2019

Gitea 1.7.2, 1.7.3 is affected by: Cross Site Scripting (XSS). The impact is: execute JavaScript in victim's browser, wh

Insufficient validation of environment variables in the telnet client supplied in Junos OS can lead to stack-based buffe

The srxpfe process may crash on SRX Series services gateways when the UTM module processes a specific fragmented HTTP pa

On Junos devices with the BGP graceful restart helper mode enabled or the BGP graceful restart mechanism enabled, a cert

On EX4300 Series switches with TCAM optimization enabled, incoming multicast traffic matches an implicit loopback filter

A vulnerability in the pfe-chassisd Chassis Manager (CMLC) daemon of Juniper Networks Junos OS allows an attacker to cau

IBM Security Identity Manager 7.0.1 discloses sensitive information to unauthorized users. The information can be used t

The Windows Guest Tools in Citrix XenServer 6.2 SP1 and earlier allows remote attackers to cause a denial of service (gu

Any URLs with download_attachment.php under templates or home folders can allow arbitrary files downloaded without login

Alarm.com ADC-V522IR 0100b9 devices have Incorrect Access Control, a different issue than CVE-2018-19588. This occurs be

A SQL injection vulnerability in the reporting component of Avaya Control Manager could allow an unauthenticated attacke

A reflected XSS vulnerability exists in authorization flow of OpenShift Container Platform versions: openshift-online-3,

Multiple stored Cross-site scripting (XSS) issues in the admin panel and survey system in REDCap 8 before 8.10.20 and 9

An issue was discovered in Squid 2.x through 2.7.STABLE9, 3.x through 3.5.28, and 4.x through 4.7. When Squid is configu

An issue was discovered in Squid 4.0.23 through 4.7. When checking Basic Authentication with HttpHeader::getAuth, Squid

An issue was discovered in Squid 3.3.9 through 3.5.28 and 4.x through 4.7. When Squid is configured to use Digest authen

The SUNNET WMPro v5.0 and v5.1 for eLearning system has OS Command Injection via "/teach/course/doajaxfileupload.php". T

Sensitive passwords used in deployment and configuration of oVirt Metrics, all versions. were found to be insufficiently

A stack-buffer overflow vulnerability was found in the Redis hyperloglog data structure versions 3.x before 3.2.13, 4.x

A heap-buffer overflow vulnerability was found in the Redis hyperloglog data structure versions 3.x before 3.2.13, 4.x b

A flaw was found in the yaml.load() function in the osbs-client versions since 0.46 before 0.56.1. Insecure use of the y

Alarm.com ADC-V522IR 0100b9 devices have Incorrect Access Control.

Intersystems Cache 2017.2.2.865.0 allows XXE.

Intersystems Cache 2017.2.2.865.0 has Incorrect Access Control.

Intersystems Cache 2017.2.2.865.0 allows XSS.

XSS exists in Ping Identity Agentless Integration Kit before 1.5.

Cloud Foundry UAA version prior to 73.3.0, contain endpoints that contains improper escaping. An authenticated malicious

An issue was discovered in the Core Server in Ivanti Endpoint Manager (EPM) 2017.3 before SU7 and 2018.x before 2018.3 S

D-Link DIR-655 C devices before 3.02B05 BETA03 allow CSRF for the entire management console.

D-Link DIR-655 C devices before 3.02B05 BETA03 allow XSS, as demonstrated by the /www/ping_response.cgi ping_ipaddr para

D-Link DIR-655 C devices before 3.02B05 BETA03 allow remote attackers to execute arbitrary commands via shell metacharac

D-Link DIR-655 C devices before 3.02B05 BETA03 allow remote attackers to force a blank password via the apply_sec.cgi se

hidea.com AZ Admin 1.0 has news_det.php?cod= SQL Injection.

@nuxt/devalue before 1.2.3, as used in Nuxt.js before 2.6.2, mishandles object keys, leading to XSS.

An issue was discovered in Zoho ManageEngine AssetExplorer. There is XSS via ResourcesAttachments.jsp with the parameter

An issue was discovered in Zoho ManageEngine AssetExplorer. There is XSS via SoftwareListView.do with the parameter swTy

An issue was discovered in Zoho ManageEngine AssetExplorer. There is XSS via the RCSettings.do rdsName parameter.

An issue was discovered in Zoho ManageEngine ServiceDesk Plus 10.5. There is XSS via the WorkOrder.do search field.

An issue was discovered in the Purchase component of Zoho ManageEngine ServiceDesk Plus. There is XSS via the SearchN.do

An issue was discovered in Zoho ManageEngine AssetExplorer. There is XSS via the SearchN.do search field.

An CSRF issue was discovered in the JN-Jones MyBB-2FA plugin through 2014-11-05 for MyBB. An attacker can forge a reques

Jenkins Caliper CI Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be

Jenkins Port Allocator Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they ca

A stored cross site scripting vulnerability in Jenkins Dependency Graph Viewer Plugin 0.13 and earlier allowed attackers

Jenkins Gogs Plugin stored credentials unencrypted in job config.xml files on the Jenkins master where they can be viewe

Jenkins Mashup Portlets Plugin stored credentials unencrypted on the Jenkins master where they can be viewed by users wi

A reflected cross site scripting vulnerability in Jenkins Embeddable Build Status Plugin 2.0.1 and earlier allowed attac

A missing permission check in Jenkins Docker Plugin 1.1.6 and earlier in various 'fillCredentialsIdItems' methods allowe

A missing permission check in Jenkins Docker Plugin 1.1.6 and earlier in DockerAPI.DescriptorImpl#doTestConnection allow

A cross-site request forgery vulnerability in Jenkins Docker Plugin 1.1.6 and earlier in DockerAPI.DescriptorImpl#doTest