2020

Authentication bypass using an alternate path or channel in SimpliSafe SS3 firmware 1.4 allows a local, unauthenticated

HCL Connections v5.5, v6.0, and v6.5 contains an open redirect vulnerability which could be exploited by an attacker to

Telegram Desktop through 2.0.1, Telegram through 6.0.1 for Android, and Telegram through 6.0.1 for iOS allow an IDN Homo

Moxa Service in Moxa NPort 5150A firmware version 1.5 and earlier allows attackers to obtain sensitive configuration val

In Wagtail before versions 2.7.3 and 2.8.2, a potential timing attack exists on pages or documents that have been protec

In affected versions of WordPress, a special payload can be crafted that can lead to scripts getting executed within the

In affected versions of WordPress, a vulnerability in the stats() method of class-wp-object-cache.php can be exploited t

In affected versions of WordPress, some private posts, which were previously public, can result in unauthenticated discl

In affected versions of WordPress, a password reset link emailed to a user does not expire upon changing the user passwo

ZTE's SDON controller is impacted by the resource management error vulnerability. When RPC is frequently called by other

A ZTE product is impacted by a resource management error vulnerability. An attacker could exploit this vulnerability to

ZTE SDN controller platform is impacted by an information leakage vulnerability. Due to the program's failure to optimiz

In versions 7.1.5-7.1.8, the BIG-IP Edge Client components in BIG-IP APM, Edge Gateway, and FirePass legacy allow attack

On BIG-IP 15.0.0-15.0.1, 14.1.0-14.1.2.3, 13.1.0-13.1.3.3, and 12.1.0-12.1.5.1 and BIG-IQ 5.2.0-7.1.0, when creating a Q

In affected versions of WordPress, a cross-site scripting (XSS) vulnerability in the navigation section of Customizer al

On versions 15.1.0-15.1.0.1, 15.0.0-15.0.1.2, and 14.1.0-14.1.2.3, in BIG-IP APM portal access, a specially crafted HTTP

An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs cla

An archive traversal flaw was found in all ansible-engine versions 2.9.x prior to 2.9.7, when running ansible-galaxy col

Cross-site scripting (XSS) vulnerability in mailhive/cloudbeez/cloudloader.php and mailhive/cloudbeez/cloudloader_core.p

The address-management feature in xt:Commerce 5.1 to 6.2.2 allows remote authenticated users to zero out other user's st

In Mahara 19.04 before 19.04.5 and 19.10 before 19.10.3, account details are shared in the Elasticsearch results for acc

Sourcegraph before 3.15.1 has a vulnerable authentication workflow because of improper validation in the SafeRedirectURL

In jQuery starting with 1.12.0 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one

admin/blocks.php in Subrion CMS through 4.2.1 allows PHP Object Injection (with resultant file deletion) via serialized

Subrion CMS 4.2.1 allows session fixation via an alphanumeric value in a session cookie.

In Moonlight iOS/tvOS before 4.0.1, the pairing process is vulnerable to a man-in-the-middle attack. The bug has been fi

In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untru

MonoX through 5.1.40.5152 allows stored XSS via User Status, Blog Comments, or Blog Description.

An array overflow was discovered in mt76_add_fragment in drivers/net/wireless/mediatek/mt76/dma.c in the Linux kernel be

usb_sg_cancel in drivers/usb/core/message.c in the Linux kernel before 5.6.8 has a use-after-free because a transfer occ

Actions Http-Client (NPM @actions/http-client) before version 1.0.8 can disclose Authorization headers to incorrect doma

The ninja-forms plugin before 3.4.24.2 for WordPress allows CSRF with resultant XSS.

GitLab 10.8 through 12.9 has a vulnerability that allows someone to mirror a repository even if the feature is not activ

GitLab 9.5.9 through 12.9 is vulnerable to stored XSS in an admin notification feature.

GitLab 12.6 through 12.9 is vulnerable to a privilege escalation that allows an external user to create a personal snipp

In Rundeck before version 3.2.6, authenticated users can craft a request that reveals Execution data and logs and Job de

In certain Red Hat packages for Grafana 6.x through 6.3.6, the configuration files /etc/grafana/grafana.ini and /etc/gra

An information-disclosure flaw was found in Grafana through 6.7.3. The database directory /var/lib/grafana and database

ActiveX Control(HShell.dll) in Handy Groupware 1.7.3.1 for Windows 7, 8, and 10 allows an attacker to execute arbitrary

An issue was discovered in Gigamon GigaVUE 5.5.01.11. The upload functionality allows an arbitrary file upload for an au

An XSS vulnerability resides in the hostname field of the diag_ping.php page in pfsense before 2.4.5 version. After pass

IBM Maximo Anywhere 7.6.2.0, 7.6.2.1, 7.6.3.0, and 7.6.3.1 could disclose highly senstiive user information to an authen

IBM Maximo Anywhere 7.6.2.0, 7.6.2.1, 7.6.3.0, and 7.6.3.1 could disclose highly senstiive user information to an authen

re2c before 2.0 has uncontrolled recursion that causes stack consumption in find_fixed_tags.

NETGEAR ReadyNAS devices before 6.6.1 are affected by command injection.

NETGEAR ReadyNAS 6.6.1 and earlier is affected by command injection.

Certain NETGEAR devices are affected by password recovery and file access. This affects D8500 1.0.3.27 and earlier, DGN2

SUAP V2 allows XSS during the update of user information.

OpenSC before 0.20.0 has a double free in coolkey_free_private_data because coolkey_add_object in libopensc/card-coolkey

A directory traversal vulnerability in SharpZipLib used in the upgrade service in B&R Automation Studio versions 4.0.x,