2020

Jenkins Play Framework Plugin 1.0.2 and earlier lets users specify the path to the `play` command on the Jenkins master

Jenkins Selenium Plugin 3.141.59 and earlier has no CSRF protection for its HTTP endpoints, allowing attackers to perfor

common.php in the Gravity Forms plugin before 2.4.9 for WordPress can leak hashed passwords because user_pass is not con

An issue was discovered in fastecdsa before 2.1.2. When using the NIST P-256 curve in the ECDSA implementation, the poin

In Joomla! before 3.9.19, the default settings of the global textfilter configuration do not block HTML inputs for Guest

In Joomla! before 3.9.19, missing token checks in com_postinstall lead to CSRF.

websocket-extensions ruby module prior to 0.1.5 allows Denial of Service (DoS) via Regex Backtracking. The extension par

websocket-extensions npm module prior to 0.1.4 allows Denial of Service (DoS) via Regex Backtracking. The extension pars

rust-vmm vm-memory before 0.1.1 and 0.2.x before 0.2.1 allows attackers to cause a denial of service (loss of IP network

Spring Cloud Config, versions 2.2.x prior to 2.2.3, versions 2.1.x prior to 2.1.9, and older unsupported versions allow

A race condition can occur when using the fastrpc memory mapping API. in Snapdragon Auto, Snapdragon Compute, Snapdragon

Firmware will hit assert in WLAN firmware If encrypted data length in FILS IE of reassoc response is more than 528 bytes

Possibility of out of bound access while processing the responses from video firmware in Snapdragon Auto, Snapdragon Com

When making query to DSP capabilities, Stack out of bounds occurs due to wrong buffer length configured for DSP attribut

kernel failure due to load failures while running v1 path directly via kernel in Snapdragon Mobile in SM8250, SXR2130

NULL exception due to accessing bad pointer while posting events on RT FIFO in Snapdragon Compute, Snapdragon Mobile, Sn

Buffer overflow in display function due to memory copy without checking length of size using strcpy function in Snapdrag

Possibility of double free of the drawobj that is added to the drawqueue array of the context during IOCTL commands as t

Ene.sys in Asus Aura Sync through 1.07.71 does not properly validate input to IOCTL 0x80102044, 0x80102050, and 0x801020

Failure in buffer management while accessing handle for HDR blit when color modes not supported by display in Snapdragon

Out of bound memory access while processing qpay due to not validating length of the response buffer provided by User. i

Out of bound memory access while processing ese transmit command due to passing Response buffer received from user in Sn

Integer overflow in calculating estimated output buffer size when getting a list of installed Feature IDs, Serial Number

Improper permissions in XBL_SEC region enable user to update XBL_SEC code and data and divert the RAM dump path to norma

When attempting to create a new XFRM policy, a stack out-of-bounds read will occur if the user provides a template where

Out of bound read in Fingerprint application due to requested data is being used without length check in Snapdragon Auto

Out of bound read in in fingerprint application due to requested data assigned to a local buffer without length check in

Out of bound read in adm call back function due to incorrect boundary check for payload in command response in Snapdrago

Buffer over-read in ADSP parse function due to lack of check for availability of sufficient data payload received in com

IBM Planning Analytics Local 2.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decr

An issue was discovered in Sysax Multi Server 6.90. A session can be hijacked if one observes the sid value in any /scgi

Istio 1.4.x before 1.4.9 and Istio 1.5.x before 1.5.4 contain the following vulnerability when telemetry v2 is enabled:

Python-RSA before 4.1 ignores leading '\0' bytes during decryption of ciphertext. This could conceivably have a security

In QuickBox Community Edition through 2.5.5 and Pro Edition through 2.1.8, the local www-data user has sudo privileges t

system/classes/DbPDO.php in Cmfive through 2015-03-15, when database connectivity malfunctions, allows remote attackers

Lexiglot through 2014-11-20 allows SSRF via the admin.php?page=projects svn_url parameter.

Lexiglot through 2014-11-20 allows CSRF.

Lexiglot through 2014-11-20 allows local users to obtain sensitive information by listing a process because the username

Lexiglot through 2014-11-20 allows denial of service because api/update.php launches svn update operations that use a gr

In QuickBox Community Edition through 2.5.5 and Pro Edition through 2.1.8, the local www-data user can execute sudo mysq

QuickBox Community Edition through 2.5.5 and Pro Edition through 2.1.8 allows an authenticated remote attacker to execut

The scp client in OpenSSH 8.2 incorrectly sends duplicate responses to the server upon a utimes system call failure, whi

serialize-javascript prior to 3.1.0 allows remote attackers to inject arbitrary code via the function "deleteFunctions"

reel through 0.6.1 allows Request Smuggling attacks due to incorrect Content-Length and Transfer encoding header parsing

The file downloading functionality in the Atlassian Companion App before version 1.0.0 allows remote attackers, who cont

The file editing functionality in the Atlassian Companion App before version 1.0.0 allows local attackers to have the ap

The setup resources in Atlassian Fisheye and Crucible before version 4.8.1 allows remote attackers to complete the setup

Insecure storage of sensitive information in ABB Device Library Wizard versions 6.0.X, 6.0.3.1 and 6.0.3.2 allows unauth

All versions of snyk-broker before 4.73.1 are vulnerable to Information Exposure. It logs private keys if logging level

A Denial of Service vulnerability in MuleSoft Mule CE/EE 3.8.x, 3.9.x, and 4.x released before April 7, 2020, could allo