2019

An information disclosure vulnerability exists when the win32k component improperly provides kernel information, aka 'Wi

An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka 'Window

An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its m

An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its m

An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its m

An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its m

An information disclosure vulnerability exists when the Human Interface Devices (HID) component improperly handles objec

An information disclosure vulnerability exists when the Human Interface Devices (HID) component improperly handles objec

A security feature bypass vulnerability exists when Microsoft Office does not validate URLs.An attacker could send a vic

In the Linux kernel before 4.20.14, expand_downwards in mm/mmap.c lacks a check for the mmap minimum address, which make

The Blog2Social plugin before 5.0.3 for WordPress allows wp-admin/admin.php?page=blog2social-ship XSS.

The Quiz And Survey Master plugin 6.0.4 for WordPress allows wp-admin/admin.php?page=mlw_quiz_results quiz_id XSS.

Moxa IKS and EDS fails to properly validate user input, giving unauthenticated and authenticated attackers the ability t

Moxa IKS and EDS allow remote authenticated users to cause a denial of service via a specially crafted packet, which may

IBM Sterling B2B Integrator 5.2.0.1 through 6.0.0.0 Standard Edition could allow highly sensitive information to be tran

IBM Sterling B2B Integrator 5.2.0.1 through 6.0.0.0 is vulnerable to cross-site scripting. This vulnerability allows use

IBM Sterling B2B Integrator 5.2.0.1 through 6.0.0.0 is vulnerable to cross-site scripting. This vulnerability allows use

IBM Sterling B2B Integrator 5.2.0.1 through 6.0.0.0 is vulnerable to cross-site scripting. This vulnerability allows use

IBM Cloud Private 3.1.1 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By per

IBM Cloud Private 3.1.1 could alllow a local user with administrator privileges to intercept highly sensitive unencrypte

IBM Cloud Private 3.1.1 could alllow a local user with administrator privileges to intercept highly sensitive unencrypte

IBM InfoSphere Information Server 11.3, 11.5, and 11.7 could allow an attacker to change one of the settings related to

An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 12.1.3, macOS Mojave 10.14

A logic issue was addressed with improved validation. This issue is fixed in iOS 12.1.3, tvOS 12.1.2, Safari 12.0.3, iTu

A cross-site scripting issue existed in Safari. This issue was addressed with improved URL validation. This issue is fix

An out-of-bounds read was addressed with improved input validation. This issue is fixed in macOS Mojave 10.14.3. An appl

An out-of-bounds read issue existed that led to the disclosure of kernel memory. This was addressed with improved input

A memory initialization issue was addressed with improved memory handling. This issue is fixed in iOS 12.1.3, macOS Moja

If the attacker manages to create files in the directory used to collect log files in supportutils before version 3.1-5.

If supportutils before version 3.1-5.7.1 is run with -v to perform rpm verification and the attacker manages to manipula

UltraVNC revision 1205 has stack-based buffer overflow vulnerability in VNC client code inside ShowConnInfo routine, whi

An issue was discovered in YzmCMS 5.2.0. It has XSS via the bottom text field to the admin/system_manage/save.html URI,

NetApp SnapCenter Server prior to 4.1 does not set the secure flag for a sensitive cookie in an HTTPS session which can

NetApp SnapCenter Server prior to 4.0 is susceptible to cross site scripting vulnerability that could allow a privileged

The "Forminator Contact Form, Poll & Quiz Builder" plugin before 1.6 for WordPress has SQL Injection via the wp-admin/ad

The "Forminator Contact Form, Poll & Quiz Builder" plugin before 1.6 for WordPress has XSS via a custom input field of a

An issue was discovered in DOYO (aka doyocms) 2.3 through 2015-05-06. It has admin.php XSS.

DhCms through 2017-09-18 has admin.php?r=admin/Index/index XSS.

Multiple stored XSS in Vanilla Forums before 2.5 allow remote attackers to inject arbitrary JavaScript code into any mes

Stored XSS in Invision Power Board versions 3.3.1 - 3.4.8 leads to Remote Code Execution.

In Storage Performance Development Kit (SPDK) before 19.01, a malicious vhost client (i.e., virtual machine) could caref

In MISP 2.4.102, an authenticated user can view sightings that they should not be eligible for. Exploiting this requires

Delta Industrial Automation CNCSoft, CNCSoft ScreenEditor Version 1.00.84 and prior. An out-of-bounds read vulnerability

A same-origin policy violation allowing the theft of cross-origin URL entries when using a meta http-equiv="refresh" on

Limitations on the URIs allowed to WebExtensions by the browser.windows.create API can be bypassed when a pipe in the UR

WebExtension content scripts can be loaded into about: pages in some circumstances, in violation of the permissions gran

A same-origin policy violation allowing the theft of cross-origin URL entries when using the Javascript location propert

If a site is loaded over a HTTPS connection but loads a favicon resource over HTTP, the mixed content warning is not dis

The internal WebBrowserPersist code does not use correct origin context for a resource being saved. This manifests when

In private browsing mode on Firefox for Android, favicons are cached in the cache/icons folder as they are in non-privat