attacker to obtain sensitive information when a detailed technical

IBM Security Secret Server 10.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrar

IBM Security Secret Server 10.7 could allow a remote attacker to hijack the clicking action of the victim. By persuading

Solarwinds Orion (with Web Console WPM 2019.4.1, and Orion Platform HF4 or NPM HF2 2019.4) allows XSS via a name of an a

Solarwinds Orion (with Web Console WPM 2019.4.1, and Orion Platform HF4 or NPM HF2 2019.4) allows XSS via a Responsible

playSMS through 1.4.3 is vulnerable to session fixation.

A NULL pointer dereference in SANE Backends before 1.0.30 allows a malicious device connected to the same local network

An out-of-bounds read in SANE Backends before 1.0.30 may allow a malicious device connected to the same local network as

An out-of-bounds read in SANE Backends before 1.0.30 may allow a malicious device connected to the same local network as

An out-of-bounds read in SANE Backends before 1.0.30 may allow a malicious device connected to the same local network as

GNU Mailman before 2.1.33 allows arbitrary content injection via the Cgi/private.py private archive login page.

Bludit 3.12.0 allows stored XSS via JavaScript code in an SVG document to bl-kernel/ajax/logo-upload.php.

The BIOS onboard MiR's Computer is not protected by password, therefore, it allows a Bad Operator to modify settings suc

There is no mechanism in place to prevent a bad operator to boot from a live OS image, this can lead to extraction of se

Dell EMC Unisphere for PowerMax versions prior to 9.1.0.17, Dell EMC Unisphere for PowerMax Virtual Appliance versions p

GNS3 ubridge through 0.9.18 on macOS, as used in GNS3 server before 2.1.17, allows a local attacker to read arbitrary fi

XSS exists in PRTG Network Monitor 20.1.56.1574 via crafted map properties. An attacker with Read/Write privileges can c

modules\users\admin\edit.php in NukeViet 4.4 allows CSRF to change a user's password via an admin/index.php?nv=users&op=

modules\users\admin\add_user.php in NukeViet 4.4 allows CSRF to add a user account via the admin/index.php?nv=users&op=u

IBM Security Guardium 10.6 and 11.1 may use insufficiently random numbers or values in a security context that depends o

In LoRaMac-node before 4.4.4, a reception buffer overflow can happen due to the received buffer size not being checked.

Tinxy Door Lock with firmware before 3.2 allow attackers to unlock a door by replaying an Unlock request that occurred w

On TP-Link TL-WR740N v4 and TL-WR740ND v4 devices, an attacker with access to the admin panel can inject HTML code and c

Versions before 8.9.1, Various resources in Jira responded with a 404 instead of redirecting unauthenticated users to th

downloadFile.ashx in the Administrator section of the Surveillance module in Global RADAR BSA Radar 1.6.7234.24750 and e

The Firstname and Lastname parameters in Global RADAR BSA Radar 1.6.7234.24750 and earlier are vulnerable to stored cros

A vulnerability was found in Keycloak before 9.0.2, where every Authorization URL that points to an IDP server lacks pro

A vulnerability was found in quay-2, where a stored XSS vulnerability has been found in the super user function of quay.

The ThreatTrack VIPRE Password Vault app through 1.100.1090 for iOS has Missing SSL Certificate Validation.

The Sophos Secure Email application through 3.9.4 for Android has Missing SSL Certificate Validation.

The loginForm within the general/login.php webpage in webTareas 2.0p8 suffers from a Reflected Cross Site Scripting (XSS

Verint Workforce Optimization (WFO) 15.2 allows HTML injection via the "send email" feature.

Victor CMS 1.0 has Persistent XSS in admin/users.php?source=add_user via the user_name, user_firstname, or user_lastname

The Multi-Scheduler plugin 1.0.0 for WordPress has a Cross-Site Request Forgery (CSRF) vulnerability in the forms it pre

A vulnerability was found in Wildfly in versions before 20.0.0.Final, where a remote deserialization attack is possible

An improper neutralization of input vulnerability in FortiWLC 8.5.1 allows a remote authenticated attacker to perform a

In CSS Validator less than or equal to commit 54d68a1, there is a cross-site scripting vulnerability in handling URIs. A

In APNSwift 1.0.0, calling APNSwiftSigner.sign(digest:) is likely to result in a heap buffer overflow. This has been fix

In LoRa Basics Station before 2.0.4, there is a Use After Free vulnerability that leads to memory corruption. This bug i

Kordil EDMS through 2.2.60rc3 allows stored XSS in users_edit.php, users_management_edit.php, and user_management.php.

WebFOCUS Business Intelligence 8.0 (SP6) was prone to XSS via arbitrary URL parameters.

Improper Access Control vulnerability in McAfee Advanced Threat Defense (ATD) prior to 4.10.0 allows local users to view

System Services exports services without permission protect and can lead to information exposure in Snapdragon Industria

Payload size is not validated before reading memory that may cause issue of accessing invalid pointer or some garbage da

Multiple XSS vulnerabilities in the Final Tiles Gallery plugin before 3.4.19 for WordPress allow remote attackers to inj

Concrete5 before 8.5.3 does not constrain the sort direction to a valid asc or desc value.

Multiple XSS vulnerabilities in the Easy Testimonials plugin before 3.6 for WordPress allow remote attackers to inject a