CWE-20

An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. imap/command.c mishandles a NO response wit

An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. imap/command.c mishandles a long IMAP statu

An issue was discovered in NeoMutt before 2018-07-16. nntp.c proceeds even if memory allocation fails for messages data.

A vulnerability in the Cisco SD-WAN Solution could allow an authenticated, remote attacker to overwrite arbitrary files

Ansible before versions 2.3.1.0 and 2.4.0.0 fails to properly mark lookup-plugin results as unsafe. If an attacker could

redhat-certification does not properly sanitize paths in rhcertStore.py:__saveResultsFile. A remote attacker could use t

Concatenating unsanitized user input in the `whereis` npm module < 0.4.1 allowed an attacker to execute arbitrary comman

In Kamailio before 5.0.7 and 5.1.x before 5.1.4, a crafted SIP message with a double "To" header and an empty "To" tag c

Insufficient URI encoding in restforce before 3.0.0 allows attacker to inject arbitrary parameters into Salesforce API r

A vulnerability in lack of validation of user-supplied parameters pass to XML-RPC calls on SonicWall Global Management S

apps/filemanager/handlers/upload/drop.php in Elefant CMS 2.0.3 performs a urldecode step too late in the "Cannot upload

An issue was discovered in ASPCMS 2.5.6. When registering ordinary users in the addUser function of the /member/reg.asp

Lansweeper 4.x through 6.x before 6.0.0.48 allows attackers to execute arbitrary code on the administrator's workstation

A vulnerability in NoMachine App for Android 5.0.63 and earlier allows attackers to alter environment variables via unsp

An issue was discovered in zsh before 5.6. The beginning of a #! script file was mishandled, potentially leading to an e

An issue was discovered in zsh before 5.6. Shebang lines exceeding 64 characters were truncated, potentially leading to

A vulnerability has been discovered in login.cgi in Pulse Secure Pulse Connect Secure (PCS) 8.1RX before 8.1R12 and 8.3R

A remote code execution vulnerability exists when Microsoft .NET Framework processes untrusted input, aka ".NET Framewor

In Snapdragon (Automobile, Mobile, Wear) in version MDM9206, MDM9607, MDM9650, MSM8909W, MSM8996AU, SD 210/SD 212/SD 205

Philips e-Alert Unit (non-medical device), Version R2.1 and prior. The software does not validate input properly, allowi

Entes EMG12 versions 2.57 and prior The application uses a web interface where it is possible for an attacker to bypass

NetApp E-Series SANtricity OS Controller Software 11.30 and later version 11.30.5 is susceptible to unauthenticated remo

A vulnerability in the Cisco SD-WAN Solution could allow an unauthenticated, remote attacker to bypass certificate valid

A vulnerability can occur when capturing a media stream when the media source type is changed as the capture is occurrin

parseObject in Fastjson before 1.2.25, as used in FastjsonEngine in Pippo 1.11.0 and other products, allows remote attac

HTTL (aka Hyper-Text Template Language) through 1.0.11 allows remote command execution because the decodeXml function us

HTTL (aka Hyper-Text Template Language) through 1.0.11 allows remote command execution because the decodeXml function us

Incorrect access control in formPasswordSetup in TOTOLINK A3002RU version 1.0.8 allows attackers to change the admin use

Missing validation check on CRL issuer name in Snapdragon Automobile, Snapdragon Mobile in versions MSM8996AU, SD 410/12

Zoom clients on Windows (before version 4.1.34814.1119), Mac OS (before version 4.1.34801.1116), and Linux (2.4.129780.0

NUUO NVRmini2 Network Video Recorder firmware through 3.9.1 allows remote attackers to execute arbitrary code or cause a

DEXTUploadX5 version Between 1.0.0.0 and 2.2.0.0 contains a vulnerability that could allow remote attacker to download a

Multipart-file uploads call variables to be improperly registered in the global scope. In cases where variables are not

The hhvm-attach deep link handler in Nuclide did not properly sanitize the provided hostname parameter when rendering. A

A vulnerability in Cisco WebEx Network Recording Player for Advanced Recording Format (ARF) files could allow a remote a

A vulnerability in the Cisco WebEx Network Recording Player for Advanced Recording Format (ARF) files could allow an una

The External Control API in Roku and Roku TV products allow unauthorized access via a DNS Rebind attack. This can result

The UPnP HTTP server on Sonos wireless speaker products allow unauthorized access via a DNS rebinding attack. This can r

Incorrect handling of googlechrome:// URL scheme on iOS in Intents in Google Chrome prior to 70.0.3538.67 allowed a remo

A Remote Denial of Service vulnerability in Hewlett Packard Enterprise Moonshot Provisioning Manager Appliance version v

A vulnerability exists in Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3.29.67 which

In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206,

Incorrect Access Control in CustomFieldsFeedServlet in Zoho ManageEngine Applications Manager Version 13 before build 13

A vulnerability where the JavaScript JIT compiler inlines Array.prototype.push with multiple arguments that results in t

A vulnerability in Cisco WebEx Business Suite clients, Cisco WebEx Meetings, and Cisco WebEx Meetings Server could allow

The browsing feature in the server in CUPS does not filter ANSI escape sequences from shared printer names, which might

In the parseURL function of URLStreamHandler, there is improper input validation of the host field. This could lead to a

mpv through 0.28.0 allows remote attackers to execute arbitrary code via a crafted web site, because it reads HTML docum

A vulnerability in an operations script of Cisco UCS Central could allow an authenticated, remote attacker to execute ar

Libavcodec in FFmpeg before 0.11 allows remote attackers to execute arbitrary code via a crafted ASF file.