2019

An issue was discovered in GNOME Nautilus 3.30 prior to 3.30.6 and 3.32 prior to 3.32.1. A compromised thumbnailer may e

Eclipse Vorto versions prior to 0.11 resolved Maven build artifacts for the Xtext project over HTTP instead of HTTPS. An

Gila CMS 1.10.1 allows fm/save CSRF for executing arbitrary PHP code.

A buffer over-read in Util_urlDecode in util.c in Tildeslash Monit before 5.25.3 allows a remote authenticated attacker

The Snapweb interface before version 0.21.2 was exposing controls to install or remove snap packages without controlling

Versions of Unity8 before 8.11+16.04.20160122-0ubuntu1 file plugins/Dash/CardCreator.js will execute any code found in p

Any Python module in sys.path can be imported if the command line of the process triggering the coredump is Python and t

LXD before version 0.19-0ubuntu5 doUidshiftIntoContainer() has an unsafe Chmod() call that races against the stat in the

A vulnerability in maasserver.api.get_file_by_name of Ubuntu MAAS allows unauthenticated network clients to download any

Versions of nova before 2012.1 could expose hypervisor host files to a guest operating system when processing a maliciou

whatsns 4.0 allows index.php?admin_category/remove.html cid[] SQL injection.

whatsns 4.0 allows index.php?inform/add.html qid SQL injection.

In Kubernetes v1.12.0-v1.12.4 and v1.13.0, the rest.AnonymousClientConfig() method returns a copy of the provided config

An issue was discovered in CutePHP CuteNews 2.1.2. An attacker can infiltrate the server through the avatar upload proce

An issue was discovered in ATutor through 2.2.4. It allows the user to run commands on the server with the teacher user

OpenKM 6.3.2 through 6.3.7 allows an attacker to upload a malicious JSP file into the /okm:root directories and move tha

An issue was discovered in Liferay Portal CE 7.1.2 GA3. An attacker can use Liferay's Groovy script console to execute O

A CSRF issue was discovered on Intelbras IWR 3000N 1.5.0 devices, leading to complete control of the router, as demonstr

An issue was discovered on Intelbras IWR 3000N 1.5.0 devices. A malformed login request allows remote attackers to cause

An issue was discovered on Intelbras IWR 3000N 1.5.0 devices. When the administrator password is changed from a certain

An issue was discovered in Artifex MuJS 1.0.5. It has unlimited recursion because the match function in regexp.c lacks a

An issue was discovered in Artifex MuJS 1.0.5. jscompile.c can cause a denial of service (invalid stack-frame jump) beca

OpenAPI Tools OpenAPI Generator before 4.0.0-20190419.052012-560 uses http:// URLs in various build.gradle, build.gradle

arrow-kt Arrow before 0.9.0 resolved Gradle build artifacts (for compiling and building the published JARs) over HTTP in

A issue was discovered in SiteServer CMS 6.9.0. It allows remote attackers to execute arbitrary code because an administ

An issue was discovered in ProjectSend r1053. upload-process-form.php allows finished_files[]=../ directory traversal. I

wcms/wex/finder/action.php in WCMS v0.3.2 has a Arbitrary File Upload Vulnerability via developer/finder because .php is

SOY CMS v3.0.2 allows remote attackers to execute arbitrary PHP code via a <?php substring in the second text box. NOTE:

74CMS v5.0.1 has a CSRF vulnerability to add a new admin user via the index.php?m=Admin&c=admin&a=add URI.

The client in Electronic Arts (EA) Origin 10.5.36 on Windows allows template injection in the title parameter of the Ori

TeamSpeak 3 Client before 3.2.5 allows remote code execution in the Qt framework.

In the configuration of NFC modules on certain devices, there is a possible failure to distinguish individual devices du

In l2cu_send_peer_config_rej of l2c_utils.cc, there is a possible out-of-bound read due to an incorrect bounds check. Th

In rw_i93_sm_update_ndef of rw_i93.cc, there is a possible out-of-bound write due to a missing bounds check. This could

In rw_i93_sm_read_ndef of rw_i93.cc, there is a possible out-of-bounds write due to an integer overflow. This could lead

In create_hdr of dnssd_clientstub.c, there is a possible use after free. This could lead to local escalation of privileg

In SetScanResponseData of ble_advertiser_hci_interface.cc, there is a possible out-of-bound write due to a missing bound

In rw_t3t_act_handle_check_ndef_rsp of rw_t3t.cc, there is a possible out-of-bound write due to a missing bounds check.

In btm_proc_smp_cback of tm_ble.cc, there is a possible memory corruption due to a use after free. This could lead to re

In numerous hand-crafted functions in libmpeg2, NEON registers are not preserved. This could lead to remote code executi

In floor0_inverse1 of floor0.c, there is a possible out of bounds write due to an incorrect bounds check. This could lea

In updateAssistMenuItems of Editor.java, there is a possible escape from the Setup Wizard due to a missing permission ch

hw/sparc64/sun4u.c in QEMU 3.1.50 is vulnerable to a NULL pointer dereference, which allows the attacker to cause a deni

IBM MQ 8.0.0.0 through 8.0.0.10, 9.0.0.0 through 9.0.0.5, and 9.1.0.0 through 9.1.1 is vulnerable to a denial of service

In Eclipse OpenJ9 prior to the 0.14.0 release, the Java bytecode verifier incorrectly allows a method to execute past th

The studio profile decoder in libavcodec/mpeg4videodec.c in FFmpeg 4.0 before 4.0.4 and 4.1 before 4.1.2 allows remote a

libavcodec/hevcdec.c in FFmpeg 3.4 and 4.1.2 mishandles detection of duplicate first slices, which allows remote attacke

MKCMS 5.0 allows remote attackers to take over arbitrary user accounts by posting a username and e-mail address to ucent

Network Time Protocol (NTP), as specified in RFC 5905, uses port 123 even for modes where a fixed port number is not req

The urllib3 library before 1.24.2 for Python mishandles certain cases where the desired set of CA certificates is differ