2019

Parallels Plesk Panel 9.5 allows XSS in target/locales/tr-TR/help/index.htm? via the "fileName" parameter.

NETGEAR WNR3500U and WNR3500L routers uses form tokens abased solely on router's current date and time, which allows att

An integer overflow condition in poppler before 0.16.3 can occur when parsing CharCodes for fonts.

A remote file include (RFI) issue was discovered in Enghouse Web Chat 6.2.284.34. One can replace the localhost attribut

An XSS issue was discovered in Enghouse Web Chat 6.1.300.31 and 6.2.284.34. The QueueName parameter of a GET request all

Cross-site scripting (XSS) vulnerability in NETGEAR WNR3500U and WNR3500L.

In getUserCount and getCount of UserSwitcherController.java, there is possible new user creation due to a logic error. T

In poisson_distribution of random, there is an out of bounds read. This could lead to local information disclosure with

In BTA_DmPinReply of bta_dm_api.cc, there is a possible out of bounds read due to an incorrect bounds check. This could

In createSessionInternal of PackageInstallerService.java, there is a possible permissions bypass. This could lead to loc

In Download Provider, there is a possible SQL injection vulnerability. This could lead to local information disclosure w

In processPhonebookAccess of CachedBluetoothDevice.java, there is a possible permission bypass due to an insecure defaul

In Download Provider, there is possible SQL injection. This could lead to local information disclosure with no additiona

An issue was discovered in Enghouse Web Chat 6.1.300.31 and 6.2.284.34. A user is allowed to send an archive of their ch

offlineimap before 6.3.2 does not check for SSL server certificate validation when "ssl = yes" option is specified which

Some Huawei products have a memory leak vulnerability when handling some messages. A remote attacker with operation priv

vdsm and vdsclient does not validate certficate hostname from another vdsm which could facilitate a man-in-the-middle at

letodms 3.3.6 has CSRF via change password

JBoss KeyCloak is vulnerable to soft token deletion via CSRF

OpenShift Origin: Improperly validated team names could allow stored XSS attacks

letodms has multiple XSS issues: Reflected XSS in Login Page, Stored XSS in Document Owner/User name, Stored XSS in Cale

An XSS vulnerability on Technicolor TC7300 STFA.51.20 devices allows remote attackers to inject arbitrary web script via

An XSS vulnerability on Technicolor TC7300 STFA.51.20 devices allows remote attackers to inject arbitrary web script via

Huawei smart phones Emily-L29C with Versions earlier than 9.1.0.311(C10E2R1P13T8), Versions earlier than 9.1.0.311(C461E

Abuse of Authorization vulnerability in APIs exposed by TIE server in McAfee Threat Intelligence Exchange Server (TIE Se

A Privilege Escalation vulnerability in the Microsoft Windows client in McAfee Total Protection 16.0.R22 and earlier all

Smartphones with software of ELLE-AL00B 9.1.0.109(C00E106R1P21), 9.1.0.113(C00E110R1P21), 9.1.0.125(C00E120R1P21), 9.1.0

P30 smartphones with versions earlier than ELLE-AL00B 9.1.0.186(C00E180R2P1) have an improper authorization vulnerabilit

P20 Pro, P20, Mate RS smartphones with versions earlier than Charlotte-AL00A 9.1.0.321(C00E320R1P1T8), versions earlier

P30 smartphones with versions earlier than ELLE-AL00B 9.1.0.193(C00E190R2P1) have an insufficient verification vulnerabi

mysql-gui-tools (mysql-query-browser and mysql-admin) before 5.0r14+openSUSE-2.3 exposes the password of a user connecte

JBoss BRMS before 5.1.0 has a XSS vulnerability via asset=UUID parameter.

An issue exists in third_party/WebKit/Source/WebCore/svg/animation/SVGSMILElement.h in WebKit in Google Chrome before Bl

WebKit in Google Chrome before Blink M11 and M12 does not properly handle counter nodes, which allows remote attackers t

babiloo 2.0.9 before 2.0.11 creates temporary files with predictable names when downloading and unpacking dictionary fil

A potential vulnerability in the SMI callback function used in Legacy USB driver using passed parameter without sufficie

A potential vulnerability in the SMI callback function used in the Legacy USB driver using boot services structure in ru

NVIDIA GeForce Experience (prior to 3.20.1) and Windows GPU Display Driver (all versions) contains a vulnerability in th

Use after free vulnerability exists in WebKit in Google Chrome before Blink M12 in RenderLayerwhen removing elements wit

The encrypt/decrypt functions in Ruby on Rails 2.3 are vulnerable to padding oracle attacks.

The update{_bad,}_phishing_sites scripts in mailscanner 4.79.11-2 downloads files and trusts them without using encrypti

mailscanner before 4.79.11-2.1 might allow local users to overwrite arbitrary files via a symlink attack on certain temp

The Digital Asset Manager Web Interface component of TIBCO Software Inc.'s TIBCO EBX Add-ons contains a vulnerability th

The Data Exchange Web Interface component of TIBCO Software Inc.'s TIBCO EBX Add-ons contains a vulnerability that theor

It is possible to cause a DoS condition by causing the server to crash in alien-arena 7.33 by supplying various invalid

A spoofing vulnerability exists when Office Online does not validate origin in cross-origin communications handlers corr

An information disclosure vulnerability exists when Microsoft Excel improperly discloses the contents of its memory, aka

A spoofing vulnerability exists when Office Online does not validate origin in cross-origin communications handlers corr

An information disclosure vulnerability exists in Microsoft SharePoint when an attacker uploads a specially crafted file

A security feature bypass vulnerability exists when Microsoft Office does not validate URLs.An attacker could send a vic