2020

VMware Fusion (11.x before 11.5.5), VMware Remote Console for Mac (11.x and prior) and VMware Horizon Client for Mac (5.

There is a denial of service vulnerability in some Huawei products. Due to improper memory management, memory leakage ma

E6878-370 products with versions of 10.0.3.1(H557SP27C233) and 10.0.3.1(H563SP1C00) have a stack buffer overflow vulnera

Pi-hole Web v4.3.2 (aka AdminLTE) allows Remote Code Execution by privileged dashboard users via a crafted DHCP static l

In FreeRDP less than or equal to 2.0.0, when using a manipulated server with USB redirection enabled (nearly) arbitrary

In Windows Master (aka Windows Optimization Master) 7.99.13.604, the driver file (WoptiHWDetect.SYS) allows local users

The mappress-google-maps-for-wordpress plugin before 2.54.6 for WordPress does not correctly implement capability checks

IBM MQ on HPE NonStop 8.0.4 and 8.1.0 is vulnerable to a privilege escalation attack when running in restricted mode. IB

Initialization of the pcoip_credential_provider in Teradici PCoIP Standard Agent for Windows and PCoIP Graphics Agent fo

Dell Dock Firmware Update Utilities for Dell Client Consumer and Commercial docking stations contain an Arbitrary File O

node-dns-sync (npm module dns-sync) through 0.2.0 allows execution of arbitrary commands . This issue may lead to remote

IBM Security Identity Governance and Intelligence 5.2.6 is vulnerable to an XML External Entity Injection (XXE) attack w

IBM Security Identity Governance and Intelligence 5.2.6 does not require that users should have strong passwords by defa

IBM Security Identity Governance and Intelligence 5.2.6 could allow an attacker to enumerate usernames to find valid log

parser/js/js-scanner.c in JerryScript 2.2.0 mishandles errors during certain out-of-memory conditions, as demonstrated b

Ezhttptrans.ocx ActiveX Control in Kaoni ezHTTPTrans 1.0.0.70 and prior versions contain a vulnerability that could allo

VIVOTEK Network Cameras before XXXXX-VVTK-2.2002.xx.01x (and before XXXXX-VVTK-0XXXX_Beta2) allows an authenticated user

An issue was discovered in the SiteOrigin Page Builder plugin before 2.10.16 for WordPress. The live editor feature did

An issue was discovered in the SiteOrigin Page Builder plugin before 2.10.16 for WordPress. The action_builder_content f

An issue was discovered in the Real-Time Find and Replace plugin before 4.0.2 for WordPress. The far_options_page functi

A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 may allow remote attackers to execute arbitr

A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 may allow remote attackers to disclose sensi

In Anchore Engine version 0.7.0, a specially crafted container image manifest, fetched from a registry, can be used to t

Sympa before 6.2.56 allows privilege escalation.

ext/fts3/fts3.c in SQLite before 3.32.0 has a use-after-free in fts3EvalNextRow, related to the snippet feature.

IBM Spectrum Scale 5.0.0.0 through 5.0.4.4 uses weaker than expected cryptographic algorithms that could allow an attack

IBM Spectrum Scale 5.0.0.0 through 5.0.4.4 uses weaker than expected cryptographic algorithms that could allow an attack

IBM Spectrum Scale 5.0.0.0 through 5.0.4.4 uses weaker than expected cryptographic algorithms that could allow an attack

IBM MobileFirst Platform Foundation 8.0.0.0 stores highly sensitive information in URL parameters. This may lead to info

In SmartDraw 2020 27.0.0.0, the installer gives inherited write permissions to the Authenticated Users group on the Smar

JerryScript 2.2.0 allows attackers to cause a denial of service (stack consumption) via a proxy operation.

JerryScript 2.2.0 allows attackers to cause a denial of service (assertion failure) because a property key query for a P

A vulnerability in all versions of Kantech EntraPass Editions could potentially allow an authorized low-privileged user

For native-to-JS bridging, the app requires a unique token to be passed that ensures non-app code can't call the bridgin

Documents formed using data: URLs in an OBJECT element failed to inherit the CSP of the creating context. This allowed t

A race condition when running shutdown code for Web Worker led to a use-after-free vulnerability. This resulted in a pot

The 'Copy as cURL' feature of Devtools' network tab did not properly escape the HTTP method of a request, which can be c

We have recently released new version of AirMax AirOS firmware v6.3.0 for TI, XW and XM boards that fixes vulnerabilitie

qmail-verify as used in netqmail 1.06 is prone to a mail-address verification bypass vulnerability.

EM-HTTP-Request 1.1.5 uses the library eventmachine in an insecure way that allows an attacker to perform a man-in-the-m

An issue was discovered in the Image Resizer plugin before 2.0.9 for Craft CMS. There are CSRF issues with the log-clear

TrackR devices through 2020-05-06 allow attackers to trigger the Beep (aka alarm) feature, which will eventually cause a

An issue was discovered in Aviatrix Controller through 5.1. An attacker with any signed SAML assertion from the Identity

An issue was discovered in Aviatrix Controller before 5.4.1204. It contains credentials unused by the software.

An issue was discovered in Aviatrix Controller before 5.4.1204. An API call on the web interface lacked a session token

An issue was discovered in FreeRDP before 2.1.1. An out-of-bounds (OOB) write vulnerability has been detected in crypto_

An issue was discovered in FreeRDP before 2.1.1. An out-of-bounds (OOB) read vulnerability has been detected in ntlm_rea

In Puma (RubyGem) before 4.3.4 and 3.12.5, an attacker could smuggle an HTTP response, by using an invalid transfer-enco

Ezhttptrans.ocx ActiveX Control in Kaoni ezHTTPTrans 1.0.0.70 and prior versions contain a vulnerability that could allo

Apache Kylin 2.3.0, and releases up to 2.6.5 and 3.0.1 has some restful apis which will concatenate os command with the