2020

Smarter Coffee Maker before 2nd generation allows firmware replacement without authentication or authorization. User int

SoPlanning before 1.47 doesn't correctly check the security key used to publicly share plannings. It allows a bypass to

Contao before 4.4.52, 4.9.x before 4.9.6, and 4.10.x before 4.10.1 have Improper Input Validation. It is possible to inj

In GLPI before version 9.5.2, there is a SQL Injection in the API's search function. Not only is it possible to break th

Unquoted service path vulnerability in McAfee File and Removable Media Protection (FRP) prior to 5.3.0 allows local user

In kdeconnect-kde (aka KDE Connect) before 20.08.2, an attacker on the local network could send crafted packets that tri

In GLPI before version 9.5.2, there is a leakage of user information through the public FAQ. The issue was introduced in

In GLPI before version 9.5.2, the `install/install.php` endpoint insecurely stores user input into the database as `url_

In GLPI before version 9.5.2, when supplying a back tick in input that gets put into a SQL query,the application does no

In GLPI before version 9.5.2, the `​pluginimage.send.php​` endpoint allows a user to specify an image from a plugin. The

Sympa through 6.2.57b.2 allows a local privilege escalation from the sympa user account to full root access by modifying

The wp-courses plugin through 2.0.27 for WordPress allows remote attackers to bypass the intended payment step (for cour

ImpressCMS 1.4.0 is affected by XSS in modules/system/admin.php which may result in arbitrary remote code execution.

Cure53 DOMPurify before 2.0.17 allows mutation XSS. This occurs because a serialize-parse roundtrip does not necessarily

The Dynamic OOO widget for the Elementor Pro plugin through 3.0.5 for WordPress allows remote authenticated users to exe

Peplink Balance before 8.1.0rc1 allows an unauthenticated attacker to download PHP configuration files (/filemanager/php

An issue has been discovered in GitLab affecting versions prior to 13.2.10, 13.3.7 and 13.4.2: Lack of Rate Limiting at

Zabbix Server 2.2.x and 3.0.x before 3.0.31, and 3.2 allows remote attackers to execute arbitrary code.

An integer underflow in the SMB server of MikroTik RouterOS before 6.45.5 allows remote unauthenticated attackers to cra

An issue was discovered in the GAEN (aka Google/Apple Exposure Notifications) protocol through 2020-10-05, as used in CO

Multiple buffer overflow vulnerabilities were found in the QUIC image decoding process of the SPICE remote display syste

Cross-site scripting (XSS) vulnerabilities in Symphony CMS 3.0.0 allow remote attackers to inject arbitrary web script o

A command injection vulnerability was discovered in Gitlab runner versions prior to 13.2.4, 13.3.2 and 13.4.1. When the

Membership changes are not reflected in ToDo subscriptions in GitLab versions prior to 13.2.10, 13.3.7 and 13.4.2, allow

Improper group membership validation when deleting a user account in GitLab >=7.12 allows a user to delete own account w

In GitLab versions prior to 13.2.10, 13.3.7 and 13.4.2, improper authorization checks allow a non-member of a project/gr

MonoCMS Blog 1.0 is affected by: Arbitrary File Deletion. Any authenticated user can delete files on and off the webserv

This affects the package simpl-schema before 1.10.2.

Affected versions of Jira Server & Data Center allow a remote attacker with limited (non-admin) privileges to view a Jir

An issue was discovered in TimaService on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) software. PendingInten

An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), Q(10.0), and R(11.0) software. An attacker can ac

An issue was discovered on Samsung mobile devices with Q(10.0) and R(11.0) (Exynos chipsets) software. They allow attack

An issue was discovered in SystemUI on Samsung mobile devices with O(8.x), P(9.0), Q(10.0), and R(11.0) software. Pendin

An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) software. Sticker Center allows direc

An issue was discovered in EthernetNetwork on Samsung mobile devices with O(8.1), P(9.0), Q(10.0), and R(11.0) software.

An issue was discovered in DirEncryptService on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) software. Pendin

An issue was discovered on Samsung mobile devices with Q(10.0) software. Auto Hotspot allows attackers to obtain sensiti

An issue was discovered on Samsung mobile devices with Q(10.0) software. The DynamicLockscreen Terms and Conditions can

An issue was discovered on LG mobile devices with Android OS 8.0, 8.1, and 9.0 software. The Network Management componen

An issue was discovered on LG mobile devices with Android OS 9.0 and 10 software. The Wi-Fi subsystem has incorrect inpu

Zoho ManageEngine Applications Manager version 14740 and prior allows an authenticated SQL Injection via a crafted jsp r

Zoho ManageEngine Applications Manager version 14740 and prior allows an authenticated SQL Injection via a crafted jsp r

In xmpp-http-upload before version 0.4.0, when the GET method is attacked, attackers can read files which have a `.data`

An issue has been discovered in GitLab affecting all versions starting from 10.8. Reflected XSS on Multiple Routes

An issue has been discovered in GitLab affecting all versions starting from 11.2. Unauthorized Users Can View Custom Pro

A potential DOS vulnerability was discovered in GitLab versions 13.1, 13.2 and 13.3. The api to update an asset as a lin

This affects all versions of package node-pdf-generator. Due to lack of user input validation and sanitization done to t

The socket.io-file package through 2.0.31 for Node.js relies on client-side validation of file types, which allows remot

A stack overflow in WhatsApp for Android prior to v2.20.196.16, WhatsApp Business for Android prior to v2.20.196.12, Wha

A buffer overflow in WhatsApp for Android prior to v2.20.130 and WhatsApp Business for Android prior to v2.20.46 could h