2019

Sequelize version 5 before 5.3.0 does not properly ensure that standard conforming strings are used.

The f:validateButton form control for the Jenkins UI did not properly escape job URLs in Jenkins 2.171 and earlier and J

Users who cached their CLI authentication before Jenkins was updated to 2.150.2 and newer, or 2.160 and newer, would rem

The .NET SDK WebForm Viewer in SAP Crystal Reports for Visual Studio (fixed in version 2010) discloses sensitive databas

SLD Registration in SAP HANA (fixed in versions 1.0, 2.0) does not sufficiently validate an XML document accepted from a

SAP NetWeaver Process Integration (Adapter Engine), fixed in versions 7.10 to 7.11, 7.30, 7.31, 7.40, 7.50; is vulnerabl

Several web pages in SAP NetWeaver Process Integration (Runtime Workbench), fixed in versions 7.10 to 7.11, 7.30, 7.31,

ABAP BASIS function modules INST_CREATE_R3_RFC_DEST, INST_CREATE_TCPIP_RFCDEST, and INST_CREATE_TCPIP_RFC_DEST in SAP BA

Under certain conditions the Monitoring Servlet of the SAP NetWeaver Process Integration (Messaging System), fixed in ve

Kentico CMS before 11.0.45 allows unrestricted upload of a file with a dangerous type.

Symantec Endpoint Encryption prior to SEE 11.2.1 MP1 may be susceptible to a Privilege Escalation vulnerability, which i

When processing project files, the application (Omron CX-Programmer v9.70 and prior and Common Components January 2019 a

Information Disclosure vulnerability in McAfee DXL Platform and TIE Server in DXL prior to 5.0.1 HF2 and TIE prior to 2.

libxslt through 1.1.33 allows bypass of a protection mechanism because callers of xsltCheckRead and xsltCheckWrite permi

A number of HTTP endpoints in the Airflow webserver (both RBAC and classic) did not have adequate protection and were vu

A malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript

Receipt of a specific packet on the out-of-band management interface fxp0 may cause the system to crash and restart (vmc

In MPLS environments, receipt of a specific SNMP packet may cause the routing protocol daemon (RPD) process to crash and

Juniper Identity Management Service (JIMS) for Windows versions prior to 1.1.4 may send an incorrect message to associat

On EX4300-MP Series devices with any lo0 filters applied, transit network traffic may reach the control plane via loopba

On Junos OS, rpcbind should only be listening to port 111 on the internal routing instance (IRI). External packets desti

If REST API is enabled, the Junos OS login credentials are vulnerable to brute force attacks. The high default connectio

Crafted packets destined to the management interface (fxp0) of an SRX340 or SRX345 services gateway may create a denial

In a Dynamic Host Configuration Protocol version 6 (DHCPv6) environment, the jdhcpd daemon may crash and restart upon re

When configuring a stateless firewall filter in Junos OS, terms named using the format "internal-n" (e.g. "internal-1",

When "set system ports console insecure" is enabled, root login is disallowed for Junos OS as expected. However, the roo

A firewall bypass vulnerability in the proxy ARP service of Juniper Networks Junos OS allows an attacker to cause a high

A password management issue exists where the Organization authentication username and password were stored in plaintext

Specific IPv6 DHCP packets received by the jdhcpd daemon will cause a memory resource consumption issue to occur on a Ju

On Junos devices with the BGP graceful restart helper mode enabled or the BGP graceful restart mechanism enabled, a BGP

When BGP tracing is enabled an incoming BGP message may cause the Junos OS routing protocol daemon (rpd) process to cras

A certain sequence of valid BGP or IPv6 BFD packets may trigger a stack based buffer overflow in the Junos OS Packet For

The nscd daemon in the GNU C Library (glibc) before version 2.5 does not close incoming client sockets if they cannot be

The getgrouplist function in the GNU C library (glibc) before version 2.3.5, when invoked with a zero argument, writes t

An issue was discovered in Joomla! before 3.9.5. The "refresh list of helpsites" endpoint of com_users lacks access chec

An issue was discovered in Joomla! before 3.9.5. The Media Manager component does not properly sanitize the folder param

An unauthenticated user can execute SQL statements that allow arbitrary read access to the underlying database, which ca

In Ubiquiti Networks EdgeSwitch X v1.1.0 and prior, an unauthenticated user can use the "local port forwarding" and "dyn

In Ubiquiti Networks EdgeSwitch X v1.1.0 and prior, an authenticated user can execute arbitrary shell commands over the

In Ubiquiti Networks EdgeSwitch X v1.1.0 and prior, a privileged user can execute arbitrary shell commands over the SSH

Cantemo Portal before 3.2.13, 3.3.x before 3.3.8, and 3.4.x before 3.4.9 has XSS. Leveraging this vulnerability would en

In Lenovo systems, SMM BIOS Write Protection is used to prevent writes to SPI Flash. While this provides sufficient prot

A DLL search path vulnerability was reported in Lenovo Bootable Generator, prior to version Mar-2019, that could allow a

In Rancher 2.0.0 through 2.1.5, project members have continued access to create, update, read, and delete namespaces in

IBM BigFix Platform 9.5 could allow any authenticated user to upload any file to any location on the server with root pr

The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.14 and 8.5.0 to 8.5.37 accepted streams with excessive number

IBM InfoSphere Information Server 11.5 and 11.7 is vulnerable to SQL injection. A remote attacker could send specially-c

IBM Sterling Connect:Direct for UNIX 4.2.0, 4.3.0, and 6.0.0 could allow a user with restricted sudo access on a system

An issue was discovered in Rancher 2 through 2.1.5. Any project member with access to the default namespace can mount th

Gradle versions from 1.4 to 5.3.1 use an insecure HTTP URL to download dependencies when the built-in JavaScript or Coff