2019

The UPnP endpoint URL /gena.cgi in the D-Link DIR-859 Wi-Fi router 1.05 and 1.06B01 Beta01 allows an Unauthenticated rem

Apache Solr 5.0.0 to Apache Solr 8.3.1 are vulnerable to a Remote Code Execution through the VelocityResponseWriter. A V

TVT NVMS-1000 devices allow GET /.. Directory Traversal

An issue was discovered in Citrix Application Delivery Controller (ADC) and Gateway 10.5, 11.1, 12.0, 12.1, and 13.0. Th

mongo-express before 0.54.0 is vulnerable to Remote Code Execution via endpoints that uses the `toBSON` method. A misuse

In SonicWall SMA100, an unauthenticated Directory Traversal vulnerability in the handleWAFRedirect CGI allows the user t

A use after free issue was addressed with improved memory management. This issue is fixed in iOS 12.3, macOS Mojave 10.1

A use after free issue was addressed with improved memory management. This issue is fixed in macOS Mojave 10.14.4. An ap

A type confusion issue was addressed with improved memory handling. This issue is fixed in iOS 12.2, tvOS 12.2, watchOS

A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 12.1.4. An applicatio

A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 12.1.4, macOS Mojave

IBM Planning Analytics 2.0.0 through 2.0.8 is vulnerable to a configuration overwrite that allows an unauthenticated use

Vulnerability in SonicWall SMA100 allow unauthenticated user to gain read-only access to unauthorized resources. This vu

Progress Telerik UI for ASP.NET AJAX through 2019.3.1023 contains a .NET deserialization vulnerability in the RadAsyncUp

An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in

OpenSLP as used in ESXi and the Horizon DaaS appliances has a heap overwrite issue. VMware has evaluated the severity of

This external control of file name or path vulnerability allows remote attackers to access or modify system files. To fi

This external control of file name or path vulnerability allows remote attackers to access or modify system files. To fi

This improper input validation vulnerability allows remote attackers to inject arbitrary code to the system. To fix the

This improper access control vulnerability allows remote attackers to gain unauthorized access to the system. To fix the

A vulnerability in the web-based management interface of certain Cisco Small Business RV Series Routers could allow an a

Out of bounds write in JavaScript in Google Chrome prior to 73.0.3683.86 allowed a remote attacker to potentially exploi

Use after free in WebAudio in Google Chrome prior to 78.0.3904.87 allowed a remote attacker to potentially exploit heap

Sangoma FreePBX 115.0.16.26 and below, 14.0.13.11 and below, 13.0.197.13 and below have Incorrect Access Control.

Use of a hard-coded cryptographic key to cipher sensitive data in FortiOS configuration backup file may allow an attacke

A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet

An elevation of privilege vulnerability exists when the Windows Universal Plug and Play (UPnP) service improperly allows

An elevation of privilege vulnerability exists in the Windows Certificate Dialog when it does not properly enforce user

An elevation of privilege vulnerability exists when the Windows AppX Deployment Extensions improperly performs privilege

Trend Micro OfficeScan versions 11.0 and XG (12.0) could be exploited by an attacker utilizing a directory traversal vul

In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it

Vulnerability in the Oracle Solaris product of Oracle Systems (component: XScreenSaver). The supported version that is a

Directory Traversal in the function http_verify in nostromo nhttpd through 1.9.6 allows an attacker to achieve remote co

A use-after-free in binder.c allows an elevation of privilege from an application to the Linux Kernel. No user interacti

An elevation of privilege vulnerability exists when Windows improperly handles authentication requests, aka 'Microsoft W

An elevation of privilege vulnerability exists when Windows Error Reporting manager improperly handles hard links, aka '

Exim 4.92 through 4.92.2 allows remote code execution, a different vulnerability than CVE-2019-15846. There is a heap-ba

Unauthenticated remote code execution occurs in D-Link products such as DIR-655C, DIR-866L, DIR-652, and DHP-1565. The i

vBulletin 5.x through 5.5.4 allows remote command execution via the widgetConfig[code] parameter in an ajax/render/widge

A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet

The login_mgr.cgi script in D-Link DNS-320 through 2.05.B10 is vulnerable to remote command injection.

Some Samsung devices include the SIMalliance Toolbox Browser (aka S@T Browser) on the UICC, which might allow remote att

A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle obje

An elevation of privilege vulnerability exists when the Windows AppX Deployment Server improperly handles junctions.To e

An elevation of privilege vulnerability exists in the way that ws2ifsl.sys (Winsock) handles objects in memory, aka 'Win

An elevation of privilege vulnerability exists when the Windows Common Log File System (CLFS) driver improperly handles

Nagios XI before 5.6.6 allows remote command execution as root. The exploit requires access to the server as the nagios

Citrix StoreFront Server before 1903, 7.15 LTSR before CU4 (3.12.4000), and 7.6 LTSR before CU8 (3.0.8000) allows XXE at

Docker Desktop Community Edition before 2.1.0.1 allows local users to gain privileges by placing a Trojan horse docker-c

An issue was discovered in Webmin <=1.920. The parameter old in password_change.cgi contains a command injection vulnera