2019

An issue was discovered in Xen through 4.12.x allowing ARM guest OS users to cause a denial of service via a XENMEM_add_

An issue was discovered in Xen through 4.12.x allowing ARM guest OS users to cause a denial of service or gain privilege

An issue was discovered in Xen through 4.12.x allowing x86 PV guest OS users to gain host OS privileges by leveraging ra

drbd8 allows local users to bypass intended restrictions for certain actions via netlink packets, similar to CVE-2009-37

A missing permission check was found in The CLI in JBoss Operations Network before 2.3.1 does not properly check permiss

An issue was discovered in Mooltipass Moolticute through v0.42.1 and v0.42.x-testing through v0.42.5-testing. There is a

ClipSoft REXPERT 1.0.0.527 and earlier version allows arbitrary file creation and execution via report print function of

Authentication bypass vulnerability in the the web interface in Hunt CCTV, Capture CCTV, Hachi CCTV, NoVus CCTV, and Wel

A cross-site request forgery (CSRF) vulnerability in Zucchetti InfoBusiness before and including 4.4.1 allows arbitrary

Zucchetti InfoBusiness before and including 4.4.1 allows any authenticated user to upload .php files in order to achieve

Aruba Instant 4.x prior to 6.4.4.8-4.2.4.12, 6.5.x prior to 6.5.4.11, 8.3.x prior to 8.3.0.6, and 8.4.x prior to 8.4.0.1

RDesktop version 1.8.4 contains multiple out-of-bound access read vulnerabilities in its code, which results in a denial

Logstash versions before 7.4.1 and 6.8.4 contain a denial of service flaw in the Logstash Beats input plugin. An unauthe

While backporting a feature for a newer branch of BIND9, RedHat introduced a path leading to an assertion failure in buf

The Debian backport of the fix for CVE-2017-3137 leads to assertion failure in validator.c:1858; Affects Debian versions

rpcbind 0.2.0 allows local users to write to arbitrary files or gain privileges via a symlink attack on (1) /tmp/portmap

rpcbind 0.2.0 does not properly validate (1) /tmp/portmap.xdr and (2) /tmp/rpcbind.xdr, which can be created by an attac

Mapserver 5.2, 5.4 and 5.6 before 5.6.5-2 improperly validates symbol index values during Mapfile parsing.

qtum through 0.16 (a chain-based proof-of-stake cryptocurrency) allows a remote denial of service. The attacker sends in

An issue was discovered in the Tightrope Media Carousel digital signage product 7.0.4.104. Due to insecure default permi

The Tightrope Media Carousel digital signage product 7.0.4.104 contains an arbitrary file upload vulnerability in the Ma

The Tightrope Media Carousel Seneca HDn Windows-based appliance 7.0.4.104 is shipped with a default local administrator

ikiwiki before 3.20110608 allows remote attackers to hijack root's tty and run symlink attacks.

An issue was discovered in LabKey Server 19.1.0. It is possible to force a logged-in administrator to execute code throu

An issue was discovered in LabKey Server 19.1.0. Sending an SVG containing an XXE payload to the endpoint visualization-

A CWE-538: File and Directory Information Exposure vulnerability exists in Modicon M580, Modicon M340, Modicon Premium ,

A CWE-200: Information Exposure vulnerability exists in Modicon M580, Modicon BMENOC 0311, and Modicon BMENOC 0321, whic

A CWE-200: Information Exposure vulnerability exists in Modicon M580, Modicon BMENOC 0311, and Modicon BMENOC 0321, whic

A CWE-755: Improper Handling of Exceptional Conditions vulnerability exists in Modicon M580 CPU (BMEx58*) and Modicon M5

A CWE-319: Cleartext Transmission of Sensitive Information vulnerability exists in Modicon M580, Modicon M340, Modicon P

RouterOS versions 6.45.6 Stable, 6.44.5 Long-term, and below are vulnerable to a DNS unrelated data attack. The router a

RouterOS versions 6.45.6 Stable, 6.44.5 Long-term, and below allow remote unauthenticated attackers to trigger DNS queri

RouterOS 6.45.6 Stable, RouterOS 6.44.5 Long-term, and below insufficiently validate where upgrade packages are download

RouterOS 6.45.6 Stable, RouterOS 6.44.5 Long-term, and below are vulnerable to an arbitrary directory creation vulnerabi

Cezerin v0.33.0 allows unauthorized order-information modification because certain internal attributes can be overwritte

OpenAFS before 1.6.24 and 1.8.x before 1.8.5 is prone to an information disclosure vulnerability because uninitialized s

OpenAFS before 1.6.24 and 1.8.x before 1.8.5 is prone to denial of service from unserialized data access because remote

Unquoted Search Path in Maxthon 5.1.0 to 5.2.7 Browser for Windows.

LibVNC commit before d01e1bb4246323ba6fcee3b82ef1faa9b1dac82a contains a memory leak (CWE-655) in VNC server code, which

TightVNC code version 1.3.10 contains null pointer dereference in HandleZlibBPP function, which results Denial of System

Postgresql Windows installer before versions 11.5, 10.10, 9.6.15, 9.5.19, 9.4.24 is vulnerable via superuser writing pas

A flaw was discovered in postgresql versions 9.4.x before 9.4.24, 9.5.x before 9.5.19, 9.6.x before 9.6.15, 10.x before

In Apache Thrift 0.9.3 to 0.12.0, a server implemented in Go using TJSONProtocol or TSimpleJSONProtocol may panic when f

In Apache Thrift all versions up to and including 0.12.0, a server or client may run into an endless loop when feed with

Hadoop 1.0.3 contains a symlink vulnerability.

mediawiki allows deleted text to be exposed

gpw generates shorter passwords than required

Cisco Video Communications Server (VCS) before X7.0.3 contains a command injection vulnerability which allows remote, au

asterisk allows calls on prohibited networks

After installing the IBM Maximo Health- Safety and Environment Manager 7.6.1, a user is granted additional privileges th