CWE-20

The safe_eval function in Ansible before 1.5.4 does not properly restrict the code subset, which allows remote attackers

IBM Spectrum Protect Plus 10.1.0 and 10.1.5 could allow a remote attacker to execute arbitrary code on the system. By us

Lack of input validation in pdf-image npm package version <= 2.0.0 may allow an attacker to run arbitrary code if PDF fi

A vulnerability with the SmartService API Service option exists whereby an unauthorized user could potentially exploit t

In Fat-Free Framework 3.7.1, attackers can achieve arbitrary code execution if developers choose to pass user controlled

An issue was discovered in Responsive Filemanager through 9.14.0. In the ajax_calls.php file in the save_img action in t

A vulnerability was discovered in the PyYAML library in versions before 5.3.1, where it is susceptible to arbitrary code

An issue was discovered on Samsung mobile devices with P(9.0) and Q(10.0) (with TEEGRIS) software. The Esecomm Trustlet

This vulnerability allows remote attackers to execute arbitrary code on affected installations of TP-Link Archer A7 Firm

A webserver component in Paessler PRTG Network Monitor 19.2.50 to PRTG 20.1.56 allows unauthenticated remote command exe

An out-of-bounds read was addressed with improved input validation. This issue is fixed in macOS Catalina 10.15.3. A rem

A memory corruption issue was addressed with improved input validation. This issue is fixed in macOS Catalina 10.15.3. A

A memory corruption issue was addressed with improved input validation. This issue is fixed in macOS Catalina 10.15.3. A

A memory corruption issue was addressed with improved input validation. This issue is fixed in macOS Catalina 10.15.3. A

Flaw in input validation in npm package utils-extend version 1.0.8 and earlier may allow prototype pollution attack that

npm-programmatic through 0.0.12 is vulnerable to Command Injection.The packages and option properties are concatenated t

An issue was discovered on Samsung mobile devices with L(5.0/5.1) and M(6.0) software. SVoice allows Hare Hunting during

An issue was discovered on Samsung mobile devices with L(5.0/5.1) and M(6.0) software. SVoice allows provider seizure vi

An issue was discovered on Samsung mobile devices with N(7.0) (Qualcomm models using MSM8996 chipsets) software. A devic

An issue was discovered in ONLYOFFICE Document Server 5.5.0. An attacker can craft a malicious .docx file, and exploit t

An issue was discovered in ONLYOFFICE Document Server 5.5.0. An attacker can craft a malicious .docx file, and exploit t

A vulnerability in the web server for Cisco IP Phones could allow an unauthenticated, remote attacker to execute code wi

Multiple vulnerabilities in the REST API of Cisco UCS Director and Cisco UCS Director Express for Big Data may allow a r

Multiple vulnerabilities in the REST API of Cisco UCS Director and Cisco UCS Director Express for Big Data may allow a r

Multiple vulnerabilities in the REST API of Cisco UCS Director and Cisco UCS Director Express for Big Data may allow a r

Multiple vulnerabilities in the REST API of Cisco UCS Director and Cisco UCS Director Express for Big Data may allow a r

A remote code execution vulnerability in UCB component of Mitel MiVoice Connect before 19.1 SP1 could allow an unauthent

An issue was discovered on LG mobile devices with Android OS 7.0, 7.1, 7.2, 8.0, 8.1, and 9.0 software. The Backup subsy

IBM Spectrum Protect 7.1 and 8.1 server is vulnerable to a stack-based buffer overflow, caused by improper bounds checki

In FreeBSD 12.1-STABLE before r356035, 12.1-RELEASE before 12.1-RELEASE-p4, 11.3-STABLE before r356036, and 11.3-RELEASE

In FreeBSD 12.1-STABLE before r356035, 12.1-RELEASE before 12.1-RELEASE-p4, 11.3-STABLE before r356036, and 11.3-RELEASE

In FreeBSD 12.1-STABLE before r356911, and 12.1-RELEASE before p5, insufficient checking in the cryptodev module allocat

In FreeBSD 12.1-STABLE before r360971, 12.1-RELEASE before p5, 11.4-STABLE before r360971, 11.4-BETA1 before p1 and 11.3

A vulnerability in the Java Remote Management Interface of Cisco Unified Contact Center Express (Unified CCX) could allo

Cybozu Desktop for Windows 2.0.23 to 2.2.40 allows remote code execution via unspecified vectors.

An issue was discovered on Samsung mobile devices with Q(10.0) (with TEEGRIS on Exynos chipsets) software. The Widevine

An issue was discovered on Samsung mobile devices with O(8.x) (with TEEGRIS) software. The Gatekeeper Trustlet allows a

FactoryTalk Linx versions 6.00, 6.10, and 6.11, RSLinx Classic v4.11.00 and prior,Connected Components Workbench: Versio

SolarWinds Serv-U FTP server before 15.2.1 does not validate an argument path.

An elevation of privilege vulnerability exists when Microsoft SharePoint Server and Skype for Business Server improperly

Advantech iView, versions 5.6 and prior, has an improper input validation vulnerability. Successful exploitation of this

A vulnerability in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers

A vulnerability in the Secure Sockets Layer (SSL) VPN feature of Cisco Small Business RV340, RV340W, RV345, and RV345P D

In TYPO3 installations with the "mediace" extension from version 7.6.2 and before version 7.6.5, it has been discovered

Out of bound write while QoS DSCP mapping due to improper input validation for data received from association response f

A vulnerability in Cisco SD-WAN Solution Software could allow an unauthenticated, remote attacker to cause a buffer over

jpv (aka Json Pattern Validator) before 2.2.2 does not properly validate input, as demonstrated by a corrupted array.

IBM Spectrum Protect Operations Center 7.1.0.000 through 7.1.10 and 8.1.0.000 through 8.1.9 may allow an attacker to exe

The decode program in silk-v3-decoder Version:20160922 Build By kn007 does not strictly check data, resulting in a buffe

xmlquery before 1.3.1 lacks a check for whether a LoadURL response is in the XML format, which allows attackers to cause