2019

CyberArk Endpoint Privilege Manager 10.2.1.603 and earlier allows an attacker (who is able to edit permissions of a file

A denial of service flaw was found in the way BIND handled DNSSEC validation. A remote attacker could use this flaw to m

The Sophos UTM VPN endpoint interacts with client software provided by NPC Engineering (www.ncp-e.com). The affected cli

Incorrect Access Controls of Security Officer (SO) in PKCS11 R2 provider that ships with the Utimaco CryptoServer HSM pr

An information disclosure vulnerability in Fortinet FortiOS 6.0.1, 5.6.7 and below allows attacker to reveals serial num

Users with Site-level permissions can access files containing the username-encrypted passwords of Security Console Globa

Advantech WebAccess 8.3.4 allows unauthenticated, remote attackers to delete arbitrary files via IOCTL 10005 RPC.

Advantech WebAccess 8.3.4 is vulnerable to file upload attacks via unauthenticated RPC call. An unauthenticated, remote

In Foreman it was discovered that the delete compute resource operation, when executed from the Foreman API, leads to th

A flaw was found in the way KVM hypervisor handled x2APIC Machine Specific Rregister (MSR) access with nested(=1) virtua

A flaw was found in the way samba implemented an RPC endpoint emulating the Windows registry service API. An unprivilege

A vulnerability was found in Samba from version (including) 4.9 to versions before 4.9.6 and 4.10.2. During the creation

Spring Security versions 4.2.x prior to 4.2.12, 5.0.x prior to 5.0.12, and 5.1.x prior to 5.1.5 contain an insecure rand

In Eclipse Kura versions up to 4.0.0, the Web UI package and component services, the Artemis simple Mqtt component and t

In Eclipse Kura versions up to 4.0.0, Kura exposes the underlying Ui Web server version in its replies. This can be used

In Eclipse Kura versions up to 4.0.0, the SkinServlet did not checked the path passed during servlet call, potentially a

Improper access control in the Helpdesk App of Odoo Enterprise 10.0 through 12.0 allows remote authenticated attackers t

Cross-site scripting vulnerability in the Discuss App of Odoo Community 12.0 and earlier, and Odoo Enterprise 12.0 and e

Improper access control in the Discuss App of Odoo Community 12.0 and earlier, and Odoo Enterprise 12.0 and earlier allo

A privilege escalation vulnerability in Fortinet FortiOS 6.0.0 to 6.0.6, 5.6.0 to 5.6.10, 5.4 and below allows admin use

GAT-Ship Web Module before 1.40 suffers from a vulnerability allowing authenticated attackers to upload any file type to

An XSS vulnerability in the Zyxel NAS 326 version 5.21 and below allows a remote authenticated attacker to inject arbitr

An eval injection vulnerability in the Python web server routing on the Zyxel NAS 326 version 5.21 and below allows a re

A directory traversal vulnerability in the file browser component on the Zyxel NAS 326 version 5.21 and below allows a l

Shell Metacharacter Injection in the package installer on Zyxel NAS 326 version 5.21 and below allows an authenticated a

A plaintext password vulnerability in the Zyxel NAS 326 through 5.21 allows an elevated privileged user to get the admin

In Wireshark 2.4.0 to 2.4.13, 2.6.0 to 2.6.7, and 3.0.0, the DCERPC SPOOLSS dissector could crash. This was addressed in

In Wireshark 3.0.0, the TSDNS dissector could crash. This was addressed in epan/dissectors/packet-tsdns.c by splitting s

In Wireshark 2.4.0 to 2.4.13, 2.6.0 to 2.6.7, and 3.0.0, the LDSS dissector could crash. This was addressed in epan/diss

In Wireshark 3.0.0, the Rbm dissector could go into an infinite loop. This was addressed in epan/dissectors/file-rbm.c b

In Wireshark 2.4.0 to 2.4.13, 2.6.0 to 2.6.7, and 3.0.0, the SRVLOC dissector could crash. This was addressed in epan/di

In Wireshark 3.0.0, the GSUP dissector could go into an infinite loop. This was addressed in epan/dissectors/packet-gsm_

In Wireshark 3.0.0, the IEEE 802.11 dissector could go into an infinite loop. This was addressed in epan/dissectors/pack

In Wireshark 2.4.0 to 2.4.13, 2.6.0 to 2.6.7, and 3.0.0, the DOF dissector could crash. This was addressed in epan/disse

In Wireshark 2.4.0 to 2.4.13, 2.6.0 to 2.6.7, and 3.0.0, the NetScaler file parser could crash. This was addressed in wi

In Wireshark 2.4.0 to 2.4.13, 2.6.0 to 2.6.7, and 3.0.0, the GSS-API dissector could crash. This was addressed in epan/d

An information disclosure vulnerability exists in the way that the Windows SMB Server handles certain requests, aka 'Win

A security feature bypass exists in Azure SSH Keypairs, due to a change in the provisioning logic for some Linux images

A remote code execution vulnerability exists when the Visual Studio C++ Redistributable Installer improperly validates i

An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in

An information disclosure vulnerability exists in the way Azure WaLinuxAgent creates swap files on resource disks, aka '

A spoofing vulnerability exists when a Lync Server or Skype for Business Server does not properly sanitize a specially c

An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in

A remote code execution vulnerability exists in the way that the ActiveX Data objects (ADO) handles objects in memory, a

A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet

An information disclosure vulnerability exists when the Windows kernel fails to properly initialize a memory address, ak

A remote code execution vulnerability exists in the way that Microsoft browsers access objects in memory, aka 'Microsoft

A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka 'Microsoft E

A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a speciall

A Cross-site Scripting (XSS) vulnerability exists when Team Foundation Server does not properly sanitize user provided i