2020

HashiCorp Vault and Vault Enterprise versions 1.0 and newer allowed leases created with a batch token to outlive their T

A flaw was found in Django REST Framework versions before 3.12.0 and before 3.11.2. When using the browseable API viewer

A flaw was found in dpdk in versions before 18.11.10 and before 19.11.5. A flawed bounds checking in the copy_data funct

Re:Desk 2.3 has a blind authenticated SQL injection vulnerability in the SettingsController class, in the actionEmailTem

Re:Desk 2.3 allows insecure file upload.

An integer underflow in dpdk versions before 18.11.10 and before 19.11.5 in the `move_desc` function can lead to large a

A flaw was found in dpdk in versions before 18.11.10 and before 19.11.5. A complete lack of validation of attacker-contr

A flaw was found in dpdk in versions before 18.11.10 and before 19.11.5. A lack of bounds checking when copying iv_data

A flaw was found in dpdk in versions before 18.11.10 and before 19.11.5. Virtio ring descriptors, and the data they desc

A vulnerability in the Pulse Connect Secure < 9.1R8.2 admin web interface could allow an authenticated attacker to gain

A vulnerability in the Pulse Connect Secure < 9.1R8.2 admin web interface could allow an authenticated attacker to uploa

A vulnerability in the authenticated user web interface of Pulse Connect Secure and Pulse Policy Secure < 9.1R8.2 could

BigBlueButton Greenlight before 2.5.6 allows HTTP header (Host and Origin) attacks, which can result in Account Takeover

jwt-go before 4.0.0-preview1 allows attackers to bypass intended access restrictions in situations with []string{} for m

Leanote Desktop through 2.6.2 allows XSS because a note's title is mishandled when the batch feature is triggered. This

Leanote Desktop through 2.6.2 allows XSS because a note's title is mishandled during syncing. This leads to remote code

url.cpp in libproxy through 0.4.15 is prone to a buffer overflow when PAC is enabled, as demonstrated by a large PAC fil

info.php in Logaritmo Aware CallManager 2012 allows remote attackers to obtain sensitive information via a direct reques

NATS nats.js before 2.0.0-209, nats.ws before 1.0.0-111, and nats.deno before 1.0.0-9 allow credential disclosure from a

md_push_block_bytes in md4c.c in md4c 0.4.5 allows attackers to trigger use of uninitialized memory, and cause a denial

urllib3 before 1.25.9 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserti

An issue was discovered in Hoosk CMS v1.8.0. There is a XSS vulnerability in install/index.php

An issue was discovered in Hoosk CMS v1.8.0. There is a SQL injection vulnerability in install/index.php

An issue was discovered in Hoosk CmS v1.8.0. There is an Remote Code Execution vulnerability in install/index.php

Seat Reservation System version 1.0 suffers from an Unauthenticated File Upload Vulnerability allowing Remote Attackers

An issue was discovered in SourceCodester Seat Reservation System 1.0. The file admin_class.php does not perform input v

Projectworlds Visitor Management System in PHP 1.0 allows XSS. The file myform.php does not perform input validation on

Projectworlds Visitor Management System in PHP 1.0 allows SQL Injection. The file front.php does not perform input valid

An issue was discovered in the GAEN (aka Google/Apple Exposure Notifications) protocol through 2020-09-29, as used in CO

An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.1. There is a CSRF issue (with resu

An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.1. There is a blind SQL injection i

CMS Made Simple before 2.2.15 allows XSS via the m1_mod parameter in a ModuleManager local_uninstall action to admin/mod

An issue was discovered in HFish 0.5.1. When a payload is inserted where the password is entered, XSS code is triggered

An issue was discovered in Pluck CMS 4.7.10-dev2 and 4.7.11. There is a file upload vulnerability that can cause a remot

There is an Arbitrary file deletion vulnerability in halo v1.1.3. A backup function in the background allows a user, whe

An Arbitrary file writing vulnerability in halo v1.1.3. In an interface to write files in the background, a directory tr

Halo V1.1.3 is affected by: Arbitrary File reading. In an interface that reads files in halo v1.1.3, a directory travers

There is a XML external entity (XXE) vulnerability in halo v1.1.3, The function of importing other blogs in the backgrou

A Server-Side Freemarker template injection vulnerability in halo CMS v1.1.3 In the Edit Theme File function. The ftl fi

An issue was discovered in halo V1.1.3. A Zip Slip Directory Traversal Vulnerability in the backend,the attacker can ove

An issue was discovered in FrontAccounting 2.4.7. There is a Directory Traversal vulnerability that can empty folder via

An issue was discovered in MetInfo v7.0.0 beta. There is SQL Injection via the install/index.php?action=adminsetup&cndat

Nacos 1.1.4 is affected by: Incorrect Access Control. An environment can be set up locally to get the service details in

Niushop B2B2C Multi-business basic version V1.11, can bypass the administrator to obtain the background upload interface

In Niushop B2B2C Multi-Business Basic Edition V1.11, authentication can be bypassed, causing administrators to reset any

An issue was discovered in Zoho Application Control Plus before version 10.0.511. The Element Configuration feature (to

An SSRF issue was discovered in Zoho Application Control Plus before version 10.0.511. The mail gateway configuration fe

Re:Desk 2.3 contains a blind unauthenticated SQL injection vulnerability in the getBaseCriteria() function in the protec

An issue was discovered in Ozeki NG SMS Gateway through 4.17.6. It stores SMS messages in .NET serialized format on the

In Apache Tapestry from 5.4.0 to 5.5.0, crafting specific URLs, an attacker can download files inside the WEB-INF folder