2019

A vulnerability was discovered in vdsm, version 4.19 through 4.30.3 and 4.30.5 through 4.30.8. The systemd_run function

An incorrect permission check in the admin backend in gvfs before version 1.39.4 was found that allows reading and modif

A flaw was found in moodle versions 3.6 to 3.6.1, 3.5 to 3.5.3, 3.4 to 3.4.6, 3.1 to 3.1.15 and earlier unsupported vers

A flaw was found in Moodle versions 3.1 to 3.1.15 and earlier unsupported versions. The mybackpack functionality allowed

A flaw was found in Moodle versions 3.6 to 3.6.1, 3.5 to 3.5.3, 3.4 to 3.4.6, 3.1 to 3.1.15 and earlier unsupported vers

It was found that libreoffice before versions 6.0.7 and 6.1.3 was vulnerable to a directory traversal attack which could

A flaw was found in sssd Group Policy Objects implementation. When the GPO is not readable by SSSD due to a too strict p

In ovirt-engine 4.1, if a host was provisioned with cloud-init, the root password could be revealed through the REST int

Hospira Plum A+ Infusion System version 13.4 and prior, Plum A+3 Infusion System version 13.6 and prior, and Symbiq Infu

An issue was discovered in GitLab Community and Enterprise Edition before 11.4. It allows Directory Traversal.

Mitigates a remote code execution issue in ArcSight Logger versions prior to 6.7.

Mitigates a potential information leakage issue in ArcSight Logger versions prior to 6.7.

Mitigates a directory traversal issue in ArcSight Logger versions prior to 6.7.

Mitigates a XML External Entity Parsing issue in ArcSight Logger versions prior to 6.7.

Mitigates a stored/reflected XSS issue in ArcSight Logger versions prior to 6.7.

Mitigates a potential remote code execution issue in ArcSight Logger versions prior to 6.7.

Remote arbitrary code execution in Micro Focus Data Protector, version 10.03 this vulnerability could allow remote arbit

Hospira Plum A+ Infusion System version 13.4 and prior, Plum A+3 Infusion System version 13.6 and prior, and Symbiq Infu

Hard-coded accounts may be used to access Hospira Plum A+ Infusion System version 13.4 and prior, Plum A+3 Infusion Syst

ManageEngine ServiceDesk Plus before 9314 contains a local file inclusion vulnerability in the defModule parameter in De

ManageEngine ServiceDesk Plus before 9312 contains an XML injection at add Configuration items CMDB API.

Wireless keys are stored in plain text on Hospira Plum A+ Infusion System version 13.4 and prior, Plum A+3 Infusion Syst

GForge Advanced Server 6.4.4 allows XSS via the commonsearch.php words parameter, as demonstrated by a snippet/search/?w

PHPCMS 9.6.x through 9.6.3 has XSS via the mailbox (aka E-mail) field on the personal information screen.

An issue was discovered in Xpdf 4.01.01. There is an FPE in the function PostScriptFunction::exec in Function.cc for the

An issue was discovered in Xpdf 4.01.01. There is an FPE in the function ImageStream::ImageStream at Stream.cc for nBits

An issue was discovered in Xpdf 4.01.01. There is an FPE in the function Splash::scaleImageYuXu at Splash.cc for y Brese

An issue was discovered in Xpdf 4.01.01. There is an FPE in the function PostScriptFunction::exec at Function.cc for the

An issue was discovered in Xpdf 4.01.01. There is a NULL pointer dereference in the function Gfx::opSetExtGState in Gfx.

An issue was discovered in Xpdf 4.01.01. There is an FPE in the function ImageStream::ImageStream at Stream.cc for nComp

An issue was discovered in Xpdf 4.01.01. There is an FPE in the function Splash::scaleImageYuXu at Splash.cc for x Brese

An issue was discovered in Xpdf 4.01.01. There is an FPE in the function PSOutputDev::checkPageSlice at PSOutputDev.cc f

An issue was discovered in Xpdf 4.01.01. There is an FPE in the function PostScriptFunction::exec at Function.cc for the

CMS Made Simple 2.2.10 has XSS via the moduleinterface.php Name field, which is reachable via an "Add a new Profile" act

baigoStudio baigoSSO v3.0.1 allows remote attackers to execute arbitrary PHP code via the first form field of a configur

In DedeCMS 5.7SP2, member/resetpassword.php allows remote authenticated users to reset the passwords of arbitrary users

Cross-site scripting (XSS) vulnerability in the PHP League CommonMark library before 0.18.3 allows remote attackers to i

The social-warfare plugin before 3.5.3 for WordPress has stored XSS via the wp-admin/admin-post.php?swp_debug=load_optio

The renderer process in the entertainment system on Tesla Model 3 vehicles mishandles JIT compilation, which allows atta

Open Whisper Signal (aka Signal-Desktop) through 1.23.1 and the Signal Private Messenger application through 4.35.3 for

XnView Classic 2.48 on Windows allows remote attackers to cause a denial of service (application crash) or possibly have

XnView Classic 2.48 on Windows allows remote attackers to cause a denial of service (application crash) or possibly have

XnView Classic 2.48 on Windows allows remote attackers to cause a denial of service (application crash) or possibly have

XnView Classic 2.48 on Windows allows remote attackers to cause a denial of service (application crash) or possibly have

XnView MP 0.93.1 on Windows allows remote attackers to cause a denial of service (application crash) or possibly have un

XnView MP 0.93.1 on Windows allows remote attackers to cause a denial of service (application crash) or possibly have un

XnView MP 0.93.1 on Windows allows remote attackers to cause a denial of service (application crash) or possibly have un

XnView MP 0.93.1 on Windows allows remote attackers to cause a denial of service (application crash) or possibly have un

The downloadZip function in application/controllers/admin/export.php in LimeSurvey through 3.16.1+190225 allows a relati

In ImageMagick 7.0.8-35 Q16, there is a stack-based buffer overflow in the function PopHexPixel of coders/ps.c, which al