2020

Next.js versions >=9.5.0 and <9.5.4 are vulnerable to an Open Redirect. Specially encoded paths could be used with the t

A logic vulnerability when handling the SaveGeneratorLong instruction in Facebook Hermes prior to commit b2021df62082462

A vulnerability in specified versions of American Dynamics victor Web Client and Software House CCURE Web Client could a

forma.lms 2.3.0.2 is affected by Cross Site Request Forgery (CSRF) in formalms/appCore/index.php?r=lms/profile/show&ap=s

Zoho ManageEngine Applications Manager 14780 and before allows a remote unauthenticated attacker to register managed ser

Dell EMC OpenManage Integration for Microsoft System Center (OMIMSSC) for SCCM and SCVMM versions prior to 7.2.1 contain

IBM Informix spatial 14.10 could allow a local user to execute commands as a privileged user due to an out of bounds wri

IBM QRadar SIEM 7.3 and 7.4 could allow a remote attacker to execute arbitrary commands on the system, caused by insecur

Users of the HAPI FHIR Testpage Overlay 5.0.0 and below can use a specially crafted URL to exploit an XSS vulnerability

If an attacker intercepts Thunderbird's initial attempt to perform automatic account setup using the Microsoft Exchange

An issue has been discovered in GitLab affecting all versions prior to 13.2.10, 13.3.7 and 13.4.2. Sessions keys are sto

An issue has been discovered in GitLab affecting all versions prior to 13.2.10, 13.3.7 and 13.4.2: Stored XSS in CI Job

An issue has been discovered in GitLab affecting all versions before 13.2.10, 13.3.7 and 13.4.2: XSS in SVG File Preview

During ECDSA signature generation, padding applied in the nonce designed to ensure constant-time scalar multiplication w

When converting coordinates from projective to affine, the modular inversion was not performed in constant time, resulti

IBM QRadar SIEM 7.3 and 7.4 when configured to use Active Directory Authentication may be susceptible to spoofing attack

Jenkins Nerrvana Plugin 1.02.06 and earlier does not configure its XML parser to prevent XML external entity (XXE) attac

Jenkins SMS Notification Plugin 1.2 and earlier stores an access token unencrypted in its global configuration file on t

A cross-site request forgery (CSRF) vulnerability in Jenkins Shared Objects Plugin 0.44 and earlier allows attackers to

A cross-site request forgery (CSRF) vulnerability in Jenkins Maven Cascade Release Plugin 1.3.2 and earlier allows attac

Jenkins Maven Cascade Release Plugin 1.3.2 and earlier does not perform permission checks in several HTTP endpoints, all

Jenkins Persona Plugin 2.4 and earlier allows users with Overall/Read permission to read arbitrary files on the Jenkins

Jenkins Release Plugin 2.10.2 and earlier does not escape the release version in badge tooltip, resulting in a stored cr

Jenkins couchdb-statistics Plugin 0.3 and earlier stores its server password unencrypted in its global configuration fil

Jenkins Active Choices Plugin 2.4 and earlier does not escape some return values of sandboxed scripts for Reactive Refer

Jenkins Active Choices Plugin 2.4 and earlier does not escape the name and description of build parameters, resulting in

In Jenkins Audit Trail Plugin 3.6 and earlier, the default regular expression pattern could be bypassed in many cases by

Jenkins Audit Trail Plugin 3.6 and earlier applies pattern matching to a different representation of request URL paths t

Jenkins Role-based Authorization Strategy Plugin 3.0 and earlier does not properly invalidate a permission cache when th

An issue was discovered on D-Link DSR-250N before 3.17B devices. The CGI script upgradeStatusReboot.cgi can be accessed

In SourceCodester Online Bus Booking System 1.0, there is Authentication bypass on the Admin Login screen in admin.php v

In SourceCodester Online Bus Booking System 1.0, there is XSS through the name parameter in book_now.php.

PHPGurukul hospital-management-system-in-php 4.0 allows XSS via admin/patient-search.php, doctor/search.php, book-appoin

PHPGurukul hostel-management-system 2.1 allows XSS via Guardian Name, Guardian Relation, Guardian Contact no, Address, o

PyroCMS 3.7 is vulnerable to cross-site request forgery (CSRF) via the admin/addons/uninstall/anomaly.module.blocks URI:

PyroCMS 3.7 is vulnerable to cross-site request forgery (CSRF) via the admin/pages/delete/ URI: pages will be deleted.

A vulnerability in the CLI of Cisco StarOS operating system for Cisco ASR 5000 Series Routers could allow an authenticat

A vulnerability in the CLI of Cisco StarOS operating system for Cisco ASR 5000 Series Routers could allow an authenticat

A vulnerability in the web-based management interface of Cisco Vision Dynamic Signage Director could allow an unauthenti

A vulnerability in the configuration restore feature of Cisco Nexus Data Broker software could allow an unauthenticated,

A vulnerability in the Session Initiation Protocol (SIP) of Cisco Expressway Series and Cisco TelePresence Video Communi

A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) Software could allow an au

A vulnerability in the antispam protection mechanisms of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA)

A vulnerability in the management REST API of Cisco Industrial Network Director (IND) could allow an authenticated, remo

A vulnerability in the Cisco Discovery Protocol implementation for Cisco Video Surveillance 8000 Series IP Cameras could

A vulnerability in the Cisco Discovery Protocol of Cisco Video Surveillance 8000 Series IP Cameras could allow an unauth

A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, rem

A vulnerability in the loading mechanism of specific DLLs in the Cisco Webex Teams client for Windows could allow an aut

A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticat

A vulnerability in the web-based management interface of Cisco Firepower Management Center could allow an authenticated,