2020

A HTTP Response Splitting vulnerability was identified in the Web Settings Component of Web File Manager in Rumpus FTP S

A CSRF vulnerability exists in the Upload Center Forms Component of Web File Manager in Rumpus FTP 8.2.9.1. This could a

A CSRF vulnerability exists in the Block Clients component of Web File Manager in Rumpus FTP 8.2.9.1 that could allow an

A CSRF vulnerability exists in the Event Notices Settings of Web File Manager in Rumpus FTP 8.2.9.1. An attacker can cre

A Cookie based reflected XSS exists in the Web File Manager of Rumpus FTP Server 8.2.9.1, related to RumpusLoginUserName

A CSRF vulnerability exists in the Web File Manager's Create/Delete Accounts functionality of Rumpus FTP Server 8.2.9.1.

WordPress WP Cleanfix Plugin 2.4.4 has CSRF

Piwigo 2.10.1 is affected by stored XSS via the Group Name Field to the group_list page.

A CSRF vulnerability exists in the FTP Settings of Web File Manager in Rumpus FTP 8.2.9.1. Exploitation of this vulnerab

A CSRF vulnerability exists in the Folder Sets Settings of Web File Manager in Rumpus FTP 8.2.9.1. This allows an attack

A CSRF vulnerability exists in the Web File Manager's Network Setting functionality of Rumpus FTP Server 8.2.9.1. By exp

BlackBerry PlayBook before 2.1 has an Information Disclosure Vulnerability via a Web browser component error

InfoSphere Guardium aix_ktap module: DoS

HP Systems Insight Manager before 7.0 allows a remote user on adjacent network to access information

It was found in all keycloak versions before 9.0.0 that links to external applications (Application Links) in the admin

The clientconf.html and detailbw.html pages in x3 in cPanel & WHM 11.34.0 (build 8) have a XSS vulnerability.

Orange HRM 2.7.1 allows XSS via the vacancy name.

vBSeo before 3.6.0PL2 allows XSS via the member.php u parameter.

index.php?p=/dashboard/settings/branding in Vanilla 2.6.3 allows stored XSS.

When using certain mbstring functions to convert multibyte encodings, in PHP versions 7.2.x below 7.2.27, 7.3.x below 7.

When using fgetss() function to read data with stripping tags, in PHP versions 7.2.x below 7.2.27, 7.3.x below 7.3.14 an

htmlfile in lib/transport/htmlfile.js in SockJS before 0.3.0 is vulnerable to Reflected XSS via the /htmlfile c (aka cal

Digi TransPort WR21 5.2.2.3, WR44 5.1.6.4, and WR44v2 5.1.6.9 devices allow stored XSS in the web application.

The Basic webmail module 6.x-1.x before 6.x-1.2 for Drupal allows remote authenticated users with the "access basic_webm

Multiple cross-site scripting (XSS) vulnerabilities in NetCracker Resource Management System before 8.2 allow remote aut

Cross-site scripting (XSS) vulnerability in main/dropbox/index.php in Chamilo LMS before 1.8.8.6 allows remote attackers

Multiple cross-site scripting (XSS) vulnerabilities in the Photo Gallery plugin before 1.2.11 for WordPress allow remote

Cross-site scripting (XSS) vulnerability in the loadForm function in Frontend/Modules/Search/Actions/Index.php in Fork C

Open-School Community Edition 2.2 does not properly restrict access to the export functionality, which allows remote aut

Multiple cross-site scripting (XSS) vulnerabilities in Open-School Community Edition 2.2 allow remote attackers to injec

Kevin Backhouse discovered an integer overflow in bson_ensure_space, as used in whoopsie.

Sander Bos discovered a time of check to time of use (TOCTTOU) vulnerability in apport that allowed a user to cause core

Bludit 3.10.0 allows Editor or Author roles to insert malicious JavaScript on the WYSIWYG editor. NOTE: the vendor's per

ajax/profile-picture-upload.php in Bludit 3.10.0 allows authenticated users to change other users' profile pictures.

The Fujitsu TLS library allows a man-in-the-middle attack. This affects Interstage Application Development Cycle Manager

Cross-site scripting (XSS) vulnerability in admin/system.html in Openfiler 2.3 allows remote attackers to inject arbitra

A flaw was found in the way the Ceph RGW Beast front-end handles unexpected disconnects. An authenticated attacker can a

A cross-site scripting (XSS) vulnerability in Smoothwall Express 3.

D-Link DIR865L v1.03 suffers from an "Unauthenticated Hardware Linking" vulnerability.

Linksys WRT310Nv2 2.0.0.1 is vulnerable to XSS.

A vulnerability exists in Docker before 1.2 via container names, which may collide with and override container IDs.

The external frontend system uses numerous background calls to the backend. Each background request is treated as user a

A Cross-site Scripting (XSS) vulnerability exists in WatchGuard XTM 11.8.3 via the poll_name parameter in the firewall/p

statusnet through 2010 allows attackers to spoof syslog messages via newline injection attacks.

ProjectPier 0.8.8 does not use the Secure flag for cookies

ProjectPier 0.8.8 has a Remote Information Disclosure Weakness because of the lack of the HttpOnly cookie flag

ProjectPier 0.8.8 has stored XSS

Synaptive Medical ClearCanvas ImageServer 3.0 Alpha allows XSS (and HTML injection) via the Default.aspx UserName parame

WordPress Super Cache Plugin 1.3 has XSS.

File Disclosure in SMF (SimpleMachines Forum) <= 2.0.3: Forum admin can read files such as the database config.