2019

plugin-fw/lib/yit-plugin-panel-wc.php in the YIT Plugin Framework through 3.3.8 for WordPress allows authenticated optio

A security vulnerability exists in a management port in the version of ZTE's ZXMP M721V3.10P01B10_M2NCP. An attacker cou

In JetBrains YouTrack before 2019.2.55152, removing tags from the issues list without the corresponding permission was p

In JetBrains TeamCity before 2019.1.2, a non-destructive operation could be performed by a user without the correspondin

In JetBrains TeamCity before 2019.1.2, secure values could be exposed to users with the "View build runtime parameters a

In JetBrains TeamCity before 2019.1.4, reverse tabnabbing was possible on several pages.

Mumble: murmur-server has DoS due to malformed client query

In JetBrains TeamCity before 2019.1.2, access could be gained to the history of builds of a deleted build configuration

JetBrains MPS before 2019.2.2 exposed listening ports to the network.

JetBrains IntelliJ IDEA before 2019.2 allows local user privilege escalation, potentially leading to arbitrary code exec

In JetBrains Hub versions earlier than 2019.1.11738, username enumeration was possible through password recovery.

Jupyter Notebook before 5.5.0 does not use a CSP header to treat served files as belonging to a separate origin. Thus, f

An issue was discovered in Xen through 4.12.x allowing attackers to gain host OS privileges via DMA in a situation where

An issue was discovered in Xen through 4.12.x allowing x86 PV guest OS users to cause a denial of service via a VCPUOP_i

In Apak Wholesale Floorplanning Finance 6.31.8.3 and 6.31.8.5, an attacker can send an authenticated POST request with a

The quarantine restoration function in Total Defense Anti-virus 11.5.2.28 is vulnerable to symbolic link attacks, allowi

The malware scan function in Total Defense Anti-virus 11.5.2.28 is vulnerable to a TOCTOU bug; consequently, symbolic li

A cross-site scripting (XSS) vulnerability in ikiwiki before 3.20101112 allows remote attackers to inject arbitrary web

Transmission before 1.92 allows attackers to prevent download of a file by corrupted data during the endgame.

A malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript

The init script in autokey before 0.61.3-2 allows local attackers to write to arbitrary files via a symlink attack.

ClipSoft REXPERT 1.0.0.527 and earlier version allows remote attacker to arbitrary file deletion by issuing a HTTP GET r

ClipSoft REXPERT 1.0.0.527 and earlier version allows remote attacker to upload arbitrary local file via the ActiveX met

ClipSoft REXPERT 1.0.0.527 and earlier version allows directory traversal by issuing a special HTTP POST request with ..

ClipSoft REXPERT 1.0.0.527 and earlier version allows arbitrary file creation via a POST request with the parameter set

ClipSoft REXPERT 1.0.0.527 and earlier version have an information disclosure issue. When requesting web page associated

In xpdf, the xref table contains an infinite loop which allows remote attackers to cause a denial of service (applicatio

xpdf allows remote attackers to cause a denial of service (NULL pointer dereference and crash) in the way it processes J

In Zucchetti InfoBusiness before and including 4.4.1, an authenticated user can inject client-side code due to improper

Multiple Reflected Cross-site Scripting (XSS) vulnerabilities exist in Zucchetti InfoBusiness before and including 4.4.1

GNUBOARD5 before 5.3.2.0 has XSS that allows remote attackers to inject arbitrary web script or HTML via the "board grou

Elasticsearch versions 7.0.0-7.3.2 and 6.7.0-6.8.3 contain a username disclosure flaw was found in the API Key service.

An insecure direct object reference (IDOR) vulnerability exists in Magento 2.3 prior to 2.3.1, 2.2 prior to 2.2.8, and 2

An issue was discovered in LabKey Server 19.1.0. The display name of a user is vulnerable to stored XSS that can execute

A CWE-755: Improper Handling of Exceptional Conditions vulnerability exists in Modicon M580, Modicon M340, Modicon BMxCR

A CWE-319: Cleartext Transmission of Sensitive Information vulnerability exists in Modicon M580, Modicon M340, Modicon B

A CWE-755: Improper Handling of Exceptional Conditions vulnerability exists in Modicon M580, Modicon M340, Modicon BMxCR

A CWE-755: Improper Handling of Exceptional Conditions vulnerability exists in Modicon M580 with firmware (version prior

A CWE-755: Improper Handling of Exceptional Conditions vulnerability exists in Modicon M580, Modicon M340, Modicon BMxCR

A CWE-755: Improper Handling of Exceptional Conditions vulnerability exists in Modicon M580 with firmware (version prior

In VMware SD-WAN by VeloCloud versions 3.x prior to 3.3.0, the VeloCloud Orchestrator parameter authorization check mist

An issue was discovered in the AbuseFilter extension through 1.34 for MediaWiki. Previously hidden (restricted) AbuseFil

An issue was discovered in the CheckUser extension through 1.34 for MediaWiki. Certain sensitive information within over

OpenAFS before 1.6.24 and 1.8.x before 1.8.5 is prone to information leakage upon certain error conditions because unini

Sahi Pro 8.0.0 has a script manager arena located at _s_/dyn/pro/DBReports with many different areas that are vulnerable

All versions of archiver allow attacker to perform a Zip Slip attack via the "unarchive" functions. It is exploited usin

Reflected Cross-Site Scripting (XSS) vulnerability in the fabrik_referrer hidden field in the Fabrikar Fabrik component

A stack based buffer overflow vulnerability exists in the method receiving data from SysTreeView32 control of the GMER 2

Cross Site Scripting (XSS) in ikiwiki before 3.20110122 could allow remote attackers to insert arbitrary JavaScript due

Mercurial before 1.6.4 fails to verify the Common Name field of SSL certificates which allows remote attackers who acqui