2019

Xiaomi Mi 5s Plus devices allow attackers to trigger touchscreen anomalies via a radio signal between 198 kHz and 203 kH

Gallagher Command Centre before 7.80.939, 7.90.x before 7.90.961, and 8.x before 8.00.1128 allows arbitrary event creati

Anviz Global M3 Outdoor RFID Access Control executes any command received from any source. No authentication/encryption

Kyocera Command Center RX TASKalfa4501i and TASKalfa5052ci allows remote attackers to abuse the Test button in the machi

On SOYAL AR-727H and AR-829Ev5 devices, all CGI programs allow unauthenticated POST access.

VMware Workstation (15.x before 15.1.0) contains a use-after-free vulnerability in the Advanced Linux Sound Architecture

VMware Tools for Windows update addresses an out of bounds read vulnerability in vm3dmp driver which is installed with v

The Pivotal Ops Manager, 2.2.x versions prior to 2.2.23, 2.3.x versions prior to 2.3.16, 2.4.x versions prior to 2.4.11,

Dell EMC OpenManage Server Administrator (OMSA) versions prior to 9.1.0.3 and prior to 9.2.0.4 contain a web parameter t

Dell EMC OpenManage Server Administrator (OMSA) versions prior to 9.1.0.3 and prior to 9.2.0.4 contain an XML external e

MyBB 1.8.19 allows remote attackers to obtain sensitive information because it discloses the username upon receiving a p

MyBB 1.8.19 has XSS in the resetpassword function.

A code injection issue was discovered in PyXDG before 0.26 via crafted Python code in a Category element of a Menu XML d

A deserialization vulnerability exists in the way parso through 0.4.0 handles grammar parsing from the cache. Cache load

An issue was discovered in MantisBT through 1.3.14, and 2.0.0. Using a crafted request on bug_report_page.php (modifying

vtiger CRM 7.0.1 is affected by one reflected Cross-Site Scripting (XSS) vulnerability affecting version 7.0.1 and proba

TP-Link TL-WR940N is vulnerable to a stack-based buffer overflow, caused by improper bounds checking by the ipAddrDispos

Northern.tech CFEngine Enterprise 3.12.1 has Insecure Permissions.

Progress Sitefinity 10.1.6536 does not invalidate session cookies upon logouts. It instead tries to overwrite the cookie

HashiCorp Consul 1.4.0 through 1.5.0 has Incorrect Access Control. Keys not matching a specific ACL rule used for prefix

An unspecified vulnerability in the application server in PaperCut MF and NG versions 18.3.8 and earlier and versions 19

An issue was discovered in PHP Scripts Mall API Based Travel Booking 3.4.7. There is Reflected XSS via the flight-result

PHP Scripts Mall Chartered Accountant : Auditor Website 2.0.1 has Stored XSS in the Profile Update page via the My Name

An issue was discovered in PHP Scripts Mall Investment MLM Software 2.0.2. Stored XSS was found in the the My Profile Se

An issue was discovered on Linksys WRT1900ACS 1.0.3.187766 devices. A lack of encryption in how the user login cookie (a

X-Cart V5 is vulnerable to XSS via the CategoryFilter2 parameter.

In Rancher 2 through 2.2.3, Project owners can inject additional fluentd configuration to read files or execute arbitrar

In Rancher 1 and 2 through 2.2.3, unprivileged users (if allowed to deploy nodes) can gain admin access to the Rancher m

A Directory Traversal issue was discovered in RubyGems 2.7.6 and later through 3.0.2. Before making new directories or t

The image processing module of some Huawei Mate 10 smartphones versions before ALP-L29 9.0.0.159(C185) has a memory doub

Huawei Honor V10 smartphones versions earlier than Berkeley-AL20 9.0.0.125(C00E125R2P14T8) have an authorization bypass

There is a code execution vulnerability in Huawei PCManager versions earlier than PCManager 9.0.1.50. The attacker can t

There is a privilege escalation vulnerability in Huawei PCManager versions earlier than PCManager 9.0.1.50. The attacker

There is a double free vulnerability on certain drivers of Huawei Mate10 smartphones versions earlier than ALP-AL00B 9.0

There is a race condition vulnerability on Huawei Honor V10 smartphones versions earlier than Berkeley-AL20 9.0.0.156(C0

There is a use after free vulnerability on certain driver component in Huawei Mate10 smartphones versions earlier than A

The Chartkick gem through 3.1.0 for Ruby allows XSS.

CSV Injection (aka Excel Macro Injection or Formula Injection) exists in the export feature in Workday through 32 via a

Sitecore Experience Platform (XP) prior to 9.1.1 is vulnerable to remote code execution via deserialization, aka TFS # 2

IBM InfoSphere Information Server 11.7.1.0 stores a common hard coded encryption key that could be used to decrypt sensi

IBM Jazz for Service Management 1.1.3, 1.1.3.1, and 1.1.3.2 could allow a remote attacker to conduct phishing attacks, u

IBM InfoSphere Information Server 11.7.1 containers are vulnerable to privilege escalation due to an insecurely configur

IBM Maximo Asset Management 7.6 Work Centers' application does not validate file type upon upload, allowing attackers to

IBM Maximo Asset Management 7.6 could allow a physical user of the system to obtain sensitive information from a previou

IBM Maximo Asset Management 7.6 could allow a an authenticated user to replace a target page with a phishing site which

Kromtech MacKeeper 3.20.4 suffers from a root privilege escalation vulnerability through its `com.mackeeper.AdwareAnalyz

Gemalto DS3 Authentication Server 2.6.1-SP01 has Broken Access Control.

Gemalto DS3 Authentication Server 2.6.1-SP01 allows Local File Disclosure.

Gemalto DS3 Authentication Server 2.6.1-SP01 allows OS Command Injection.

An issue was discovered in Thomson Reuters Desktop Extensions 1.9.0.358. An unauthenticated directory traversal and loca