2020

An improper authorization in the receiver component of the Android Suite Daemon.Product: AndroidVersions: Android SoCAnd

An improper authorization while processing the provisioning data.Product: AndroidVersions: Android SoCAndroid ID: A-1498

Veritas APTARE versions prior to 10.4 did not perform adequate authorization checks. An authenticated user could gain un

Spring Security versions 5.3.x prior to 5.3.2, 5.2.x prior to 5.2.4, 5.1.x prior to 5.1.10, 5.0.x prior to 5.0.16 and 4.

An issue was discovered in Progress MOVEit Automation Web Admin. A Web Admin application endpoint failed to adequately s

A vulnerability in Apache Flink (1.1.0 to 1.1.5, 1.2.0 to 1.2.1, 1.3.0 to 1.3.3, 1.4.0 to 1.4.2, 1.5.0 to 1.5.6, 1.6.0 t

In Apache ActiveMQ 5.0.0 to 5.15.11, the webconsole admin GUI is open to XSS, in the view that lists the contents of a q

In Apache RocketMQ 4.2.0 to 4.6.0, when the automatic topic creation in the broker is turned on by default, an evil topi

An issue was discovered in all versions of Bond JetSelect. Within the JetSelect Application, the web interface hides RAD

The administrative passwords for all versions of Bond JetSelect are stored within an unprotected file on the filesystem,

IBM WebSphere Application Server 8.5 is vulnerable to server-side request forgery. By sending a specially crafted reques

IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 6.0.3.1 could expose sensitive information to a user throug

IBM Sterling File Gateway 2.2.0.0 through 6.0.3.1 could allow an authenticated user could manipulate cookie information

Apache Ant 1.1 to 1.9.14 and 1.10.0 to 1.10.7 uses the default temporary directory identified by the Java system propert

Default installations of Zoho ManageEngine ServiceDesk Plus 10.0 before 10500 are vulnerable to XSS injected by a workst

The COVIDSafe (Australia) app 1.0 and 1.1 for iOS allows a remote attacker to crash the app, and consequently interfere

Cross-site scripting vulnerability in Movable Type series (Movable Type 7 r.4606 (7.2.1) and earlier (Movable Type 7), M

HTML attribute value injection vulnerability in Movable Type series (Movable Type 7 r.4606 (7.2.1) and earlier (Movable

Pivotal Concourse, most versions prior to 6.0.0, allows redirects to untrusted websites in its login flow. A remote unau

In TYPO3 CMS greater than or equal to 9.5.12 and less than 9.5.17, and greater than or equal to 10.2.0 and less than 10.

In TYPO3 CMS greater than or equal to 9.0.0 and less than 9.5.17 and greater than or equal to 10.0.0 and less than 10.4.

Under certain circumstances a user's password may be logged in cleartext in the PanGPS.log diagnostic file when logs are

An external control of filename vulnerability in the command processing of PAN-OS allows an authenticated administrator

An improper authorization vulnerability in PAN-OS that mistakenly uses the permissions of local linux users instead of t

An open redirection vulnerability in the GlobalProtect component of Palo Alto Networks PAN-OS allows an attacker to spec

A missing authorization vulnerability in the management server component of PAN-OS Panorama allows a remote unauthentica

A NULL pointer dereference vulnerability in Palo Alto Networks PAN-OS allows an authenticated administrator to send a re

A predictable temporary file vulnerability in PAN-OS allows a local authenticated user with shell access to corrupt arbi

The SVG Sanitizer extension for TYPO3 has a cross-site scripting vulnerability in versions before 1.0.3. Slightly invali

An issue was discovered in FRRouting FRR (aka Free Range Routing) through 7.3.1. When using the split-config feature, th

In affected Ops Manager versions there is an exposed http route was that may allow attackers to view a specific access l

Attackers can obtain Cloud Key information from the Dahua Web P2P control in specific ways. Cloud Key is used to authent

In FreeBSD 12.1-STABLE before r360973, 12.1-RELEASE before p5, 11.4-STABLE before r360973, 11.4-BETA1 before p1 and 11.3

Symantec IT Analytics, prior to 2.9.1, may be susceptible to a cross-site scripting (XSS) exploit, which is a type of is

A Improper Neutralization of Input During Web Page Generation vulnerability in open-build-service allows remote attacker

IBM Sterling B2B Integrator Standard Edition 5.2.0.0 trough 6.0.3.1 could allow an authenticated user to obtain sensitiv

The iubenda-cookie-law-solution plugin before 2.3.5 for WordPress does not restrict URL sanitization to http protocols.

The direct_mail extension through 5.2.3 for TYPO3 allows Information Disclosure via a newsletter subscriber data Special

The direct_mail extension through 5.2.3 for TYPO3 has an Open Redirect via jumpUrl.

The direct_mail extension through 5.2.3 for TYPO3 has Broken Access Control for newsletter subscriber tables.

The direct_mail extension through 5.2.3 for TYPO3 allows Denial of Service via log entries.

In GLPI after 0.68.1 and before 9.4.6, multiple reflexive XSS occur in Dropdown endpoints due to an invalid Content-Type

A signal access-control issue was discovered in the Linux kernel before 5.6.5, aka CID-7395ea4e65c2. Because exec_id in

Under certain conditions SAP Adaptive Server Enterprise, versions 15.7, 16.0, allows an attacker to access information w

SAP Identity Management, version 8.0, does not perform necessary authorization checks for an authenticated user, allowin

SAP Business Objects Business Intelligence Platform (CMC and BI Launchpad) 4.2 does not sufficiently encode user-control

SAP Master Data Governance, versions - 748, 749, 750, 751, 752, 800, 801, 802, 803, 804, allows users to display change

SAP Enterprise Threat Detection, versions 1.0, 2.0, does not sufficiently encode error response pages in case of errors,

Under certain conditions or error scenarios SAP Business Objects Business Intelligence Platform, version 4.2, allows an

SAP Adaptive Server Enterprise, version 16.0, allows an authenticated attacker to exploit certain misconfigured endpoint