2021

Clustered Data ONTAP versions prior to 9.3P20 and 9.5P15 are susceptible to a vulnerability which could allow unauthoriz

Authenticated stored cross-site scripting (XSS) in the contact name field in the distribution list of MDaemon webmail 19

Stored cross-site scripting (XSS) in file attachment field in MDaemon webmail 19.5.5 allows an attacker to execute code

Zoho ManageEngine Remote Access Plus 10.0.259 allows HTML injection via the Description field on the Admin - User Admini

In SolarWinds Serv-U before 15.2.2 Hotfix 1, there is a directory containing user profile files (that include users' pas

SolarWinds Orion Platform before 2020.2.4, as used by various SolarWinds products, installs and uses a SQL Server backen

The Collector Service in SolarWinds Orion Platform before 2020.2.4 uses MSMQ (Microsoft Message Queue) and doesn't set p

A missing link validation in Nextcloud Server before 20.0.2, 19.0.5, 18.0.11 allows execution of a stored XSS attack usi

The function ClientEAPOLKeyRecvd() in the Realtek RTL8195A Wi-Fi Module prior to versions released in April 2020 (up to

The function DecWPA2KeyData() in the Realtek RTL8195A Wi-Fi Module prior to versions released in April 2020 (up to and e

The function AES_UnWRAP() in the Realtek RTL8195A Wi-Fi Module prior to versions released in April 2020 (up to and exclu

The function DecWPA2KeyData() in the Realtek RTL8195A Wi-Fi Module prior to versions released in April 2020 (up to and e

The function CheckMic() in the Realtek RTL8195A Wi-Fi Module prior to versions released in April 2020 (up to and excludi

Apache Shiro before 1.7.1, when using Apache Shiro with Spring, a specially crafted HTTP request may cause an authentica

Apache Cassandra versions 2.1.0 to 2.1.22, 2.2.0 to 2.2.19, 3.0.0 to 3.0.23, and 3.11.0 to 3.11.9, when using 'dc' or 'r

In JetBrains TeamCity before 2020.2.1, permissions during user deletion were checked improperly.

In JetBrains TeamCity before 2020.2.1, permissions during token removal were checked improperly.

In JetBrains TeamCity before 2020.2, an ECR token could be exposed in a build's parameters.

In JetBrains TeamCity before 2020.2.1, the server admin could create and see access tokens for any other users.

In JetBrains TeamCity before 2020.2.1, a user could get access to the GitHub access token of another user.

JetBrains TeamCity before 2020.2 was vulnerable to reflected XSS on several pages.

In JetBrains TeamCity before 2020.2.2, TeamCity server DoS was possible via server integration.

In JetBrains YouTrack before 2020.6.1099, project information could be potentially disclosed.

In JetBrains YouTrack before 2020.5.3123, server-side template injection (SSTI) was possible, which could lead to code e

In JetBrains YouTrack before 2020.4.6808, the YouTrack administrator wasn't able to access attachments.

In JetBrains YouTrack before 2020.4.4701, permissions for attachments actions were checked improperly.

In JetBrains YouTrack before 2020.6.1767, an issue's existence could be disclosed via YouTrack command execution.

In JetBrains YouTrack before 2020.4.4701, improper resource access checks were made.

In JetBrains YouTrack before 2020.4.4701, CSRF via attachment upload was possible.

In JetBrains Ktor before 1.4.2, weak cipher suites were enabled by default.

In JetBrains Ktor before 1.4.3, HTTP Request Smuggling was possible.

In JetBrains Ktor before 1.5.0, a birthday attack on SessionStorage key was possible.

In JetBrains Hub before 2020.1.12669, information disclosure via the public API was possible.

In JetBrains Hub before 2020.1.12629, an authenticated user can delete 2FA settings of any other user.

In JetBrains IntelliJ IDEA before 2020.3, potentially insecure deserialization of the workspace model could lead to loca

In JetBrains Hub before 2020.1.12629, an open redirect was possible.

In JetBrains IntelliJ IDEA before 2020.2, HTTP links were used for several remote repositories instead of HTTPS.

In JetBrains Code With Me before 2020.3, an attacker on the local network, knowing a session ID, could get access to the

JetBrains TeamCity Plugin before 2020.2.85695 SSRF. Vulnerability that could potentially expose user credentials.

SolarWinds Serv-U before 15.2.2 allows authenticated reflected XSS.

SolarWinds Serv-U before 15.2.2 allows Unauthenticated Macro Injection.

The vulnerability have been reported to affect earlier versions of QTS. If exploited, this command injection vulnerabili

The vulnerability have been reported to affect earlier versions of QTS. If exploited, this improper access control vulne

In JetBrains Kotlin before 1.4.21, a vulnerable Java API was used for temporary file and folder creation. An attacker wa

In Wind River VxWorks, memory allocator has a possible overflow in calculating the memory block's size to be allocated b

Zoho ManageEngine OpManager Stable build before 125203 (and Released build before 125233) allows Remote Code Execution v

SolarWinds Serv-U before 15.2.2 allows Authenticated Stored XSS.

SolarWinds Serv-U before 15.2.2 allows Authenticated Directory Traversal.

In Eclipse Californium version 2.3.0 to 2.6.0, the certificate based (x509 and RPK) DTLS handshakes accidentally fails,

In JetBrains YouTrack before 2020.4.4701, an attacker could enumerate users via the REST API without appropriate permiss