2019

LibreOffice has a feature where documents can specify that pre-installed macros can be executed on various script events

The Airbrake Ruby notifier 4.2.3 for Airbrake mishandles the blacklist_keys configuration option and consequently may di

Sentrifugo 3.2 lacks CSRF protection. This could lead to an attacker tricking the administrator into executing arbitrary

Insufficient boundary checks when processing M_SOFx markers from JPEG headers in the GD extension could allow access to

Insufficient boundary checks when processing the JPEG APP12 block marker in the GD extension could allow access to out-o

A type confusion vulnerability in the merge_param() function of php_http_params.c in PHP's pecl-http extension 3.1.0beta

An issue was discovered in the pam_p11 component 0.2.0 and 0.3.0 for OpenSC. If a smart card creates a signature with a

An issue was discovered in Python through 2.7.16, 3.x through 3.5.7, 3.6.x through 3.6.9, and 3.7.x through 3.7.4. The e

libslirp 4.0.0, as used in QEMU 4.1.0, has a use-after-free in ip_reass in ip_input.c.

An issue was discovered in Tyto Sahi Pro 6.x through 8.0.0. TestRunner_Non_distributed (and distributed end points) does

An issue was discovered in Alfresco Community Edition versions below 5.2.6, 6.0.N and 6.1.N. The Alfresco Share applicat

A vulnerability was found in McKesson Cardiology product 13.x and 14.x. Insecure file permissions in the default install

An exploitable authentication bypass vulnerability exists in the Bluetooth Low Energy (BLE) authentication module of YI

An access vulnerability in CA Common Services DIA of CA Technologies Client Automation 14 and Workload Automation AE 11.

NVIDIA Tegra contains a vulnerability in BootRom where a user with kernel level privileges can write an arbitrary value

A flaw was found in ghostscript, versions 9.x before 9.50, in the setsystemparams procedure where it did not properly se

In Pyxis ES Versions 1.3.4 through to 1.6.1 and Pyxis Enterprise Server, with Windows Server Versions 4.4 through 4.12,

Exim before 4.92.2 allows remote attackers to execute arbitrary code as root via a trailing backslash.

In readArgumentList of zygote.java in Android 10, there is a possible command injection due to improper input validation

In binder_transaction of binder.c in the Android kernel, there is a possible out of bounds write due to an integer overf

In ippSetValueTag of ipp.c in Android 8.0, 8.1 and 9, there is a possible out of bounds read due to improper input valid

In NDEF_MsgValidate of ndef_utils in Android 7.1.1, 7.1.2, 8.0, 8.1 and 9, there is a possible out of bounds read due to

In rw_t4t_sm_read_ndef of rw_t4t in Android 7.1.1, 7.1.2, 8.0, 8.1 and 9, there is a possible out of bounds write due to

In isPreferred of HidProfile.java in Android 7.1.1, 7.1.2, 8.0, 8.1 and 9, there is a possible device type confusion due

In ihevcd_parse_buffering_period_sei of ihevcd_parse_headers.c in Android 8.0, 8.1 and 9, there is a possible out of bou

In checkAccess of SliceManagerService.java in Android 9, there is a possible permissions check bypass due to incorrect o

In SensorManager::assertStateLocked of SensorManager.cpp in Android 7.1.1, 7.1.2, 8.0, 8.1, and 9, there is a possible u

In ComposeActivityEmailExternal of ComposeActivityEmailExternal.java in Android 7.1.1, 7.1.2, 8.0, 8.1 and 9, there is a

In execTransact of Binder.java in Android 7.1.1, 7.1.2, 8.0, 8.1, and 9, there is a possible local execution of arbitrar

In GateKeeper::MintAuthToken of gatekeeper.cpp in Android 7.1.1, 7.1.2, 8.0, 8.1 and 9, there is possible memory corrupt

In ihevcd_ref_list of ihevcd_ref_list.c in Android 10, there is a possible out of bounds write due to a missing bounds c

In Google Assistant in Android 9, there is a possible permissions bypass that allows the Assistant to take a screenshot

An issue was discovered in Alfresco Community Edition 5.2 201707. By leveraging multiple components in the Alfresco Soft

An issue was discovered in Alfresco Community Edition versions 6.0 and lower. An unauthenticated, remote attacker could

FusionPBX 4.4.8 allows an attacker to execute arbitrary system commands by submitting a malicious command to the service

The master-password feature in the ES File Explorer File Manager application 4.2.0.1.3 for Android can be bypassed via a

In Counter-Strike: Global Offensive before 8/29/2019, community game servers can display unsafe HTML in a disconnection

JetBrains TeamCity 2019.1 and 2019.1.1 allows cross-site scripting (XSS), potentially making it possible to send an arbi

The ContentProvider in the Canon PRINT jp.co.canon.bsd.ad.pixmaprint 2.5.5 application for Android does not properly res

In all versions prior to version 3.9.6 for eclipse-wtp, all versions prior to version 9.4.4 for eclipse-cdt, and all ver

An issue was discovered in Total.js CMS 12.0.0. A low privilege user can perform a simple transformation of a cookie to

An issue was discovered in Total.js CMS 12.0.0. An authenticated user with the widgets privilege can gain achieve Remote

An issue was discovered in Total.js CMS 12.0.0. An authenticated user with limited privileges can get access to a resour

An issue was discovered in Total.js CMS 12.0.0. An authenticated user with the Pages privilege can conduct a path traver

In Knowage through 6.1.1, an unauthenticated user can enumerated valid usernames via the ChangePwdServlet page.

In Knowage through 6.1.1, an authenticated user that accesses the users page will obtain all user password hashes.

A SQL injection vulnerability in IntraMaps MapControl 8 allows attackers to execute arbitrary SQL commands via the /Appl

In Knowage through 6.1.1, an unauthenticated user can bypass access controls and access the entire application.

The Rich Text Formatter (Redactor) extension through v1.1.1 for Symphony CMS has an Unauthenticated arbitrary file uploa

An exploitable SQL injection vulnerability exists in the unauthenticated portion of eFront LMS, versions v5.2.12 and ear