2019

This external control of file name or path vulnerability allows remote attackers to access or modify system files. To fi

This improper input validation vulnerability allows remote attackers to inject arbitrary code to the system. To fix the

This improper access control vulnerability allows remote attackers to gain unauthorized access to the system. To fix the

This cross-site scripting (XSS) vulnerability in Music Station allows remote attackers to inject and execute scripts on

This cross-site scripting (XSS) vulnerability in Video Station allows remote attackers to inject and execute scripts on

This improper link resolution vulnerability allows remote attackers to access system files. To fix this vulnerability, Q

SCEditor 2.1.3 allows XSS.

OpenStack nova base images permissions are world readable

Katello: Username in Notification page has cross site scripting

The chkstat tool in the permissions package followed symlinks before commit a9e1d26cd49ef9ee0c2060c859321128a6dd4230 (pl

reset/modules/advanced_form_maker_edit/multiupload/upload.php in the RESET.PRO Adobe Stock API integration 4.8 for Prest

reset/modules/fotoliaFoto/multi_upload.php in the RESET.PRO Adobe Stock API Integration for PrestaShop 1.6 and 1.7 allow

Intelbras IWR 3000N 1.8.7 devices allow disclosure of the administrator login name and password because v1/system/user i

beegfs-ctl in ThinkParQ BeeGFS through 7.1.3 allows Authentication Bypass via communication with a BeeGFS metadata serve

Improper input validation in Kubernetes CSI sidecar containers for external-provisioner (<v0.4.3, <v1.0.2, v1.1, <v1.2.2

Improper validation of URL redirection in the Kubernetes API server in versions prior to v1.14.0 allows an attacker-cont

haskell-tls-extra before 0.6.1 has Basic Constraints attribute vulnerability may lead to Man in the Middle attacks on TL

Improper Check for filenames with overly long extensions in PostMaster (sending in email) or uploading files (e.g. attac

An improper authentication check in Palo Alto Networks PAN-OS may allow an authenticated low privileged non-superuser cu

A vulnerability was found in keycloak 7.x, when keycloak is configured with LDAP user federation and StartTLS is used in

OpenShift haproxy cartridge: predictable /tmp in set-proxy connection hook which could facilitate DoS

fpregs_state_valid in arch/x86/include/asm/fpu/internal.h in the Linux kernel before 5.4.2, when GCC 9 is used, allows c

lookupName in resolve.c in SQLite 3.30.1 omits bits from the colUsed bitmask in the case of a generated column, which al

OpenDetex 2.8.5 has a Buffer Overflow in TexOpen in detex.l because of an incorrect sprintf.

D-Link DAP-1860 devices before v1.04b03 Beta allow access to administrator functions without authentication via the HNAP

D-Link DAP-1860 devices before v1.04b03 Beta allow arbitrary remote code execution as root without authentication via sh

The Lever PDF Embedder plugin 4.4 for WordPress does not block the distribution of polyglot PDF documents that are valid

GitBook through 2.6.9 allows XSS via a local .md file.

In radare2 through 4.0, there is an integer overflow for the variable new_token_size in the function r_asm_massemble at

The validators package 0.12.2 through 0.12.5 for Python enters an infinite loop when validators.domain is called with a

In Wireshark 3.0.0 to 3.0.6 and 2.6.0 to 2.6.12, the CMS dissector could crash. This was addressed in epan/dissectors/as

In WSO2 Enterprise Integrator 6.5.0, reflected XSS occurs when updating the message processor configuration from the sou

OpenBSD 6.6, in a non-default configuration where S/Key or YubiKey authentication is enabled, allows local users to beco

libc in OpenBSD 6.6 allows authentication bypass via the -schallenge username, as demonstrated by smtpd, ldapd, or radiu

xlock in OpenBSD 6.6 allows local users to gain the privileges of the auth group by providing a LIBGL_DRIVERS_PATH envir

In OpenBSD 6.6, local users can use the su -L option to achieve any login class (often excluding root) because there is

An issue was discovered in Xen through 4.12.x allowing attackers to gain host OS privileges via DMA in a situation where

An SQL Injection vulnerability exists in MiniDLNA prior to 1.1.0

An issue was discovered in Decentralized Anonymous Payment System (DAPS) through 2019-08-26. The content to be signed is

An issue was discovered in Decentralized Anonymous Payment System (DAPS) through 2019-08-26. It is possible to force wal

BMC Smart Reporting 7.3 20180418 allows authenticated XXE within the import functionality. One can import a malicious XM

A weak malicious user can escalate its privilege whenever CatalystProductionSuite.2019.1.exe (version 1.1.0.21) and Cata

admincgi-bin/service.fcgi on Fronius Solar Inverter devices before 3.14.1 (HM 1.12.1) allows action=download&filename= D

Fronius Solar Inverter devices before 3.14.1 (HM 1.12.1) allow attackers to bypass authentication because the password f

The CSS Hero plugin through 4.0.3 for WordPress is prone to reflected XSS via the URI in a csshero_action=edit_page requ

class.upload.php in verot.net class.upload before 1.0.3 and 2.x before 2.0.4, as used in the K2 extension for Joomla! an

A stored XSS issue was discovered in DAViCal through 1.1.8. It does not adequately sanitize output of various fields tha

A CSRF issue was discovered in DAViCal through 1.1.8. If an authenticated user visits an attacker-controlled webpage, th

The AsyncResponseWrapperImpl class in Apache Olingo versions 4.0.0 to 4.6.0 reads the Retry-After header and passes it t

An unquoted service path vulnerability is reported to affect the service QVssService in QNAP NetBak Replicator. This vul