2020

Relative Path Traversal in Teltonika firmware TRB2_R_00.02.04.3 allows a remote, authenticated attacker to delete arbitr

Relative Path Traversal in Teltonika firmware TRB2_R_00.02.04.3 allows a remote, authenticated attacker to delete arbitr

Cross-site request forgery in Teltonika firmware TRB2_R_00.02.04.3 allows a remote attacker to perform sensitive applica

Insufficient output sanitization in Teltonika firmware TRB2_R_00.02.04.3 allows an unauthenticated attacker to conduct r

Server-Side Request Forgery in Teltonika firmware TRB2_R_00.02.04.3 allows a low privileged user to cause the applicatio

Dell XPS 13 9370 BIOS versions prior to 1.13.1 contains an Improper Exception Handling vulnerability. A local attacker w

HCL Digital Experience 8.5, 9.0, 9.5 is susceptible to cross-site scripting (XSS). The vulnerability could be employed i

In Apache NiFi 1.0.0 to 1.11.4, the notification service manager and various policy authorizer and user group provider o

As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the

When recursing through graphical layers while scrolling, an iterator may have become invalid, resulting in a potential u

By exploiting an Open Redirect vulnerability on a website, an attacker could have spoofed the site displayed in the down

Firefox sometimes ran the onload handler for SVG elements that the DOM sanitizer decided to remove, resulting in JavaScr

When processing surfaces, the lifetime may outlive a persistent buffer leading to memory corruption and a potentially ex

Mozilla developers reported memory safety bugs present in Firefox 80. Some of these bugs showed evidence of memory corru

Mozilla developers reported memory safety bugs present in Firefox 80 and Firefox ESR 78.2. Some of these bugs showed evi

When typing in a password under certain conditions, a race may have occured where the InputContext was not being correct

Mozilla developers reported memory safety bugs present in Firefox for Android 79. Some of these bugs showed evidence of

When aborting an operation, such as a fetch, an abort signal may be deleted while alerting the objects to be notified. T

A lock was missing when accessing a data structure and importing certificate information into the trust database. This v

When processing a MAR update file, after the signature has been validated, an invalid name length could result in a heap

When trying to load a non-video in an audio/video context the exact status code (200, 302, 404, 500, 412, 403, etc.) was

Firefox did not reset the address bar after the beforeunload dialog was shown if the user chose to remain on the page. T

By holding a reference to the eval() function from an about:blank window, a malicious webpage could have gained access t

If Firefox is installed to a user-writable directory, the Mozilla Maintenance Service would execute updater.exe from the

In Zoho ManageEngine Application Manager 14.7 Build 14730 (before 14684, and between 14689 and 14750), the AlarmEscalati

Nette versions before 2.0.19, 2.1.13, 2.2.10, 2.3.14, 2.4.16, 3.0.6 are vulnerable to an code injection attack by passin

Pritunl 1.29.2145.25 allows attackers to enumerate valid VPN usernames via a series of /auth/session login attempts. Ini

In the `@actions/core` npm module before version 1.2.6,`addPath` and `exportVariable` functions communicate with the Act

Envoy master between 2d69e30 and 3b5acb2 may fail to parse request URL that requires host canonicalization.

Envoy through 1.15.0 only considers the first value when multiple header values are present for some HTTP headers. Envoy

Unisys Stealth(core) before 4.0.134 stores passwords in a recoverable format. Therefore, a search of Enterprise Manager

In Istio 1.5.0 though 1.5.8 and Istio 1.6.0 through 1.6.7, when users specify an AuthorizationPolicy resource with DENY

The Web application on Rittal CMC PU III 7030.000 V3.00 V3.11.00_2 to V3.15.70_4 devices fails to sanitize user input on

IBM WebSphere Application Server 7.5, 8.0, 8.5, and 9.0 traditional could allow a remote attacker to obtain sensitive in

WebsiteBaker 2.12.2 allows SQL Injection via parameter 'display_name' in /websitebaker/admin/preferences/save.php. Explo

GetSimple CMS 3.3.16 allows in parameter 'permalink' on the Settings page persistent Cross Site Scripting which is execu

CMS Made Simple 2.2.14 allows an authenticated user with access to the Content Manager to edit content and put persisten

A vulnerability has been discovered in the ace.xmd parser that results from a lack of proper validation of user-supplied

The hyperlinks functionality in atlaskit/editor-core in before version 113.1.5 allows remote attackers to inject arbitra

Upgrading Crowd via XML Data Transfer can reactivate a disabled user from OpenLDAP. The affected versions are from befor

A DLL Hijacking vulnerability in Eaton's 9000x Programming and Configuration Software v 2.0.38 and prior allows an attac

An issue was discovered in MantisBT before 2.24.3. Improper escaping of a custom field's name allows an attacker to inje

An issue was discovered in file_download.php in MantisBT before 2.24.3. Users without access to view private issue notes

An issue was discovered in MantisBT before 2.24.3. When editing an Issue in a Project where a Custom Field with a crafte

In PLC WinProladder Version 3.28 and prior, a stack-based buffer overflow vulnerability can be exploited when a valid us

In the course of work on the open source project it was discovered that authenticated users running queries against Hive

An issue has been discovered in GitLab affecting versions from 11.8 before 12.10.13. GitLab was vulnerable to a stored X

RainbowFish PacsOne Server 6.8.4 allows SQL injection on the username parameter in the signup page.

RainbowFish PacsOne Server 6.8.4 allows XSS.

RainbowFish PacsOne Server 6.8.4 has Incorrect Access Control.