2020

An issue was discovered in ReadyTalk Avian 1.2.0 before 2020-10-27. The FileOutputStream.write() method in FileOutputStr

The LDAP authentication method in LdapLoginModule in Hazelcast IMDG Enterprise 4.x before 4.0.3, and Jet Enterprise 4.x

The execute function in in the Atlassian gajira-comment GitHub Action before version 2.0.2 allows remote attackers to ex

The preprocessArgs function in the Atlassian gajira-create GitHub Action before version 2.0.1 allows remote attackers to

An issue was discovered in the MongoDB Simple LDAP plugin through 2020-10-02 for Percona Server when using the SimpleLDA

An unrestricted file upload vulnerability was discovered in the Microweber 1.1.18 admin account page. An attacker can up

Magento versions 2.4.0 and 2.3.5p1 (and earlier) are affected by an unsafe file upload vulnerability that could result i

tdpServer on TP-Link Archer A7 AC1750 devices before 201029 allows remote attackers to execute arbitrary code via the sl

An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), Q(10.0), and R(11.0) software. Attackers can bypa

A vulnerability in the enhanced Preboot eXecution Environment (PXE) boot loader for Cisco IOS XR 64-bit Software could a

In Alerta before version 8.1.0, users may be able to bypass LDAP authentication if they provide an empty password when A

A relative path traversal attack in the B. Braun OnlineSuite Version AP 3.0 and earlier allows unauthenticated attackers

The JWT library in NATS nats-server before 2.1.9 has Incorrect Access Control because of how expired credentials are han

In SaltStack Salt through 3002, salt-netapi improperly validates eauth credentials and tokens. A user can bypass authent

An issue was discovered in SaltStack Salt through 3002. Sending crafted web requests to the Salt API, with the SSH clien

Cellinx NVT Web Server 5.0.0.014b.test 2019-09-05 allows a remote user to run commands as root via SetFileContent.cgi be

Improper neutralization of argument delimiters in a command ('Argument Injection') vulnerability in TCP/IP function incl

Improper access control vulnerability in TCP/IP function included in the firmware of GT14 Model of GOT 1000 series (GT14

Buffer overflow vulnerability in TCP/IP function included in the firmware of GT14 Model of GOT 1000 series (GT1455-QTBDE

Ubuntu's packaging of libvirt in 20.04 LTS created a control socket with world read and write permissions. An attacker c

Apache Shiro before 1.7.0, when using Apache Shiro with Spring, a specially crafted HTTP request may cause an authentica

Git LFS 2.12.0 allows Remote Code Execution.

Immuta v2.8.2 is affected by stored XSS that allows a low-privileged user to escalate privileges to administrative permi

A remote unauthenticated arbitrary code execution vulnerability was discovered in Aruba Airwave Software version(s): Pri

The Relish (Verve Connect) VH510 device with firmware before 1.0.1.6L0516 contains undocumented default admin credential

JomSocial (Joomla Social Network Extention) 4.7.6 allows CSV injection via a customer's profile.

In FUEL CMS 11.4.12 and before, the page preview feature allows an anonymous user to take complete ownership of any acco

WeForms Wordpress Plugin 1.4.7 allows CSV injection via a form's entry.

Jenkins Active Directory Plugin 2.19 and earlier allows attackers to log in as any user with any password while a succes

Jenkins Active Directory Plugin 2.19 and earlier does not prohibit the use of an empty password in Windows/ADSI mode, wh

Jenkins Active Directory Plugin 2.19 and earlier allows attackers to log in as any user if a magic constant is used as t

A use-after-free in a logging library in WhatsApp for iOS prior to v2.20.111 and WhatsApp Business for iOS prior to v2.2

Heap buffer overflow in UI in Google Chrome on Windows prior to 86.0.4240.183 allowed a remote attacker who had compromi

Heap buffer overflow in UI in Google Chrome on Android prior to 86.0.4240.185 allowed a remote attacker who had compromi

Heap buffer overflow in Freetype in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploi

Use after free in printing in Google Chrome prior to 86.0.4240.99 allowed a remote attacker to potentially exploit heap

Improper access control vulnerability in TCP/IP function included in the firmware of MELSEC iQ-R series (RJ71EIP91 Ether

Buffer overflow vulnerability in TCP/IP function included in the firmware of MELSEC iQ-R series (RJ71EIP91 EtherNet/IP N

is_protected_meta in wp-includes/meta.php in WordPress before 5.5.2 allows arbitrary file deletion because it does not p

is_blog_installed in wp-includes/functions.php in WordPress before 5.5.2 improperly determines whether WordPress is alre

wp-includes/class-wp-xmlrpc-server.php in WordPress before 5.5.2 allows attackers to gain privileges by using XML-RPC to

WordPress before 5.5.2 allows attackers to gain privileges via XML-RPC.

WordPress before 5.5.2 mishandles deserialization requests in wp-includes/Requests/Utility/FilteredIterator.php.

SSRF exists in osTicket before 1.14.3, where an attacker can add malicious file to server or perform port scanning.

A command injection vulnerability exists in Moxa Inc VPort 461 Series Firmware Version 3.4 or lower that could allow a r

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions

In JUUKO K-808, an attacker could specially craft a packet that encodes an arbitrary command, which could be executed on

JUUKO K-800 (Firmware versions prior to numbers ending ...9A, ...9B, ...9C, etc.) is vulnerable to a replay attack and c

If exploited, this command injection vulnerability could allow remote attackers to execute arbitrary commands. This issu

u'Buffer over-read issue in Bluetooth peripheral firmware due to lack of check for invalid opcode and length of opcode r