2020

An OS command injection and external control of filename vulnerability in Palo Alto Networks PAN-OS allows authenticated

An OS command injection vulnerability in the management server component of PAN-OS allows an authenticated user to poten

A stack-based buffer overflow vulnerability in the management server component of PAN-OS that allows an authenticated us

A cross-site scripting (XSS) vulnerability exists when visiting malicious websites with the Palo Alto Networks GlobalPro

An authentication bypass by spoofing vulnerability exists in the authentication daemon and User-ID components of Palo Al

An external control of path and data vulnerability in the Palo Alto Networks PAN-OS Panorama XSLT processing logic that

A flaw was found in Keycloak before version 11.0.0, where the code base contains usages of ObjectInputStream without typ

In Autoswitch Python Virtualenv before version 0.16.0, a user who enters a directory with a malicious `.venv` file could

Spring Security versions 5.2.x prior to 5.2.4 and 5.3.x prior to 5.3.2 contain a signature wrapping vulnerability during

Dahua devices with Build time before December 2019 use strong security login mode by default, but in order to be compati

In FreeBSD 12.1-STABLE before r356908, 12.1-RELEASE before p5, 11.3-STABLE before r356908, and 11.3-RELEASE before p9, a

In FreeBSD 12.1-STABLE before r352509, 11.3-STABLE before r352509, and 11.3-RELEASE before p9, an unprivileged local use

The Western Digital WD Discovery application before 3.8.229 for MyCloud Home on Windows and macOS is vulnerable to CSRF,

TylerTech Eagle 2018.3.11 deserializes untrusted user input, resulting in remote code execution via a crafted Java objec

A vulnerability in the PDF archive parsing module in Clam AntiVirus (ClamAV) Software versions 0.101 - 0.102.2 could all

A vulnerability in the ARJ archive parsing module in Clam AntiVirus (ClamAV) Software versions 0.102.2 could allow an un

A flaw was found in the reset credential flow in all Keycloak versions before 8.0.0. This flaw allows an attacker to gai

An issue was discovered in Ignite Realtime Spark 2.8.3 (and the ROAR plugin for it) on Windows. A chat message can inclu

In GLPI before 9.4.6, an attacker can execute system commands by abusing the backup functionality. Theoretically, this v

Service Data Download in SAP Application Server ABAP (ST-PI, before versions 2008_1_46C, 2008_1_620, 2008_1_640, 2008_1_

Under certain conditions, SAP Adaptive Server Enterprise (Web Services), versions 15.7, 16.0, allows an authenticated us

Under certain conditions SAP Adaptive Server Enterprise (Cockpit), version 16.0, allows an attacker with access to local

The use of an admin backend report within SAP Master Data Governance, versions - S4CORE 101, S4FND 102, 103, 104, SAP_BS

SAP Adaptive Server Enterprise (Backup Server), version 16.0, does not perform the necessary validation checks for an au

SAP Business Objects Business Intelligence Platform, version 4.2, allows an unauthenticated attacker to prevent legitima

SAP Business Client, version 7.0, allows an attacker after a successful social engineering attack to inject malicious co

Under certain conditions, SAP Adaptive Server Enterprise (XP Server on Windows Platform), versions 15.7, 16.0, does not

SAP Adaptive Server Enterprise, version 16.0, allows an authenticated user to execute crafted database queries to elevat

SAP NetWeaver AS ABAP (Web Dynpro ABAP), versions (SAP_UI 750, 752, 753, 754 and SAP_BASIS 700, 710, 730, 731, 804) allo

libcroco through 0.6.13 has excessive recursion in cr_parser_parse_any_core in cr-parser.c, leading to stack consumption

In versions 7.1.5-7.1.9, there is use-after-free memory vulnerability in the BIG-IP Edge Client Windows ActiveX componen

On versions 7.1.5-7.1.9, the BIG-IP Edge Client's Windows Installer Service's temporary folder has weak file and folder

GLPI before before version 9.4.6 has a vulnerability involving a default encryption key. GLPIKEY is public and is used o

An out-of-bounds buffer read flaw was found in the pluto daemon of libreswan from versions 3.27 till 3.31 where, an unau

A missing verification of the TLS host in Nextcloud Mail 1.1.3 allowed a man in the middle attack.

An Insecure direct object reference vulnerability in Nextcloud Server 18.0.2 allowed an attacker to remote wipe devices

Improper access control in Groupfolders app 4.0.3 allowed to delete hidden directories when when renaming an accessible

There is a possible information disclosure issue in Active Resource <v5.1.1 that could allow an attacker to create speci

In SLP Validate (npm package slp-validate) before version 1.2.1, users could experience false-negative validation outcom

SLPJS (npm package slpjs) before version 0.27.2, has a vulnerability where users could experience false-negative validat

A malicious userspace application can cause a integer overflow and bypass security checks performed by system call handl

In updatehub_probe, right after JSON parsing is complete, objects\[1] is accessed from the output structure in two diffe

Multiple syscalls in the Kscan subsystem perform insufficient argument validation, allowing code executing in userspace

Multiple syscalls with insufficient argument validation See NCC-ZEP-006 This issue affects: zephyrproject-rtos zephyr ve

An attacker who has obtained code execution within a user thread is able to elevate privileges to that of the kernel. Se

The arm platform-specific code uses a signed integer comparison when validating system call numbers. An attacker who has

Out-of-bounds Write in the USB Mass Storage memoryWrite handler with unaligned Sizes See NCC-ZEP-024, NCC-ZEP-025, NCC-Z

USB DFU has a potential buffer overflow where the requested length (wLength) is not checked against the buffer size. Thi

In SwiftNIO Extras before 1.4.1, a logic issue was addressed with improved restrictions.

Symantec Endpoint Protection, prior to 14.3, may not respect file permissions when writing to log files that are replace