2019

In the PowerSchool Mobile application 1.1.8 for Android, the username and password are stored in the log during authenti

In the Seesaw Parent and Family application 6.2.5 for Android, the username and password are stored in the log during au

In the Orbitz application 19.31.1 for Android, the username and password are stored in the log during authentication, an

In the DoorDash application through 11.5.2 for Android, the username and password are stored in the log during authentic

safer-eval before 1.3.2 are vulnerable to Arbitrary Code Execution. A payload using constructor properties can escape th

safer-eval before 1.3.4 are vulnerable to Arbitrary Code Execution. A payload using constructor properties can escape th

Intelbras IWR 1000N 1.6.4 devices allow disclosure of the administrator login name and password because v1/system/user i

Connect2id Nimbus JOSE+JWT before v7.9 can throw various uncaught exceptions while parsing a JWT, which could result in

AutoPi Wi-Fi/NB and 4G/LTE devices before 2019-10-15 allows an attacker to perform a brute-force attack or dictionary at

Certain D-Link products are affected by: Buffer Overflow. This affects DIR-880L 1.08B04 and DIR-895 L/R 1.13b03. The imp

Directory Traversal in the function http_verify in nostromo nhttpd through 1.9.6 allows an attacker to achieve remote co

tonyy dormsystem through 1.3 allows SQL Injection in admin.php.

An issue was discovered in the Popup Maker plugin before 1.8.13 for WordPress. An unauthenticated attacker can partially

An issue was discovered in MetInfo v7.0.0 beta. There is SQL Injection via the admin/?n=tags&c=index&a=doSaveTags URI.

An issue was discovered in idreamsoft iCMS v7.0.14. There is a spider_project.admincp.php SQL injection vulnerability in

parserIfLabel in inc/zzz_template.php in ZZZCMS zzzphp 1.7.3 allows remote attackers to execute arbitrary code because t

GDAL through 3.0.1 has a poolDestroy double free in OGRExpatRealloc in ogr/ogr_expat.cpp when the 10MB threshold is exce

libaspell.a in GNU Aspell before 0.60.8 has a stack-based buffer over-read in acommon::unescape in common/getdata.cpp vi

FFmpeg before 4.2 has a heap-based buffer overflow in vqa_decode_chunk because of an out-of-array access in vqa_decode_i

In FFmpeg before 4.2, avcodec_open2 in libavcodec/utils.c allows a NULL pointer dereference and possibly unspecified oth

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is ena

D-Link DIR-846 devices with firmware 100A35 allow remote attackers to execute arbitrary OS commands as root by leveragin

D-Link DIR-846 devices with firmware 100A35 allow remote attackers to execute arbitrary OS commands as root by leveragin

On D-Link DIR-859 A3-1.06 and DIR-850 A1.13 devices, /etc/services/DEVICE.TIME.php allows command injection via the $SER

There are some web interfaces without authentication requirements on D-Link DIR-868L B1-2.03 and DIR-817LW A1-1.04 route

Boa through 0.94.14rc21 allows remote attackers to trigger an out-of-memory (OOM) condition because malloc is mishandled

A shell injection vulnerability on the Sophos Cyberoam firewall appliance with CyberoamOS before 10.6.6 MR-6 allows remo

A Cascading Style Sheets (CSS) injection vulnerability in Swagger UI before 3.23.11 allows attackers to use the Relative

The root password of the Cobham EXPLORER 710 is the same for all versions of firmware up to and including v1.08. This co

The web application portal of the Cobham EXPLORER 710, firmware version 1.07, allows unauthenticated access to port 5454

An issue was discovered in Softing uaGate SI 1.60.01. A maintenance script, that is executable via sudo, is vulnerable t

Libntlm through 1.5 relies on a fixed buffer size for tSmbNtlmAuthRequest, tSmbNtlmAuthChallenge, and tSmbNtlmAuthRespon

The ACF-Frontend-Display plugin through 2015-07-03 for WordPress has arbitrary file upload via an action=upload request

The dzs-zoomsounds plugin through 2.0 for WordPress has admin/upload.php arbitrary file upload.

The broken-link-manager plugin before 0.5.0 for WordPress has wpslDelURL or wpslEditURL SQL injection via the url parame

The wti-like-post plugin before 1.4.3 for WordPress has WtiLikePostProcessVote SQL injection via the HTTP_CLIENT_IP, HTT

NetSarang XFTP Client 6.0149 and earlier version contains a buffer overflow vulnerability caused by improper boundary ch

An remote code execution vulnerability exists when Azure App Service/ Antares on Azure Stack fails to check the length o

An elevation of privilege vulnerability exists when Microsoft IIS Server fails to check the length of a buffer prior to

Adhouma CMS through 2019-10-09 has SQL Injection via the post.php p_id parameter.

The new-contact-form-widget (aka Contact Form Widget - Contact Query, Form Maker) plugin 1.0.9 for WordPress has SQL Inj

Automattic Mongoose through 5.7.4 allows attackers to bypass access control (in some applications) because any query obj

A Structured Exception Handler (SEH) based buffer overflow in File Sharing Wizard 1.5.0 26-8-2008 allows remote unauthen

A security vulnerability exists in Zingbox Inspector version 1.293 and earlier, that allows for remote code execution if

A security vulnerability exists in the Zingbox Inspector versions 1.293 and earlier, that could allow an attacker to sup

A security vulnerability exists in the Zingbox Inspector versions 1.294 and earlier, that could allow an attacker to sup

A vulnerability exists in the way that iTerm2 integrates with tmux's control mode, which may allow an attacker to execut

The Shack Forms Pro extension before 4.0.32 for Joomla! allows path traversal via a file attachment.

The netaddr gem before 2.0.4 for Ruby has misconfigured file permissions, such that a gem install may result in 0777 per

Kramer VIAware 2.5.0719.1034 has Incorrect Access Control.