2019

Dell OS10 versions prior to 10.4.2.1 contain a vulnerability caused by lack of proper input validation on the command-li

Taoensso Sente version Prior to version 1.14.0 contains a Cross Site Request Forgery (CSRF) vulnerability in WebSocket h

slixmpp version before commit 7cd73b594e8122dddf847953fcfc85ab4d316416 contains an incorrect Access Control vulnerabilit

rssh version 2.3.4 contains a CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection'

Erlang/OTP Rebar3 version 3.7.0 through 3.7.5 contains a Signing oracle vulnerability in Package registry verification t

Hex package manager hex_core version 0.3.0 and earlier contains a Signing oracle vulnerability in Package registry verif

Hex package manager version 0.14.0 through 0.18.2 contains a Signing oracle vulnerability in Package registry verificati

aioxmpp version 0.10.2 and earlier contains a Improper Handling of Structural Elements vulnerability in Stanza Parser, r

mPDF version 7.1.7 and earlier contains a CWE-502: Deserialization of Untrusted Data vulnerability in getImage() method

MapSVG MapSVG Lite version 3.2.3 contains a Cross Site Request Forgery (CSRF) vulnerability in REST endpoint /wp-admin/a

IBM Security Identity Manager 7.0.1 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML da

Session fixation exists in ZoneMinder through 1.32.3, as an attacker can fixate his own session cookies to the next logg

A Time-of-check Time-of-use (TOCTOU) Race Condition exists in ZoneMinder through 1.32.3 as a session remains active for

A CSRF check issue exists in ZoneMinder through 1.32.3 as whenever a CSRF check fails, a callback function is called dis

An issue was discovered in crop_page in PoDoFo 0.9.6. For a crafted PDF document, pPage->GetObject()->GetDictionary().Ad

Spice, versions 0.5.2 through 0.14.1, are vulnerable to an out-of-bounds read due to an off-by-one error in memslot_get_

Debian tmpreaper version 1.6.13+nmu1 has a race condition when doing a (bind) mount via rename() which could result in l

GUP (generic update process) in LightySoft LogMX before 7.4.0 does not properly verify the authenticity of updates, whic

In Poppler 0.73.0, a heap-based buffer over-read (due to an integer signedness error in the XRef::getEntry function in X

A path traversal vulnerability was found in module static-resource-server 1.7.2 that allows unauthorized read access to

A prototype pollution vulnerability was found in module mpath <0.5.1 that allows an attacker to inject arbitrary propert

A deficiency in the access control in module express-cart <=1.1.5 allows unprivileged users to add new users to the appl

A server directory traversal vulnerability was found on node module mcstatic <=0.0.20 that would allow an attack to acce

Path traversal vulnerability in http-live-simulator <1.0.7 causes unauthorized access to arbitrary files on disk by appe

Path Traversal vulnerability in Photo Station versions: 5.7.2 and earlier in QTS 4.3.4, 5.4.4 and earlier in QTS 4.3.3,

LCDS Laquis SCADA prior to version 4.1.0.4150 allows execution of script code by opening a specially crafted report form

Zen Load Balancer 3.10.1 allows remote authenticated admin users to execute arbitrary commands as root via shell metacha

Artica Proxy 3.06.200056 allows remote attackers to execute arbitrary commands as root by reading the ressources/setting

In Pylons Colander through 1.6, the URL validator allows an attacker to potentially cause an infinite loop thereby causi

An issue was discovered on D-Link DIR-823G devices with firmware through 1.02B03. A command Injection vulnerability allo

NVIDIA Tegra Gralloc module contains a vulnerability in driver in which it does not validate input parameter of the regi

The MailConnect feature on D-Link Central WiFiManager CWM-100 1.03 r0098 devices is intended to check a connection to an

The CaptivelPortal service on D-Link Central WiFiManager CWM-100 1.03 r0098 devices will load a Trojan horse "quserex.dl

An issue was discovered in rcp in NetKit through 0.17. For an rcp operation, the server chooses which files/directories

When loading a document with Apache Open Office 4.1.5 and earlier with smaller end line termination than the operating s

An issue was discovered in FileChucker 4.99e-free-e02. filechucker.cgi has a filter bypass that allows a malicious user

A bug exists in the way mod_ssl handled client renegotiations. A remote attacker could send a carefully crafted request

An exploitable out-of-bounds read vulnerability exists in the handling of certain XFA element attributes of Foxit Softwa

In Apache HTTP Server 2.4 release 2.4.37 and prior, mod_session checks the session expiry time before decoding the sessi

An issue was discovered in idreamsoft iCMS 7.0.13 on Windows. editor/editor.admincp.php allows admincp.php?app=files&do=

An issue was discovered in idreamsoft iCMS 7.0.13. editor/editor.admincp.php allows admincp.php?app=editor&do=fileManage

An issue was discovered in idreamsoft iCMS 7.0.13. admincp.php?app=apps&do=save allows directory traversal via _app=/../

In libdoc through 2019-01-28, doc2text in catdoc.c has a NULL pointer dereference.

Three type confusion vulnerabilities exist in CX-One Versions 4.50 and prior and CX-Protocol Versions 2.0 and prior when

PrinceXML, versions 10 and below, is vulnerable to XXE due to the lack of protection against external entities. If an at

An issue has been found in PowerDNS Recursor versions after 4.1.3 before 4.1.9 where Lua hooks are not properly applied

A flaw was found in the Linux kernel's handle_rx() function in the [vhost_net] driver. A malicious virtual guest, under

Adobe Acrobat and Reader versions 2018.011.20058 and earlier, 2017.011.30099 and earlier, and 2015.006.30448 and earlier

Incorrect sanitation of the 302 redirect field in HTTP transport method of apt versions 1.4.8 and earlier can lead to co

Drager Infinity Delta, Infinity Delta, all versions, Delta XL, all versions, Kappa, all version, and Infinity Explorer C