2019

All known versions of the Orpak SiteOmat web management console is vulnerable to multiple instances of Stored Cross-site

An authentication bypass was found in an unknown area of the SiteOmat source code. All SiteOmat BOS versions are affecte

Multi modules of MailSherlock MSR35 and MSR45 lead to a CSRF vulnerability. It allows attacker to elevate privilege of s

Multi modules of MailSherlock MSR35 and MSR45 lead to a CSRF vulnerability. It allows attacker to add malicious email so

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Malwarebytes Antimal

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Bitdefender SafePay

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Bitdefender SafePay

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Bitdefender SafePay

IceWarp Mail Server through 10.4.4 is prone to a local file inclusion vulnerability via webmail/calendar/minimizer/index

An issue was discovered in Django 1.11 before 1.11.21, 2.1 before 2.1.9, and 2.2 before 2.2.2. The clickable Current URL

Remote unauthorized command execution and unauthorized disclosure of information in Micro Focus Service Manager, version

This affects Spring Data JPA in versions up to and including 2.1.6, 2.0.14 and 1.11.20. ExampleMatcher using ExampleMatc

Atlassian Bitbucket Data Center licensed instances starting with version 5.13.0 before 5.13.6 (the fixed version for 5.1

Atlassian Crowd and Crowd Data Center had the pdkinstall development plugin incorrectly enabled in release builds. Attac

NETGEAR Insight Cloud with firmware before Insight 5.6 allows remote authenticated users to achieve command injection.

In Firejail before 0.9.60, seccomp filters are writable inside the jail, leading to a lack of intended seccomp restricti

Apcupsd 0.3.91_5, as used in pfSense through 2.4.4-RELEASE-p3 and other products, has an Arbitrary Command Execution iss

Apcupsd 0.3.91_5, as used in pfSense through 2.4.4-RELEASE-p3 and other products, has an XSS issue in apcupsd_status.php

A vulnerability in Viber before 10.7.0 for Desktop (Windows) could allow an attacker to execute arbitrary commands on a

The WP Statistics plugin through 12.6.5 for Wordpress has stored XSS in includes/class-wp-statistics-pages.php. This is

In DouCo DouPHP v1.5 Release 20190516, remote attackers can view the database backup file via a brute-force guessing app

An improper authorization check in the User API in TheHive before 2.13.4 and 3.x before 3.3.1 allows users with read-onl

Incorrect access control was discovered in the stdonato Dashboard plugin through 0.9.7 for GLPI, affecting df.php, issue

There is an out-of-bounds read vulnerability in the function FlateStream::getChar() located at Stream.cc in Xpdf 4.01.01

NUUO Network Video Recorder Firmware 1.7.x through 3.3.x allows unauthenticated attackers to execute arbitrary commands

The WebApp v04.68 in the supervisor on SAET Impianti Speciali TEBE Small 05.01 build 1137 devices allows remote attacker

The WebApp v04.68 in the supervisor on SAET Impianti Speciali TEBE Small 05.01 build 1137 devices allows remote attacker

The rpWLANRedirect.asp ASP page is accessible without authentication on ZyXEL P-660HN-T1 V2 (2.00(AAKK.3)) devices. Afte

NVIDIA GeForce Experience versions prior to 3.19 contains a vulnerability in the Web Helper component, in which an attac

SQL Injection in Advanced InfoData Systems (AIS) ESEL-Server 67 (which is the backend for the AIS logistics mobile app)

In Godot through 3.1, remote code execution is possible due to the deserialization policy not being applied correctly.

It is possible for an attacker with regular user access to the web application of Pydio through 8.2.2 to trick an admini

The ImageMagick plugin that is installed by default in Pydio through 8.2.2 does not perform the appropriate validation a

A stored XSS vulnerability exists in the web application of Pydio through 8.2.2 that can be exploited by levering the fi

An unauthenticated attacker can obtain information about the Pydio 8.2.2 configuration including session timeout, librar

The "action" get_sess_id in the web application of Pydio through 8.2.2 discloses the session cookie value in the respons

Evernote 7.9 on macOS allows attackers to execute arbitrary programs by embedding a reference to a local executable file

In QEMU 3.1.0, load_device_tree in device_tree.c calls the deprecated load_image function, which has a buffer overflow r

The function getopt_simple as described in Advanced Bash Scripting Guide (ISBN 978-1435752184) allows privilege escalati

Deserialization of Untrusted Data in the anti CSRF module in Sitecore through 9.1 allows an authenticated attacker to ex

Deserialization of Untrusted Data in the Sitecore.Security.AntiCSRF (aka anti CSRF) module in Sitecore CMS 7.0 to 7.2 an

In Vijeo Citect 7.30 and 7.40, and CitectSCADA 7.30 and 7.40, a vulnerability has been identified that may allow an auth

Jector Smart TV FM-K75 devices allow remote code execution because there is an adb open port with root permission.

Jenkins Gitea Plugin 1.1.1 and earlier did not implement trusted revisions, allowing attackers without commit access to

Jenkins InfluxDB Plugin 1.21 and earlier stored credentials unencrypted in its global configuration file on the Jenkins

Jenkins Pipeline Remote Loader Plugin 1.4 and earlier provided a custom whitelist for script security that allowed attac

An XML external entities (XXE) vulnerability in Jenkins Pipeline Maven Integration Plugin 1.7.0 and earlier allowed atta

A cross-site request forgery vulnerability in Jenkins Warnings NG Plugin 5.0.0 and earlier allowed attackers to reset wa

A cross-site scripting vulnerability in Jenkins Warnings NG Plugin 5.0.0 and earlier allowed attacker with Job/Configure

A cross-site request forgery vulnerability in Jenkins Artifactory Plugin 3.2.2 and earlier in ReleaseAction#doSubmit, Gr