2019

An issue was discovered in Netdata 1.10.0. JSON injection exists via the api/v1/data tqx parameter because of web_client

The Tubigan "Welcome to our Resort" 1.0 software allows CSRF via admin/mod_users/controller.php?action=edit.

IBM Cloud Private 2.1.0, 3.1.0, 3.1.1, and 3.1.2 is vulnerable to cross-site request forgery which could allow an attack

In firmware version MS_2.6.9900 of Columbia Weather MicroServer, the BACnet daemon does not properly validate input, whi

In firmware version MS_2.6.9900 of Columbia Weather MicroServer, an authenticated web user can access an alternative con

In firmware version MS_2.6.9900 of Columbia Weather MicroServer, a readouts_rd.php directory traversal issue makes it po

In firmware version MS_2.6.9900 of Columbia Weather MicroServer, a stored Cross-site scripting (XSS) vulnerability allow

Cerio DT-300N 1.1.6 through 1.1.12 devices allow OS command injection because of improper input validation of the web-in

A vulnerability in the exacqVision Enterprise System Manager (ESM) v5.12.2 application whereby unauthorized privilege es

dotCMS before 5.1.6 is vulnerable to a SQL injection that can be exploited by an attacker of the role Publisher via view

Artha ~ The Open Thesaurus 1.0.3.0 has a Buffer Overflow.

Helpy v2.1.0 has Stored XSS via the Ticket title.

In firmware version MS_2.6.9900 of Columbia Weather MicroServer, a networkdiags.php reflected Cross-site scripting (XSS)

In firmware version MS_2.6.9900 of Columbia Weather MicroServer, an authenticated web user can pipe commands directly to

OX App Suite 7.10.1 and earlier allows Information Exposure.

An XSS issue was discovered in i-doit Open 1.12 via the src/tools/php/qr/qr.php url parameter.

Craft CMS before 3.1.31 does not properly filter XML feeds and thus allowing XSS.

An issue was discovered on Phoenix Contact AXC F 2152 (No.2404267) before 2019.0 LTS and AXC F 2152 STARTERKIT (No.10465

In UrBackup 2.2.6, an attacker can send a malformed request to the client over the network, and trigger a fileservplugin

app/Model/Server.php in MISP 2.4.109 allows remote command execution by a super administrator because the PHP file_exist

In radare2 through 3.5.1, cmd_mount in libr/core/cmd_mount.c has a double free for the ms command.

Recently it was discovered as a part of the research on IoT devices in the most recent firmware for Shekar Endoscope tha

Recently it was discovered as a part of the research on IoT devices in the most recent firmware for Shekar Endoscope tha

Recently it was discovered as a part of the research on IoT devices in the most recent firmware for Shekar Endoscope tha

Recently it was discovered as a part of the research on IoT devices in the most recent firmware for Shekar Endoscope tha

Recently it was discovered as a part of the research on IoT devices in the most recent firmware for Shekar Endoscope tha

Recently it was discovered as a part of the research on IoT devices in the most recent firmware for Shekar Endoscope tha

Recently it was discovered as a part of the research on IoT devices in the most recent firmware for Shekar Endoscope tha

An exploitable information disclosure vulnerability exists in the KCodes NetUSB.ko kernel module that enables the ReadyS

An exploitable arbitrary memory read vulnerability exists in the KCodes NetUSB.ko kernel module which enables the ReadyS

OPNsense 18.7.x before 18.7.7 has Incorrect Access Control.

An issue was discovered on Vera VeraEdge 1.7.19 and Veralite 1.7.481 devices. The device provides UPnP services that are

An issue was discovered on Vera VeraEdge 1.7.19 and Veralite 1.7.481 devices. The device provides UPnP services that are

An issue was discovered in RubyGems 2.6 and later through 3.0.2. Gem::GemcutterUtilities#with_response may output the AP

An issue was discovered in RubyGems 2.6 and later through 3.0.2. The gem owner command outputs the contents of the API r

An issue was discovered in RubyGems 2.6 and later through 3.0.2. Since Gem::UserInteraction#verbose calls say without es

OX App Suite 7.10.0 and earlier has Incorrect Access Control.

A command injection can occur for specially crafted PDF files in Foxit Reader SDK (ActiveX) 5.4.0.1031 when parsing a la

A File Write can occur for specially crafted PDF files in Foxit Reader SDK (ActiveX) Professional 5.4.0.1031 when the Ja

In Foxit Reader SDK (ActiveX) Professional 5.4.0.1031, an uninitialized object in IReader_ContentProvider::GetDocEventHa

A stack-based buffer overflow can occur for specially crafted PDF files in Foxit Reader SDK (ActiveX) 5.4.0.1031 when pa

A File Write can occur for specially crafted PDF files in Foxit Reader SDK (ActiveX) Professional 5.4.0.1031 when the Ja

A command injection can occur for specially crafted PDF files in Foxit Reader SDK (ActiveX) Professional 5.4.0.1031 when

A use after free in the TextBox field Validate action in IReader_ContentProvider can occur for specially crafted PDF fil

Concrete5 8.4.3 has XSS because config/concrete.php allows uploads (by administrators) of SVG files that may contain HTM

An issue was discovered on Vera VeraEdge 1.7.19 and Veralite 1.7.481 devices. The device provides a shell script called

An issue was discovered on Vera VeraEdge 1.7.19 and Veralite 1.7.481 devices. The device provides a web user interface t

An issue was discovered on Vera VeraEdge 1.7.19 and Veralite 1.7.481 devices. The device provides a shell script called

An issue was discovered on Vera VeraEdge 1.7.19 and Veralite 1.7.481 devices. The device provides a script file called "

An issue was discovered on Vera Veralite 1.7.481 devices. The device has an additional OpenWRT interface in addition to