2019

cPanel before 82.0.2 allows unauthenticated file creation because Exim log parsing is mishandled (SEC-507).

cPanel before 82.0.2 has Self XSS in the cPanel and webmail master templates (SEC-506).

cPanel before 82.0.2 has stored XSS in the WHM Tomcat Manager interface (SEC-504).

libopenmpt before 0.4.3 allows a crash due to a NULL pointer dereference when doing a portamento from an OPL instrument

A CSRF vulnerability in Settings form in the Custom Simple Rss plugin 2.0.6 for WordPress allows attackers to change the

The WP Fastest Cache plugin through 0.8.9.5 for WordPress allows wpFastestCache.php and inc/cache.php Directory Traversa

edx-platform before 2017-08-03 allows attackers to trigger password-reset e-mail messages in which the reset link has an

In FreeType before 2.6.1, a buffer over-read occurs in type1/t1parse.c on function T1_Get_Private_Dict where there is no

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9.2. This occurs when Default Typ

Planon before Live Build 41 has XSS.

The Amcrest IP2M-841B V2.520.AC00.18.R, Dahua IPC-XXBXX V2.622.0000000.9.R, Dahua IPC HX5X3X and HX4X3X V2.800.0000008.0

In MatrixSSL 3.8.3 Open through 4.2.1 Open, the DTLS server mishandles incoming network messages leading to a heap-based

An issue was discovered in Veritas Resiliency Platform (VRP) before 3.4 HF1. When uploading an application bundle, a dir

An issue was discovered in Veritas Resiliency Platform (VRP) before 3.4 HF1. An arbitrary command execution vulnerabilit

An issue was discovered in Veritas Resiliency Platform (VRP) before 3.4 HF1. An arbitrary command execution vulnerabilit

An issue was discovered in Veritas Resiliency Platform (VRP) before 3.4 HF1. A persistent cross-site scripting (XSS) vul

Imgix through 2019-06-19 allows remote attackers to cause a denial of service (resource consumption) by manipulating a s

Apache VCL versions 2.1 through 2.5 do not properly validate form input when adding and removing VMs to and from hosts.

Apache VCL versions 2.1 through 2.5 do not properly validate form input when processing a submitted block allocation. Th

Apache VCL versions 2.1 through 2.5 do not properly validate cookie input when determining what node (if any) was previo

In Docker 19.03.x before 19.03.1 linked against the GNU C Library (aka glibc), code injection can occur when the nsswitc

A SQL injection vulnerability exists in the Vsourz Digital Advanced CF7 DB plugin through 1.6.1 for WordPress. Successfu

An issue was discovered in PrinterOn Central Print Services (CPS) through 4.1.4. A user without valid credentials can by

An issue was discovered in PrinterOn Central Print Services (CPS) through 4.1.4. An unauthenticated attacker can view de

One Identity Cloud Access Manager 8.1.3 does not use HTTP Strict Transport Security (HSTS), which may allow man-in-the-m

An integer overflow in NATS Server before 2.0.2 allows a remote attacker to crash the server by sending a crafted reques

See.sys, up to version 4.25, in SoftEther VPN Server versions 4.29 or older, allows a user to call an IOCTL specifying a

edx-platform before 2016-06-06 allows CSRF.

edx-platform before 2016-06-10 allows account activation with a spoofed e-mail address.

The WP Fastest Cache plugin through 0.8.9.0 for WordPress allows remote attackers to delete arbitrary files because wp_p

PDFResurrect 0.15 has a buffer overflow via a crafted PDF file because data associated with startxref and %%EOF is misha

A vulnerability in the web-based management interface of VVX, Trio, SoundStructure, SoundPoint, and SoundStation phones

HumHub Social Network Kit Enterprise v1.3.13 allows remote attackers to find the user accounts existing on any Social Ne

Dolibarr ERP/CRM 9.0.1 provides a module named website that provides for creation of public websites with a WYSIWYG edit

Dolibarr ERP/CRM 9.0.1 provides a web-based functionality that backs up the database content to a dump file. However, th

Dolibarr ERP/CRM 9.0.1 was affected by stored XSS within uploaded files. These vulnerabilities allowed the execution of

The Unity Web Player plugin before 4.6.6f2 and 5.x before 5.0.3f2 allows attackers to read messages or access online ser

edx-platform before 2015-09-17 allows XSS via a team name.

edx-platform before 2015-08-17 allows XSS in the Studio listing of courses.

edx-platform before 2015-07-20 allows code execution by privileged users because the course import endpoint mishandles .

A crafted self-referential DOS partition table will cause all Das U-Boot versions through 2019.07-rc4 to infinitely recu

Fleet before 2.1.2 allows exposure of SMTP credentials.

stacktable.js before 1.0.4 allows XSS.

Dependency-Track before 3.5.1 allows XSS.

invenio-app before 1.1.1 allows host header injection.

invenio-communities before 1.0.0a20 allows XSS.

Tridactyl before 1.16.0 allows fake key events.

invenio-records before 1.2.2 allows XSS.

Pterodactyl before 0.7.14 with 2FA allows credential sniffing.

A spoofing vulnerability exists in the way Microsoft Outlook for Android software parses specifically crafted email mess