2019

If an attacker can control the port, which in itself is a very sensitive value, they can inject arbitrary OS commands du

IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 binaries load shared librari

An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SSH_MSG_CHANNEL_REQUEST packets with an exi

An issue was discovered on Wifi-soft UniBox controller 0.x through 2.x devices. The tools/ping Ping feature of the Diagn

An issue was discovered on Wifi-soft UniBox controller 3.x devices. The tools/controller/diagnostic_tools_controller Dia

An issue was discovered on Wifi-soft UniBox controller 0.x through 2.x devices. network/mesh/edit-nds.php is vulnerable

Prior to version 0.3.0, chloride's use of net-ssh resulted in host fingerprints for previously unknown hosts getting add

An exploitable unsafe default configuration vulnerability exists in the TURN server functionality of coTURN prior to 4.5

An issue where a provided address with access_ok() is not checked was discovered in i915_gem_execbuffer2_ioctl in driver

PHP Scripts Mall Car Rental Script 2.0.8 has Cross-Site Request Forgery (CSRF) via accountedit.php.

PHP Scripts Mall Basic B2B Script 2.0.9 has Cross-Site Request Forgery (CSRF) via the Edit profile feature.

PHP Scripts Mall Entrepreneur Job Portal Script 3.0.1 has Cross-Site Request Forgery (CSRF) via the Edit Profile feature

PHP Scripts Mall Advance B2B Script 2.1.4 has Cross-Site Request Forgery (CSRF) via the Edit Profile feature.

PHP Scripts Mall Charity Foundation Script 1 through 3 allows directory traversal via a direct request for a listing of

An out-of-bounds read issue was discovered in the HTTP/2 protocol decoder in HAProxy 1.8.x and 1.9.x through 1.9.0 which

SQL injection vulnerability in Booking Calendar plugin 8.4.3 for WordPress allows remote attackers to execute arbitrary

www/soap/application/MCSoap/Logs.php in MailCleaner Community Edition 2018.08 allows remote attackers to execute arbitra

Secure/SAService.rem in Deltek Ajera Timesheets 9.10.16 and prior are vulnerable to remote code execution via deserializ

An issue was discovered on Teracue ENC-400 devices with firmware 2.56 and below. While the web interface requires authen

An issue was discovered on Teracue ENC-400 devices with firmware 2.56 and below. After successful authentication, the de

In Webgalamb through 7.0, log files are exposed to the internet with predictable files/logs/sql_error_log/YYYY-MM-DD-sql

In Webgalamb through 7.0, a system/ajax.php "wgmfile restore" directory traversal vulnerability could lead to arbitrary

The WP-jobhunt plugin before version 2.4 for WordPress does not control AJAX requests sent to the cs_employer_ajax_profi

ColossusCoinXT through 1.0.5 (a chain-based proof-of-stake cryptocurrency) allows a remote denial of service, exploitabl

The email-ingestion feature in Best Practical Request Tracker 4.1.13 through 4.4 allows denial of service by remote atta

BMC Remedy Mid-Tier 7.1.00 and 9.1.02.003 for BMC Remedy AR System has Incorrect Access Control in ITAM forms, as demons

An issue was discovered in SecurEnvoy SecurAccess 9.3.502. When put in Debug mode and used for RDP connections, the appl

KioWare Server version 4.9.6 and older installs by default to "C:\kioware_com" with weak folder permissions granting any

eVisitorPass contains default administrative credentials. An attacker could exploit this vulnerability to gain full acce

eVisitorPass could allow a local attacker to gain elevated privileges on the system, caused by an error while in kiosk m

eVisitorPass could allow a local attacker to gain elevated privileges on the system, caused by an error with the Virtual

eVisitorPass could allow a local attacker to gain elevated privileges on the system, caused by an error with the Virtual

eVisitorPass could allow a local attacker to gain elevated privileges on the system, caused by an error with the Fullscr

EasyLobby Solo contains default administrative credentials. An attacker could exploit this vulnerability to gain full ac

EasyLobby Solo could allow a local attacker to gain elevated privileges on the system. By visiting the kiosk and typing

EasyLobby Solo is vulnerable to a denial of service. By visiting the kiosk and accessing the task manager, a local attac

Lobby Track Desktop could allow a local attacker to gain elevated privileges on the system, caused by an error in the pr

Lobby Track Desktop could allow a local attacker to gain elevated privileges on the system, caused by an error in the pr

Lobby Track Desktop contains default administrative credentials. An attacker could exploit this vulnerability to gain fu

libhttp/url.c in shellinabox through 2.20 has an implementation flaw in the HTTP request parsing logic. By sending a cra

SolarWinds Serv-U FTP Server 15.1.6 allows remote authenticated users to execute arbitrary code by leveraging the Import

An issue was discovered in Repute ARForms 3.5.1 and prior. An attacker is able to delete any file on the server with web

Five9 Agent Desktop Plus 10.0.70 has Incorrect Access Control allowing a remote attackers to cause a denial of service v

YSoft SafeQ Server 6 allows a replay attack.

Buffer overflow in prot_get_ring_space in the bcmdhd4358 Wi-Fi driver on the Samsung Galaxy S6 SM-G920F G920FXXU5EQH7 al

Trash Bin plugin 1.1.3 for MyBB has cross-site scripting (XSS) via a thread subject and a cross-site request forgery (CS

Avast Free Antivirus prior to 19.1.2360 stores user credentials in memory upon login, which allows local users to obtain

An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6. When Default Typing is enab

An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6. When Default Typing is enab

When accessing the heron-ui webpage, people can modify the file paths outside of the current container to access any fil