2019

Podcast Generator 2.7 has stored cross-site scripting (XSS) via the URL addcategory parameter.

The function hso_get_config_data in drivers/net/usb/hso.c in the Linux kernel through 4.19.8 reads if_num from the USB d

SolarWinds Serv-U FTP Server 15.1.6.25 has reflected cross-site scripting (XSS) in the Web management interface via URL

The IBM Power 9 OP910, OP920, and FW910 boot firmware's bootloader is responsible for loading and validating the initial

Microweber 1.0.8 has reflected cross-site scripting (XSS) vulnerabilities.

An issue was discovered in Qt 5.11. A malformed PPM image causes a division by zero and a crash in qppmhandler.cpp.

HMS Industrial Networks Netbiter WS100 3.30.5 devices and previous have reflected XSS in the login form.

An issue was discovered on Systrome ISG-600C, ISG-600H, and ISG-800W 1.1-R2.1_TRUNK-20180914.bin devices. There is CSRF

wg7.php in Webgalamb 7.0 lacks security measures to prevent CSRF attacks, as demonstrated by wg7.php?options=1 to change

wg7.php in Webgalamb 7.0 makes opportunistic calls to htmlspecialchars() instead of using a templating engine with prope

The Simplenia Pages plugin 2.6.0 for Atlassian Bitbucket Server has XSS.

Webmin 1.890 has XSS via /config.cgi?webmin, the /shell/index.cgi history parameter, /shell/index.cgi?stripped=1, or the

A stored cross-site scripting (XSS) issue was discovered in ControlByWeb X-320M-I Web-Enabled Instrumentation-Grade Data

A Denial of Service (DOS) issue was discovered in ControlByWeb X-320M-I Web-Enabled Instrumentation-Grade Data Acquisiti

In Qemu 3.0.0, lsi_do_msgin in hw/scsi/lsi53c895a.c allows out-of-bounds access by triggering an invalid msg_len value.

internal/advanced_comment_system/index.php and internal/advanced_comment_system/admin.php in Advanced Comment System, ve

SaltOS 3.1 r8126 contains a database download vulnerability.

IBM WebSphere MQ 9.0.2, 9.0.3, 9.0.4, 9.0.5, 9.1.0.0, and 9.1.0.1 console is vulnerable to cross-site scripting. This vu

LayerBB 1.1.1 allows XSS via the titles of conversations (PMs).

LayerBB before 1.1.3 allows CSRF for adding a user via admin/new_user.php, deleting a user via admin/members.php/delete_

The Receptionist for iPad could allow a local attacker to obtain sensitive information, caused by an error in the contac

Lobby Track Desktop could allow a local attacker to obtain sensitive information, caused by an error in Sample Database.

Lobby Track Desktop could allow a local attacker to obtain sensitive information, caused by an error in Reports while in

PrinterOn Enterprise 4.1.4 suffers from multiple authenticated stored XSS vulnerabilities via the (1) "Machine Host Name

A vulnerability has been identified in Firmware variant IEC 61850 for EN100 Ethernet module (All versions < V4.35), Firm

COYO 9.0.8, 10.0.11 and 12.0.4 has cross-site scripting (XSS) via URLs used by "iFrame" widgets.

In the Ban List plugin 1.0 for MyBB, any forum user with mod privileges can ban users and input an XSS payload into the

DNN (formerly DotNetNuke) 9.1.1 allows cross-site scripting (XSS) via XML.

OX App Suite 7.8.4 and earlier allows XSS. Internal reference: 58742 (Bug ID)

OX App Suite 7.8.4 and earlier allows SSRF.

An issue was discovered in the Bose Soundtouch app 18.1.4 for iOS. There is no frontend input validation of the device n

AudioCodes IP phone 420HD devices using firmware version 2.2.12.126 allow XSS.

It was found that dropbear before version 2013.59 with GSSAPI leaks whether given username is valid or invalid. When an

IBM InfoSphere Streams 4.2.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt

In PCRE 8.41, after compiling, a pcretest load test PoC produces a crash overflow in the function match() in pcre_exec.c

Moxa G3100V2 Series, editions prior to Version 2.8, and OnCell G3111/G3151/G3211/G3251 Series, editions prior to Version

An unquoted search path vulnerability was identified in Lenovo Dynamic Power Reduction Utility prior to version 2.2.2.0

Phamm (aka PHP LDAP Virtual Hosting Manager) 0.6.8 allows XSS via the login page (the /public/main.php action parameter)

CircuitWerkes Sicon-8, a hardware device used for managing electrical devices, ships with a web-based front-end controll

In yast2-printer up to and including version 4.0.2 the SMB printer settings don't escape characters in passwords properl

The Netdata web application through 1.13.0 allows remote attackers to inject their own malicious HTML code into an impor

Cobham Satcom Sailor 800 and 900 devices contained persistent XSS, which required administrative access to exploit. The

Cobham Satcom Sailor 250 and 500 devices before 1.25 contained persistent XSS, which could be exploited by an unauthenti

IBM Rational Team Concert 5.0 through 6.0.6 is vulnerable to cross-site scripting. This vulnerability allows users to em

IBM Rational Team Concert 5.0 through 6.0.6 is vulnerable to cross-site scripting. This vulnerability allows users to em

IBM Rational Team Concert 5.0 through 6.0.6 is vulnerable to cross-site scripting. This vulnerability allows users to em

IBM Jazz Foundation (IBM Rational Engineering Lifecycle Manager 5.0 through 6.0.6) is vulnerable to cross-site scripting

IBM Rational Engineering Lifecycle Manager 5.0 through 6.0.6 could allow a malicious user to be allowed to view any view

IBM Jazz Foundation (IBM Rational Engineering Lifecycle Manager 5.0 through 6.0.6) is vulnerable to cross-site scripting

IBM Rational Engineering Lifecycle Manager 5.0 through 6.0.6 is vulnerable to cross-site scripting. This vulnerability a