2020

Zoho ManageEngine Service Plus before 11.1 build 11112 allows low-privilege authenticated users to discover the File Pro

app/View/Events/resolved_attributes.ctp in MISP before 2.4.126 has XSS in the resolved attributes view.

Dolibarr before 11.0.4 allows XSS.

Studio in Open edX Ironwood 2.5 allows users to upload SVG files via the "Content>File Uploads" screen. These files can

gadget_dev_desc_UDC_store in drivers/usb/gadget/configfs.c in the Linux kernel 3.16 through 5.6.13 relies on kstrdup wit

Gollem before 3.0.13, as used in Horde Groupware Webmail Edition 5.2.22 and other products, is affected by a reflected C

An exploitable information disclosure vulnerability exists in the way Nitro Pro 13.9.1.155 does XML error handling. A sp

D-Link DSP-W215 1.26b03 devices allow information disclosure by intercepting messages on the local network, as demonstra

A Reflected XSS was found in the server selection box inside the login page at: enginemanager/loginfailed.html in Wowza

An issue was discovered on NETGEAR Orbi Tri-Band Business WiFi Add-on Satellite (SRS60) AC3000 V2.5.1.106, Outdoor Satel

An issue was discovered in atillk64.sys in AMD ATI Diagnostics Hardware Abstraction Sys/Overclocking Utility 5.11.9.0. T

The image view functionality in Horde Groupware Webmail Edition before 5.2.22 is affected by a stored Cross-Site Scripti

If LibreOffice has an encrypted document open and crashes, that document is auto-saved encrypted. On restart, LibreOffic

rConfig 3.9.4 is vulnerable to reflected XSS. The devicemgmnt.php file improperly validates user input. An attacker can

In Dovecot before 2.3.10.1, remote unauthenticated attackers can crash the lmtp or submission process by sending mail wi

Cross Site scripting vulnerability on Micro Focus Enterprise Server and Enterprise developer, affecting all versions pri

In Dovecot before 2.3.10.1, a crafted SMTP/LMTP message triggers an unauthenticated use-after-free bug in submission-log

rConfig 3.9.4 is vulnerable to reflected XSS. The configDevice.php file improperly validates user input. An attacker can

COVIDSafe through v1.0.17 allows a remote attacker to access phone name and model information because a BLE device can h

Unnecessary fields in the OpenTrace/BlueTrace protocol in COVIDSafe through v1.0.17 allow a remote attacker to identify

An issue was discovered in the Readdle Documents app before 6.9.7 for iOS. The application's file-transfer web server im

An issue was discovered in the Readdle Documents app before 6.9.7 for iOS. The application's file-transfer web server al

An issue was discovered in the "Ultimate Addons for Elementor" plugin before 1.24.2 for WordPress, as exploited in the w

Submitty through 20.04.01 has an open redirect via authentication/login?old= during an invalid login attempt.

A flaw was found in Keycloak in versions before 10.0.0, where it does not perform the TLS hostname verification while se

iSpyConnect.com Agent DVR before 2.7.1.0 allows directory traversal.

yaws_config.erl in Yaws through 2.0.2 and/or 2.0.7 loads obsolete TLS ciphers, as demonstrated by ones that allow Sweet3

The VFIO PCI driver in the Linux kernel through 5.6.13 mishandles attempts to access disabled memory space.

An XSS issue was identified on the Subrion CMS 4.2.1 /panel/configuration/general settings page. A remote attacker can i

XSS in the admin help system admin/help.html and admin/quicklinks.html in Interchange 4.7.0 through 5.11.x allows remote

libfreerdp/codec/interleaved.c in FreeRDP versions > 1.0 through 2.0.0-rc4 has an Out-of-bounds Write.

libfreerdp/gdi/region.c in FreeRDP versions > 1.0 through 2.0.0-rc4 has an Integer Overflow.

libfreerdp/gdi/gdi.c in FreeRDP > 1.0 through 2.0.0-rc4 has an Out-of-bounds Read.

libfreerdp/codec/planar.c in FreeRDP version > 1.0 through 2.0.0-rc4 has an Out-of-bounds Write.

ALSong 3.46 and earlier version contain a Document Object Model (DOM) based cross-site scripting vulnerability caused by

Missing input validation in the ar/tar implementations of APT before version 2.1.2 could result in denial of service whe

An incomplete fix was found for the fix of the flaw CVE-2020-1733 ansible: insecure temporary directory when running bec

Submitty through 20.04.01 allows XSS via upload of an SVG document, as demonstrated by an attack by a Student against a

An issue was discovered in CODESYS Development System before 3.5.16.0. CODESYS WebVisu and CODESYS Remote TargetVisu are

Opto 22 SoftPAC Project Version 9.6 and prior. SoftPAC’s firmware files’ signatures are not verified upon firmware updat

Opto 22 SoftPAC Project Version 9.6 and prior. Paths specified within the zip files used to update the SoftPAC firmware

In crus_afe_callback of msm-cirrus-playback.c, there is a possible out of bounds write due to a missing bounds check. Th

In getCellLocation of PhoneInterfaceManager.java, there is a possible permission bypass due to a missing SDK version che

In onShowingStateChanged of KeyguardStateMonitor.java, there is a possible inappropriate read due to a logic error. This

In BnCrypto::onTransact of ICrypto.cpp, there is a possible information disclosure due to uninitialized data. This could

In onTransact of IHDCP.cpp, there is a possible out of bounds read due to incorrect error handling. This could lead to l

In exif_data_save_data_entry of exif-data.c, there is a possible out of bounds read due to a missing bounds check. This

In setHideSensitive of NotificationStackScrollLayout.java, there is a possible disclosure of sensitive notification cont

In mnld, an incorrect configuration in driver_cfg of mnld for meta factory mode.Product: AndroidVersions: Android SoCAnd

An improper authorization in the receiver component of Email.Product: AndroidVersions: Android SoCAndroid ID: A-14981304