2019

In userman 13.0.76.43 through 15.0.20 in Sangoma FreePBX, XSS exists in the user management screen of the Administrator

In userman 13.0.76.43 through 15.0.20 in Sangoma FreePBX, XSS exists in the User Management screen of the Administrator

The Audible application through 2.34.0 for Android has Missing SSL Certificate Validation for Adobe SDKs, allowing MITM

An out-of-bounds read was discovered in OpenCV before 4.1.1. Specifically, variable coarsest_scale is assumed to be grea

domain/section/markdown/markdown.go in Documize before 3.5.1 mishandles untrusted Markdown content. This was addressed b

An Insecure Direct Object Reference (IDOR) vulnerability in the Xtivia Web Time and Expense (WebTE) interface used for M

A Cross-Site Scripting (XSS) vulnerability exists in LDAP Account Manager (LAM) Pro 3.6 in the export, add_value_form, a

A Cross-Site Scripting (XSS) vulnerability exists in LDAP Account Manager (LAM) Pro 3.6 in the filter parameter to cmd.p

In Puma before versions 3.12.2 and 4.3.1, a poorly-behaved client could use keepalive requests to monopolize Puma's reac

The serialize-javascript npm package before version 2.1.1 is vulnerable to Cross-site Scripting (XSS). It does not prope

An Information Disclosure vulnerability exists in the Jasig Project php-pear-CAS 1.2.2 package in the /tmp directory. Th

Norton Password Manager, prior to 6.6.2.5, may be susceptible to an information disclosure issue, which is a type of vul

Norton Password Manager, prior to 6.6.2.5, may be susceptible to a cross origin resource sharing (CORS) vulnerability, w

Norton Password Manager, prior to 6.6.2.5, may be susceptible to a cross origin resource sharing (CORS) vulnerability, w

A Security Bypass vulnerability exists in the phpCAS 1.2.2 library from the jasig project due to the way proxying of ser

This cross-site scripting (XSS) vulnerability in Music Station allows remote attackers to inject and execute scripts on

This cross-site scripting (XSS) vulnerability in Video Station allows remote attackers to inject and execute scripts on

SCEditor 2.1.3 allows XSS.

OpenStack nova base images permissions are world readable

Katello: Username in Notification page has cross site scripting

The chkstat tool in the permissions package followed symlinks before commit a9e1d26cd49ef9ee0c2060c859321128a6dd4230 (pl

Improper input validation in Kubernetes CSI sidecar containers for external-provisioner (<v0.4.3, <v1.0.2, v1.1, <v1.2.2

Improper Check for filenames with overly long extensions in PostMaster (sending in email) or uploading files (e.g. attac

OpenShift haproxy cartridge: predictable /tmp in set-proxy connection hook which could facilitate DoS

fpregs_state_valid in arch/x86/include/asm/fpu/internal.h in the Linux kernel before 5.4.2, when GCC 9 is used, allows c

GitBook through 2.6.9 allows XSS via a local .md file.

In WSO2 Enterprise Integrator 6.5.0, reflected XSS occurs when updating the message processor configuration from the sou

An issue was discovered in Xen through 4.12.x allowing attackers to gain host OS privileges via DMA in a situation where

An issue was discovered in Decentralized Anonymous Payment System (DAPS) through 2019-08-26. It is possible to force wal

BMC Smart Reporting 7.3 20180418 allows authenticated XXE within the import functionality. One can import a malicious XM

admincgi-bin/service.fcgi on Fronius Solar Inverter devices before 3.14.1 (HM 1.12.1) allows action=download&filename= D

The CSS Hero plugin through 4.0.3 for WordPress is prone to reflected XSS via the URI in a csshero_action=edit_page requ

A stored XSS issue was discovered in DAViCal through 1.1.8. It does not adequately sanitize output of various fields tha

A stored cross-site scripting (XSS) vulnerability has been reported to affect multiple versions of QTS. If exploited, th

read_textobject in read.c in Xfig fig2dev 3.2.7b has a stack-based buffer overflow because of an incorrect sscanf.

The XML content type entity deserializer in Apache Olingo versions 4.0.0 to 4.6.0 is not configured to deny the resoluti

A vulnerability exists in libgwenhywfar through 4.12.0 due to the usage of outdated bundled CA certificates.

Dell Command Update versions prior to 3.1 contain an Arbitrary File Deletion Vulnerability. A local authenticated malici

Dell Command Update versions prior to 3.1 contain an Arbitrary File Deletion Vulnerability. A local authenticated malici

RSA Authentication Manager software versions prior to 8.4 P8 contain a stored cross-site scripting vulnerability in the

SALTO ProAccess SPACE 5.4.3.0 allows XSS.

OpenWrt 18.06.4 allows XSS via the "New port forward" Name field to the cgi-bin/luci/admin/network/firewall/forwards URI

OpenWrt 18.06.4 allows XSS via these Name fields to the cgi-bin/luci/admin/network/firewall/rules URI: "Open ports on ro

In FreeRADIUS 3.0 through 3.0.19, on average 1 in every 2048 EAP-pwd handshakes fails because the password element canno

An issue was discovered in SALTO ProAccess SPACE 5.4.3.0. The product's webserver runs as a Windows service with local S

A User Enumeration flaw exists in Harbor. The issue is present in the "/users" API endpoint. This endpoint is supposed t

In the Linux kernel before 5.2.10, there is a race condition bug that can be caused by a malicious USB device in the USB

In the Linux kernel before 5.2.9, there is an info-leak bug that can be caused by a malicious USB device in the drivers/

In the Linux kernel before 5.2.9, there is an info-leak bug that can be caused by a malicious USB device in the drivers/

In the Linux kernel before 5.3.9, there are multiple out-of-bounds write bugs that can be caused by a malicious USB devi