2020

The Elementor Page Builder plugin before 2.9.9 for WordPress suffers from multiple stored XSS vulnerabilities. An author

The Elementor Page Builder plugin before 2.9.9 for WordPress suffers from a stored XSS vulnerability. An author user can

In Combodo iTop a menu shortcut name can be exploited with a stored XSS payload. This is fixed in all iTop packages (com

In Combodo iTop, dashboard ids can be exploited with a reflective XSS payload. This is fixed in all iTop packages (commu

An issue was discovered in the Comments plugin before 1.5.5 for Craft CMS. There is stored XSS via an asset volume name.

An issue was discovered in the Comments plugin before 1.5.6 for Craft CMS. There is stored XSS via a guest name.

An issue was discovered in the Comments plugin before 1.5.5 for Craft CMS. CSRF affects comment integrity.

Open-iSCSI targetcli-fb through 2.1.52 has weak permissions for /etc/target (and for the backup directory and backup fil

In the Zephyr project Bluetooth subsystem, certain duplicate and back-to-back packets can cause incorrect behavior, resu

A remote adversary with the ability to send arbitrary CoAP packets to be parsed by Zephyr is able to cause a denial of s

The Kubernetes kube-controller-manager in versions v1.0-1.14, versions prior to v1.15.12, v1.16.9, v1.17.5, and version

Huawei Smartphones HONOR 20 PRO;Honor View 20;HONOR 20 have an improper handling of exceptional condition Vulnerability.

Huawei products NIP6800;Secospace USG6600;USG9500 have a memory leak vulnerability. An attacker with high privileges exp

Pydio Cells 2.0.4 allows any user to upload a profile image to the web application, including standard and shared user r

In Pydio Cells 2.0.4, once an authenticated user shares a file selecting the create a public link option, a hidden share

An issue was discovered on LG mobile devices with Android OS software before 2020-06-01. Local users can cause a denial

Pydio Cells 2.0.4 allows XSS. A malicious user can either upload or create a new file that contains potentially maliciou

The update feature for Pydio Cells 2.0.4 allows an administrator user to set a custom update URL and the public RSA key

Castel NextGen DVR v1.0.0 is vulnerable to CSRF in all state-changing request. A __RequestVerificationToken is set by th

Castel NextGen DVR v1.0.0 is vulnerable to authorization bypass on all administrator functionality. The application fail

A flaw was found in QEMU in the implementation of the Pointer Authentication (PAuth) support for ARM introduced in versi

An issue was discovered in Foxit Reader and PhantomPDF before 9.5. It has homograph mishandling.

An issue was discovered in Foxit PhantomPDF before 8.3.10. It has homograph mishandling.

An issue was discovered in Foxit PhantomPDF before 8.3.6. It has COM object mishandling when Microsoft Word is used.

An issue was discovered in Foxit Reader and PhantomPDF before 9.2. It allows NTLM credential theft via a GoToE or GoToR

An issue was discovered in Foxit PhantomPDF before 8.3.7. It allows NTLM credential theft via a GoToE or GoToR action.

An issue was discovered in all Athom Homey and Homey Pro devices up to the current version 4.2.0. An attacker within RF

ati-vga in hw/display/ati.c in QEMU 4.2.0 allows guest OS users to trigger infinite recursion via a crafted mm_index val

hw/pci/pci.c in QEMU 4.2.0 allows guest OS users to trigger an out-of-bounds access by providing an address near the end

rom_copy() in hw/core/loader.c in QEMU 4.0 and 4.1.0 does not validate the relationship between two addresses, which all

Cybele Thinfinity VirtualUI 2.5.17.2 allows HTTP response splitting via the mimetype parameter within a PDF viewer reque

Cybele Thinfinity VirtualUI 2.5.17.2 allows ../ path traversal that can be used for data exfiltration. This enables file

phpList before 3.5.4 allows XSS via /lists/admin/user.php and /lists/admin/users.php.

IBM Security Guardium 11.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt hi

IBM Security Guardium 11.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary Jav

An improper neutralization of input vulnerability in the Admin Profile of FortiAnalyzer may allow a remote authenticated

Use of a hard-coded cryptographic key to encrypt security sensitive data in local storage and configuration in FortiClie

A sensitive information disclosure vulnerability was discovered in the web interface component of IP Office that may pot

The October CMS debugbar plugin before version 3.1.0 contains a feature where it will log all requests (and all informat

Insufficient policy enforcement in notifications in Google Chrome prior to 74.0.3729.108 allowed a remote attacker to by

Inappropriate implementation in accessibility in Google Chrome prior to 74.0.3729.108 allowed a remote attacker to obtai

Incorrect implementation in permissions in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to spoof securi

Insufficient policy enforcement in CSP in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to bypass conten

Inappropriate implementation in interstitials in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to spoof

Inappropriate implementation in AppCache in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to bypass AppC

Incorrect implementation in user interface in Google Chrome on iOS prior to 83.0.4103.88 allowed a remote attacker to pe

Insufficient policy enforcement in Omnibox in Google Chrome on iOS prior to 83.0.4103.88 allowed a remote attacker to pe

Insufficient policy enforcement in developer tools in Google Chrome prior to 83.0.4103.97 allowed an attacker who convin

Incorrect security UI in payments in Google Chrome on Android prior to 83.0.4103.97 allowed a remote attacker to spoof t

In Weave Net before version 2.6.3, an attacker able to run a process as root in a container is able to respond to DNS re