2019

The parsing component in LibSass through 3.5.5 allows attackers to cause a denial-of-service (uncontrolled recursion in

read_ujpg in jpgcoder.cc in Dropbox Lepton 1.2.1 allows attackers to cause a denial-of-service (application runtime cras

io/ZlibCompression.cc in the decompression component in Dropbox Lepton 1.2.1 allows attackers to cause a denial of servi

An XML external entity (XXE) vulnerability in PrinterOn version 4.1.4 and lower allows remote authenticated users to rea

Zoho ManageEngine Applications Manager 12 through 14 allows FaultTemplateOptions.jsp resourceid SQL injection. Subsequen

A memory leak in archive_read_format_zip_cleanup in archive_read_support_format_zip.c in libarchive 3.3.4-dev allows rem

cipso_v4_validate in include/net/cipso_ipv4.h in the Linux kernel before 3.11.7, when CONFIG_NETLABEL is disabled, allow

A hard-link created from log file archive of Check Point ZoneAlarm up to 15.4.062 or Check Point Endpoint Security clien

An issue was discovered in GNOME gnome-desktop 3.26, 3.28, and 3.30 prior to 3.30.2.2, and 3.32 prior to 3.32.1.1. A com

The tiff_document_render() and tiff_document_get_thumbnail() functions in the TIFF document backend in GNOME Evince thro

An issue was discovered in the Medha WiFi FTP Server application 1.8.3 for Android. An attacker can read the username/pa

A vulnerability was discovered wherein a specially crafted URL could enable reflected XSS via JavaScript in the pony mai

c3p0 version < 0.9.5.4 may be exploited by a billion laughs attack when loading XML configuration due to missing protect

An issue was discovered in GNOME Nautilus 3.30 prior to 3.30.6 and 3.32 prior to 3.32.1. A compromised thumbnailer may e

The Zalora application 6.15.1 for Android stores confidential information insecurely on the system (i.e. plain text), wh

Eclipse Vorto versions prior to 0.11 resolved Maven build artifacts for the Xtext project over HTTP instead of HTTPS. An

On Zyxel ATP200, ATP500, ATP800, USG20-VPN, USG20W-VPN, USG40, USG40W, USG60, USG60W, USG110, USG210, USG310, USG1100, U

In Eclipse Jetty version 7.x, 8.x, 9.2.27 and older, 9.3.26 and older, and 9.4.16 and older, the server running on any O

In Eclipse Jetty version 9.2.27, 9.3.26, and 9.4.16, the server running on Windows is vulnerable to exposure of the full

In Eclipse Jetty version 9.2.26 and older, 9.3.25 and older, and 9.4.15 and older, the server is vulnerable to XSS condi

In various firmware versions of Lenovo System x, the integrated management module II (IMM2)'s first failure data capture

A potential vulnerability was found in an SMI handler in various BIOS versions of certain legacy IBM System x and IBM Bl

A flaw was found in Mercurial before 4.9. It was possible to use symlinks and subrepositories to defeat Mercurial's path

A race condition in perf_event_open() allows local attackers to leak sensitive data from setuid programs. As no relevant

It was found that default configuration of Heketi does not require any authentication potentially exposing the managemen

Gila CMS 1.10.1 allows fm/save CSRF for executing arbitrary PHP code.

A buffer over-read in Util_urlDecode in util.c in Tildeslash Monit before 5.25.3 allows a remote authenticated attacker

Persistent cross-site scripting (XSS) in http/cervlet.c in Tildeslash Monit before 5.25.3 allows a remote unauthenticate

The Snapweb interface before version 0.21.2 was exposing controls to install or remove snap packages without controlling

A malicious webview could install long-lived unload handlers that re-use an incognito BrowserContext that is queued for

In all versions of AppArmor mount rules are accidentally widened when compiled.

In all versions of Unity8 a running but not active application on a large-screen device could talk with Maliit and consu

UDM provides support for running commands after a download is completed, this is currently made use of for click package

Versions of Unity8 before 8.11+16.04.20160122-0ubuntu1 file plugins/Dash/CardCreator.js will execute any code found in p

All versions of unity-scope-gdrive logs search terms to syslog.

Any Python module in sys.path can be imported if the command line of the process triggering the coredump is Python and t

LXD before version 0.19-0ubuntu5 doUidshiftIntoContainer() has an unsafe Chmod() call that races against the stat in the

Content Hub before version 0.0+15.04.20150331-0ubuntu1.0 DBUS API only requires a file path for a content item, it doesn

python-dbusmock before version 0.15.1 AddTemplate() D-Bus method call or DBusTestCase.spawn_server_template() method cou

The SeaMicro provisioning of Ubuntu MAAS logs credentials, including username and password, for the management interface

Juju Core's Joyent provider before version 1.25.5 uploads the user's private ssh key.

A vulnerability in generate_filestorage_key of Ubuntu MAAS allows an attacker to brute-force filenames. This issue affec

A vulnerability in the REST API of Ubuntu MAAS allows an attacker to cause a logged-in user to execute commands via cros

A vulnerability in maasserver.api.get_file_by_name of Ubuntu MAAS allows unauthenticated network clients to download any

The Ubuntu SELinux initscript before version 1:0.10 used touch to create a lockfile in a world-writable directory. If th

Versions of nova before 2012.1 could expose hypervisor host files to a guest operating system when processing a maliciou

When mount.ecrpytfs_private before version 87-0ubuntu1.2 calls setreuid() it doesn't also set the effective group id. So

Ekiga versions before 3.3.0 attempted to load a module from /tmp/ekiga_test.so.

whatsns 4.0 allows index.php?admin_category/remove.html cid[] SQL injection.

whatsns 4.0 allows index.php?inform/add.html qid SQL injection.