2019

Improper authentication is possible in Apache Traffic Control versions 3.0.0 and 3.0.1 if LDAP is enabled for login in t

In ATutor 2.2.4, an unauthenticated attacker can change the application settings and force it to use his crafted databas

An issue was discovered in LibreNMS through 1.47. A number of scripts import the Authentication libraries, but do not en

An issue was discovered in LibreNMS through 1.47. The scripts that handle the graphing options (html/includes/graphs/com

The Swape theme before 1.2.1 for WordPress has incorrect access control, as demonstrated by allowing new administrator a

An issue was discovered in the blake2 crate before 0.8.1 for Rust. The BLAKE2b and BLAKE2s algorithms, when used with HM

An issue was discovered in the renderdoc crate before 0.5.0 for Rust. Multiple exposed methods take self by immutable re

An issue was discovered in the chttp crate before 0.1.3 for Rust. There is a use-after-free during buffer conversion.

An issue was discovered in the compact_arena crate before 0.4.0 for Rust. Generativity is mishandled, leading to an out-

An issue was discovered in the image crate before 0.21.3 for Rust, affecting the HDR image format decoder. Vec::set_len

In Jobberbase 2.0, the parameter category is not sanitized in public/page_subscribe.php, leading to /subscribe SQL injec

In YouPHPTube 7.4, the file install/checkConfiguration.php has no access control, which leads to everyone being able to

SQL injection in the photo-gallery (10Web Photo Gallery) plugin before 1.5.35 for WordPress exists via the admin/control

Silver Peak EdgeConnect SD-WAN before 8.1.7.x has an SNMP service with a public value for rocommunity and trapcommunity.

Symonics libmysofa 0.7 has an invalid write in readOHDRHeaderMessageDataLayout in hdf/dataobject.c.

Symonics libmysofa 0.7 has a NULL pointer dereference in getHrtf in hrtf/reader.c.

An issue was discovered in D-Link DIR-806 devices. There is a stack-based buffer overflow in function hnap_main at /htdo

An issue was discovered in D-Link DIR-806 devices. There is a command injection in function hnap_main, which calls syste

LibreOffice is typically bundled with LibreLogo, a programmable turtle vector graphics script, which can execute arbitra

The Airbrake Ruby notifier 4.2.3 for Airbrake mishandles the blacklist_keys configuration option and consequently may di

Insufficient boundary checks when processing M_SOFx markers from JPEG headers in the GD extension could allow access to

Insufficient boundary checks when processing the JPEG APP12 block marker in the GD extension could allow access to out-o

A type confusion vulnerability in the merge_param() function of php_http_params.c in PHP's pecl-http extension 3.1.0beta

An issue was discovered in Tyto Sahi Pro 6.x through 8.0.0. TestRunner_Non_distributed (and distributed end points) does

An access vulnerability in CA Common Services DIA of CA Technologies Client Automation 14 and Workload Automation AE 11.

A flaw was found in ghostscript, versions 9.x before 9.50, in the setsystemparams procedure where it did not properly se

Exim before 4.92.2 allows remote attackers to execute arbitrary code as root via a trailing backslash.

An issue was discovered in Alfresco Community Edition versions 6.0 and lower. An unauthenticated, remote attacker could

An issue was discovered in Total.js CMS 12.0.0. An authenticated user with the widgets privilege can gain achieve Remote

In Knowage through 6.1.1, an unauthenticated user can bypass access controls and access the entire application.

The Rich Text Formatter (Redactor) extension through v1.1.1 for Symphony CMS has an Unauthenticated arbitrary file uploa

Controller/ListController.php in Eventum 3.5.0 is vulnerable to Deserialization of Untrusted Data. Fixed in version 3.5.

Pengutronix barebox through 2019.08.1 has a remote buffer overflow in nfs_readlink_req in fs/nfs.c because a length fiel

Pengutronix barebox through 2019.08.1 has a remote buffer overflow in nfs_readlink_reply in net/nfs.c because a length f

A vulnerability in the “plug-and-play” services component of Cisco Industrial Network Director (IND) could a

An issue was discovered in the Linux kernel before 5.2.3. Out of bounds access exists in the functions ath6kl_wmi_pstrea

Similar to the issue identified in CVE-2018-12120, on versions 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.0.0-13.1.2, and 12.1

eGain Chat 15.0.3 allows unrestricted file upload.

AsusPTPFilter.sys on Asus Precision TouchPad 11.0.0.25 hardware has a Pool Overflow associated with the \\.\AsusTP devic

The LoginPress plugin before 1.1.4 for WordPress has SQL injection via an import of settings.

The wps-hide-login plugin before 1.5.3 for WordPress has a protection bypass via wp-login.php in the Referer field.

The wps-hide-login plugin before 1.5.3 for WordPress has an action=rp&key&login protection bypass.

The wps-hide-login plugin before 1.5.3 for WordPress has an adminhash protection bypass.

The wps-hide-login plugin before 1.5.3 for WordPress has an action=confirmaction protection bypass.

The wps-child-theme-generator plugin before 1.2 for WordPress has classes/helpers.php directory traversal.

The nd-restaurant-reservations plugin before 1.5 for WordPress has no requirement for nd_rst_import_settings_php_functio

In FreeBSD 12.0-STABLE before r350648, 12.0-RELEASE before 12.0-RELEASE-p9, 11.3-STABLE before r350650, 11.3-RELEASE bef

CommScope ARRIS TR4400 devices with firmware through A1.00.004-180301 are vulnerable to an authentication bypass to the

CommScope ARRIS TR4400 devices with firmware through A1.00.004-180301 are vulnerable to an authentication bypass to the

Irssi 1.2.x before 1.2.2 has a use-after-free if the IRC server sends a double CAP.