2020

SolarWinds Orion Platform 2018.4 HF3 (NPM 12.4, NetPath 1.1.4) allows Stored HTML Injection by administrators via the We

IBM QRadar Advisor 1.1 through 2.5 could allow an unauthorized attacker to obtain sensitive information from specially c

An issue was discovered in the Widgets extension through 1.4.0 for MediaWiki. Improper title sanitization allowed for th

In Apache Tomcat 9.0.0.M1 to 9.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99 the HTTP header parsing code used an approach t

The refactoring present in Apache Tomcat 9.0.28 to 9.0.30, 8.5.48 to 8.5.50 and 7.0.98 to 7.0.99 introduced a regression

includes/options.php in the motors-car-dealership-classified-listings (aka Motors - Car Dealer & Classified Ads) plugin

includes/options.php in the motors-car-dealership-classified-listings (aka Motors - Car Dealer & Classified Ads) plugin

In NETGEAR Nighthawk X10-R900 prior to 1.0.4.24, by sending a DHCP discover request containing a malicious hostname fiel

In NETGEAR Nighthawk X10-R900 prior to 1.0.4.24, an attacker may execute stored XSS attacks against this device by suppl

In TOTOLINK A3002RU 1.0.8, the router provides a page that allows the user to change their account name and password. Th

rdf-graph-array through 0.3.0-rc6 manipulation of JavaScript objects resutling in Prototype Pollution. The rdf.Graph.pro

IBM Maximo Asset Management 7.6.1.0 could allow a remote attacker to disclose sensitive information to an authenticated

IBM Spectrum Protect Plus 10.1.0 and 10.5.0, when protecting Microsoft SQL or Microsoft Exchange, could allow an attacke

IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 5.2.6.5 could allow a remote attacker to conduct phishing a

There is an OS command injection vulnerability in Ruby Rake < 12.3.3 in Rake::FileList when supplying a filename that be

DNN (formerly DotNetNuke) through 9.4.4 has Insecure Permissions.

DNN (formerly DotNetNuke) through 9.4.4 allows XSS (issue 1 of 2).

An issue was discovered in SmartClient 12.0. If an unauthenticated attacker makes a POST request to /tools/developerCons

Graph Builder in SAS Visual Analytics 8.5 allows XSS via a graph template that is accessed directly.

The F-Secure AV parsing engine before 2020-02-05 allows virus-detection bypass via crafted Compression Method data in a

SOPlanning 1.45 allows XSS via the Name or Comment to status.php.

SOPlanning 1.45 allows XSS via the "Your SoPlanning url" field.

fauzantrif eLection 2.0 has XSS via the Admin Dashboard -> Settings -> Election -> "message if election is closed" field

Gogs through 0.11.91 allows attackers to violate the admin-specified repo-creation policy due to an internal/db/repo.go

OX App Suite through 7.10.2 allows SSRF.

The HTTPS protocol, as used in unspecified web applications, can encrypt compressed data without properly obfuscating th

Information-disclosure vulnerability in Netsurf through 2.8 due to a world-readable cookie jar.

Atos Unify OpenScape UC Application V9 before version V9 R4.31.0 and V10 before version V10 R0.6.0 allows XSS. An attack

Kernel/Modules/AgentTicketWatcher.pm in Open Ticket Request System (OTRS) 3.0.x before 3.0.21, 3.1.x before 3.1.17, and

Kernel/Modules/AgentTicketPhone.pm in Open Ticket Request System (OTRS) 3.0.x before 3.0.20, 3.1.x before 3.1.16, and 3.

Affected Dell Client platforms contain a BIOS Setup configuration authentication bypass vulnerability in the pre-boot In

Cross-site scripting vulnerability in Aterm WG2600HS firmware Ver1.3.2 and earlier allows remote attackers to inject arb

uap-core before 0.7.3 is vulnerable to a denial of service attack when processing crafted User-Agent strings. Some regex

Western Digital mycloud.com before Web Version 2.2.0-134 allows XSS.

The Trend Micro Security 2019 (15.0.0.1163 and below) consumer family of products is vulnerable to a denial of service (

Avira AV Engine before 8.3.54.138 allows virus-detection bypass via a crafted ISO archive. This affects versions before

A stored XSS vulnerability exists in the Modula Image Gallery plugin before 2.2.5 for WordPress. Successful exploitation

A restricted desktop environment escape vulnerability exists in the Kiosk Mode functionality of affected devices. Specia

Multiple cross-site scripting (XSS) vulnerabilities in LongTail Video JW Player through 5.10.2295 allow remote attackers

fs/proc/base.c in the Linux kernel through 3.1 allows local users to obtain sensitive keystroke information via access t

IBM Maximo Asset Management 7.6.0.10 and 7.6.1.1 could allow an authenticated user to obtain sensitive information from

Directory traversal vulnerability in the Android debug bridge (aka adb) in Android 4.0.4 allows physically proximate att

Ansible before 1.5.5 sets 0644 permissions for sources.list, which might allow local users to obtain sensitive credentia

The vault subsystem in Ansible before 1.5.5 does not set the umask before creation or modification of a vault file, whic

A flaw was found in mod_auth_openidc before version 2.4.1. An open redirect issue exists in URLs with a slash and backsl

The Neighbor Discovery (ND) protocol implementation in the IPv6 stack in FreeBSD through 10.1 allows remote attackers to

The Linux kernel from v2.3.36 before v2.6.39 allows local unprivileged users to cause a denial of service (memory consum

Ansible before 1.5.5 constructs filenames containing user and password fields on the basis of deb lines in sources.list,

The color_esycc_to_rgb function in bin/common/color.c in OpenJPEG before 2.1.1 allows attackers to cause a denial of ser

Previously, Puppet operated on a model that a node with a valid certificate was entitled to all information in the syste