2019

When a new protocol handler is registered, the API accepts a title argument which can be used to mislead users about whi

By using the reflected URL in some special resource URIs, such as chrome:, it is possible to inject stylesheets and bypa

A vulnerability where a WebExtension can run content scripts in disallowed contexts following navigation or other events

The permissions on /proc/iomem were world-readable. This could lead to local information disclosure with no additional e

In event_handler of keymaster_app.c, there is possible resource exhaustion due to a table being lost on reboot. This cou

In avrc_pars_browse_rsp of avrc_pars_ct.cc, there is a possible out of bounds read due to a missing bounds check. This c

In ComposeActivityEmail of ComposeActivityEmail.java, there is a possible way to silently attach files to an email due t

Buffer Access with Incorrect Length Value in McAfee Agent (MA) 5.x allows remote unauthenticated users to potentially ca

An issue was discovered in baigo CMS 2.1.1. There is a persistent XSS vulnerability that allows remote attackers to inje

In Wireshark 2.4.0 to 2.4.12 and 2.6.0 to 2.6.6, the ASN.1 BER and related dissectors could crash. This was addressed in

NVIDIA Windows GPU Display Driver contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEs

If an application encounters a fatal protocol error and then calls SSL_shutdown() twice (once to send a close_notify, an

IBM BigFix Platform 9.2 and 9.5 could allow an attacker to query the relay remotely and gather information about the upd

IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products versions 7.5 through 8.2 c

In Apache Airflow before 1.10.2, a malicious admin user could edit the state of objects in the Airflow metadata database

There is a reachable assertion abort in the function write_long_string_missing_values() in data/sys-file-writer.c in lib

Maccms 8.0 allows XSS via the inc/config/cache.php t_key parameter because template/paody/html/vod_type.html mishandles

An issue was discovered in PoDoFo 0.9.6. There is an attempted excessive memory allocation in PoDoFo::podofo_calloc in b

Avaya one-X Communicator uses weak cryptographic algorithms in the client authentication component that could allow a lo

The ETSI Enterprise Transport Security (ETS, formerly known as eTLS) protocol does not provide per-session forward secre

Cross-site scripting (XSS) vulnerability in F5 BIG-IP Access Policy Manager (APM) 11.5.x and 11.6.x Admin Web UI.

On BIG-IP 11.5.1-11.6.3.2, 12.1.3.4-12.1.3.7, 13.0.0 HF1-13.1.1.1, and 14.0.0-14.0.0.2, Multi-Path TCP (MPTCP) does not

On BIG-IP 11.5.1-11.5.4, 11.6.1, and 12.1.0, a virtual server configured with a Client SSL profile may be vulnerable to

WooCommerce before 3.5.5 allows XSS via a Photoswipe caption.

Arbitrary write issue can occur when user provides kernel address in compat mode in Snapdragon Auto, Snapdragon Connecti

Exceeding the limit of usage entries are not tracked and the information will be lost causing the content to lose contin

Improper input validation might result in incorrect app id returned to the caller Instead of returning failure in Snapdr

Bytes can be written to fuses from Secure region which can be read later by HLOS in Snapdragon Auto, Snapdragon Compute,

Usage of non-time-constant comparison functions can lead to information leakage through side channel analysis in Snapdra

Use of non-time constant memcmp function creates side channel that leaks information and leads to cryptographic issues i

An issue was discovered in Hsycms V1.1. There is an XSS vulnerability via the name field to the /book page.

An issue was discovered in b3log Symphony (aka Sym) before v3.4.7. XSS exists via the userIntro and userNickname fields

tecrail Responsive FileManager 9.13.4 allows XSS via a media file upload with an XSS payload in the name, because of mis

The msm gpu driver for custom Linux kernels on the Xiaomi perseus-p-oss MIX 3 device through 2018-11-26 has an integer o

The msm gpu driver for custom Linux kernels on the Xiaomi perseus-p-oss MIX 3 device through 2018-11-26 has an integer o

drivers/leds/leds-aw2023.c in the led driver for custom Linux kernels on the Xiaomi Redmi 6pro daisy-o-oss phone has sev

The ft5x46 touchscreen driver for custom Linux kernels on the Xiaomi perseus-p-oss MIX 3 device through 2018-11-26 has a

XSS exists in WUZHI CMS 4.1.0 via index.php?m=content&f=postinfo&v=listing&set_iframe=[XSS] to coreframe/app/content/pos

XSS exists in WUZHI CMS 4.1.0 via index.php?m=message&f=message&v=add&username=[XSS] to coreframe/app/message/message.ph

XSS exists in WUZHI CMS 4.1.0 via index.php?m=core&f=map&v=baidumap&x=[XSS]&y=[XSS] to coreframe/app/core/map.php.

XSS exists in WUZHI CMS 4.1.0 via index.php?m=attachment&f=imagecut&v=init&imgurl=[XSS] to coreframe/app/attachment/imag

zzcms 2019 has XSS via an arbitrary user/ask.php?do=modify parameter because inc/stopsqlin.php does not block a mixed-ca

An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.32. I

An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.32. I

An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.32. I

An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.32. I

An issue was discovered in GNU libiberty, as distributed in GNU Binutils 2.32. It is a stack consumption issue in d_coun

PHP Scripts Mall PHP Appointment Booking Script 3.0.3 allows HTML injection in a user profile.

PHP Scripts Mall Custom T-Shirt Ecommerce Script 3.1.1 allows parameter tampering of the payment amount.

PHP Scripts Mall Cab Booking Script 1.0.3 allows Directory Traversal into the parent directory of a jpg or png file.