2019

A denial of service vulnerability exists when ASP.NET Core improperly handles web requests, aka "ASP.NET Core Denial of

A remote code execution vulnerability exists in Visual Studio when the C++ compiler improperly handles specific combinat

An information disclosure vulnerability exists in .NET Framework and .NET Core which allows bypassing Cross-origin Resou

An elevation of privilege vulnerability exists when Windows improperly handles authentication requests, aka "Microsoft W

A remote code execution vulnerability exists in the way that the MSHTML engine inproperly validates input, aka "MSHTML E

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Mi

A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory,

Under certain conditions SAP Landscape Management (VCM 3.0) allows an attacker to access information which would otherwi

Under some circumstances, masterdata maintenance in SAP BW/4HANA (fixed in DW4CORE version 1.0 (SP08)) does not perform

SAP Work and Inventory Manager (Agentry_SDK , before 7.0, 7.1) allows an attacker to prevent legitimate users from acces

SAP Business Objects Mobile for Android (before 6.3.5) application allows an attacker to provide malicious input in the

A security weakness in SAP Financial Consolidation Cube Designer (BOBJ_EADES fixed in versions 8.0, 10.1) may allow an a

SAP Enterprise Financial Services (fixed in SAPSCORE 1.13, 1.14, 1.15; S4CORE 1.01, 1.02, 1.03; EA-FINSERV 1.10, 2.0, 5.

EARCLINK ESPCMS-P8 has SQL injection in the install_pack/index.php?ac=Member&at=verifyAccount verify_key parameter. inst

Apache Thrift Java client library versions 0.5.0 through 0.11.0 can bypass SASL negotiation isComplete validation in the

OnCommand Unified Manager for 7-Mode (core package) prior to 5.2.4 uses cookies that lack the secure attribute in certai

Dokan, versions between 1.0.0.5000 and 1.2.0.1000, are vulnerable to a stack-based buffer overflow in the dokan1.sys dri

Vtiger CRM 7.1.0 before Hotfix2 allows uploading files with the extension "php3" in the logo upload field, if the upload

An issue was discovered in Foxit Reader and PhantomPDF before 9.4 on Windows. It is an Out-of-Bounds Read Information Di

The Stripe API v1 allows remote attackers to bypass intended access restrictions by replaying api.stripe.com /v1/tokens

Sqla_yaml_fixtures 0.9.1 allows local users to execute arbitrary python code via the fixture_text argument in sqla_yaml_

SQL injection vulnerability in user/card.php in Dolibarr version 8.0.2 allows remote authenticated users to execute arbi

An error-based SQL injection vulnerability in product/card.php in Dolibarr version 8.0.2 allows remote authenticated use

A use-after-free issue was found in the way the Linux kernel's KVM hypervisor processed posted interrupts when nested(=1

Buffer overflow in AES-CCM and AES-GCM encryption via initialization vector in snapdragon automobile, snapdragon mobile

Possible Buffer overflow when transmitting an RTP packet in snapdragon automobile and snapdragon wear in versions MDM961

Use after free in QSH client rule processing in snapdragon mobile and snapdragon wear in versions MDM9206, MDM9607, MDM9

QSEE unload attempt on a 3rd party TEE without previously loading results in a data abort in snapdragon automobile and s

When a 3rd party TEE has been loaded it is possible for the non-secure world to create a secure monitor call which will

OpenRefine through 3.1 allows arbitrary file write because Directory Traversal can occur during the import of a crafted

The Code42 app before 6.8.4, as used in Code42 for Enterprise, on Linux installs with overly permissive permissions on t

Kubernetes Dashboard before 1.10.1 allows attackers to bypass authentication and use Dashboard's Service Account for rea

ExifTool 8.32 allows local users to gain privileges by creating a %TEMP%\par-%username%\cache-exiftool-8.32 folder with

A file-upload vulnerability exists in Rukovoditel 2.3.1. index.php?module=configuration/save allows the user to upload a

An issue was discovered in ExpressVPN on Windows. The Xvpnd.exe process (which runs as a service with SYSTEM privileges)

In libsixel v1.8.2, there is a heap-based buffer over-read in the function load_jpeg() in the file loader.c, as demonstr

The server in Core FTP 2.0 build 653 on 32-bit platforms allows remote attackers to cause a denial of service (daemon cr

A vulnerability in the ExtCommon.dll user extension module version 9.2, 9.2.1, 9.2.2 of Xplatform ActiveX could allow at

The demangle_template function in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.31.1, has a memory leak

Prior to CouchDB version 2.3.0, CouchDB allowed for runtime-configuration of key components of the database. In some cas

aria2c in aria2 1.33.1, when --log is used, can store an HTTP Basic Authentication username and password in a file, whic

Simply-Blog through 2019-01-01 has SQL Injection via the admin/deleteCategories.php delete parameter.