2019

IBM Cognos Controller 10.3.0, 10.3.1, 10.4.0, and 10.4.1 could allow an authenticated user to obtain sensitive informati

IBM Cognos Analytics 11.0 and 11.1 could reveal sensitive information to an authenticated user that could be used in fut

Medtronic Valleylab Exchange Client version 3.4 and below, Valleylab FT10 Energy Platform (VLFT10GEN) software version 4

In Medtronic Valleylab FT10 Energy Platform (VLFT10GEN) version 2.1.0 and lower and version 2.0.3 and lower, and Valleyl

In Medtronic Valleylab FT10 Energy Platform (VLFT10GEN) version 2.1.0 and lower and version 2.0.3 and lower, and Valleyl

Brocade SANnav versions before v2.0, logs plain text database connection password while triggering support save.

The authentication mechanism, in Brocade SANnav versions before v2.0, logs plaintext account credentials at the ‘trace’

In Tasy EMR, Tasy WebPortal Versions 3.02.1757 and prior, there is an information exposure vulnerability which may allow

An information-exposure vulnerability was discovered where openstack-mistral's undercloud log files containing clear-tex

It was found that the Syndesis configuration for Cross-Origin Resource Sharing was set to allow all origins. An attacker

A flaw was found in the 'deref' plugin of 389-ds-base where it could use the 'search' permission to display attribute va

A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads

tuned before 2.x allows local users to kill running processes due to insecure permissions with tuned's ktune service.

The Atlassian Troubleshooting and Support Tools plugin prior to version 1.17.2 allows an unprivileged user to initiate p

In JON 2.1.x before 2.1.2 SP1, users can obtain unauthorized security information about private resources managed by JBo

An access control issue in MantisBT before 1.2.13 allows users with "Reporter" permissions to change any issue to "New".

Lintian before 2.5.12 allows remote attackers to gather information about the "host" system using crafted symlinks.

In Linux 2.6 before 2.6.23, the TRACE_IRQS_ON function in iret_exc calls a C function without ensuring that the segments

Eximious Logo Designer 3.82 has a User Mode Write AV starting at ExiCustomPathLib!ExiCustomPathLib::CGradientColorsProfi

Eximious Logo Designer 3.82 has Heap Corruption starting at ntdll!RtlpNtMakeTemporaryKey+0x0000000000001a78.

Eximious Logo Designer 3.82 has a User Mode Write AV starting at ExiVectorRender!StrokeText_Blend+0x00000000000003a7.

GNUBOARD5 5.3.1.9 has XSS that allows remote attackers to inject arbitrary web script or HTML via the "board tail conten

Cross-site Scripting (XSS) in Mahara before 1.5.9 and 1.6.x before 1.6.4 allows remote attackers to inject arbitrary web

ldap-git-backup before 1.0.4 exposes password hashes due to incorrect directory permissions.

The Sec Consult Security Lab reported an information disclosure vulnerability in MF910S product to ZTE PSIRT in October

Gource through 0.26 logs to a predictable file name (/tmp/gource-$UID.tmp), enabling attackers to overwrite an arbitrary

Drupal 6.x before 6.16 and 5.x before version 5.22 does not properly block users under certain circumstances. A user wit

Locale module and dependent contributed modules in Drupal 6.x before 6.16 and 5.x before version 5.22 do not sanitize th

Dell EMC iDRAC7 versions prior to 2.65.65.65, iDRAC8 versions prior to 2.70.70.70 and iDRAC9 versions prior to 3.36.36.3

OpenTTD before 1.1.5 contains a Denial of Service (slow read attack) that prevents users from joining the server.

An issue exists in WebKit in Google Chrome before Blink M12. when clearing lists in AnimationControllerPrivate that sign

Drupal 5.x and 6.x before 6.16 uses a user-supplied value in output during site installation which could allow an attack

po-admin/route.php?mod=post&act=edit in PopojiCMS 2.0.1 allows post[1][content]= stored XSS.

PopojiCMS 2.0.1 allows refer= Open Redirection.

Incorrect handling of timer information in Timer.cpp in WebKit in Google Chrome before Blink M13.

Use after free vulnerability in documentloader in WebKit in Google Chrome before Blink M13 in DocumentWriter::replaceDoc

A memory leak in the sof_set_get_large_ctrl_data() function in sound/soc/sof/ipc.c in the Linux kernel through 5.3.9 all

A memory leak in the af9005_identify_state() function in drivers/media/usb/dvb-usb/af9005.c in the Linux kernel through

A memory leak in the ccp_run_sha_cmd() function in drivers/crypto/ccp/ccp-ops.c in the Linux kernel through 5.3.9 allows

A memory leak in the ql_alloc_large_buffers() function in drivers/net/ethernet/qlogic/qla3xxx.c in the Linux kernel befo

An Insecure Direct Object Reference (IDOR) vulnerability in eyecomms eyeCMS through 2019-10-15 allows any candidate to c

An issue was discovered on Intelbras WRN 150 1.0.17 devices. There is stored XSS in the Service Name tab of the WAN conf

Portainer before 1.22.1 has XSS (issue 2 of 2).

For the printers listed a maliciously crafted print file might cause certain HP Inkjet printers to assert. Under certain

Portainer before 1.22.1 has Incorrect Access Control (issue 2 of 4).

Portainer before 1.22.1 has XSS (issue 1 of 2).

The Customer Context Filter in Atlassian Jira Service Desk Server and Jira Service Desk Data Center before 3.9.17, from

Samsung Galaxy S8 plus (Android version: 8.0.0, Build Number: R16NW.G955USQU5CRG3, Baseband Vendor: Qualcomm Snapdragon

Samsung Galaxy S8 plus (Android version: 8.0.0, Build Number: R16NW.G955USQU5CRG3, Baseband Vendor: Qualcomm Snapdragon

Apache CXF before 3.3.4 and 3.2.11 does not restrict the number of message attachments present in a given message. This