2019

An issue was discovered on Teracue ENC-400 devices with firmware 2.56 and below. After successful authentication, the de

An issue was discovered on Teracue ENC-400 devices with firmware 2.56 and below. The login form passes user input direct

bin/statistics in TWiki 6.0.2 allows cross-site scripting (XSS) via the webs parameter.

Digi TransPort LR54 4.4.0.26 and possible earlier devices have Improper Input Validation that allows users with 'super'

AbanteCart 1.2.12 has reflected cross-site scripting (XSS) via the sort parameter, as demonstrated by a /apparel--access

Zenphoto 1.4.14 has multiple cross-site scripting (XSS) vulnerabilities via different URL parameters.

Podcast Generator 2.7 has stored cross-site scripting (XSS) via the URL addcategory parameter.

The function hso_get_config_data in drivers/net/usb/hso.c in the Linux kernel through 4.19.8 reads if_num from the USB d

SolarWinds Serv-U FTP Server 15.1.6.25 has reflected cross-site scripting (XSS) in the Web management interface via URL

The IBM Power 9 OP910, OP920, and FW910 boot firmware's bootloader is responsible for loading and validating the initial

Microweber 1.0.8 has reflected cross-site scripting (XSS) vulnerabilities.

An issue was discovered in Qt 5.11. A malformed PPM image causes a division by zero and a crash in qppmhandler.cpp.

Kentix MultiSensor-LAN 5.63.00 devices and previous allow Authentication Bypass via an Alternate Path or Channel.

HMS Industrial Networks Netbiter WS100 3.30.5 devices and previous have reflected XSS in the login form.

An issue was discovered on Systrome ISG-600C, ISG-600H, and ISG-800W 1.1-R2.1_TRUNK-20180914.bin devices. There is CSRF

An issue was discovered on Shenzhen Skyworth DT741 Converged Intelligent Terminal (G/EPON+IPTV) SDOTBGN1, DT721-cb SDOTB

In Webgalamb through 7.0, system/ajax.php functionality is supposed to be available only to the administrator. However,

In Webgalamb through 7.0, an arbitrary code execution vulnerability could be exploited remotely without authentication.

In Webgalamb through 7.0, log files are exposed to the internet with predictable files/logs/sql_error_log/YYYY-MM-DD-sql

In Webgalamb through 7.0, a system/ajax.php "wgmfile restore" directory traversal vulnerability could lead to arbitrary

wg7.php in Webgalamb 7.0 lacks security measures to prevent CSRF attacks, as demonstrated by wg7.php?options=1 to change

subscriber.php in Webgalamb through 7.0 is vulnerable to SQL injection via the Client-IP HTTP request header.

wg7.php in Webgalamb 7.0 makes opportunistic calls to htmlspecialchars() instead of using a templating engine with prope

The Simplenia Pages plugin 2.6.0 for Atlassian Bitbucket Server has XSS.

The WP-jobhunt plugin before version 2.4 for WordPress does not control AJAX requests sent to the cs_reset_pass() functi

The WP-jobhunt plugin before version 2.4 for WordPress does not control AJAX requests sent to the cs_employer_ajax_profi

The REST API in Wowza Streaming Engine 4.7.4.01 allows traversal of the directory structure and retrieval of a file via

OpenMRS before 2.24.0 is affected by an Insecure Object Deserialization vulnerability that allows an unauthenticated use

Webmin 1.890 has XSS via /config.cgi?webmin, the /shell/index.cgi history parameter, /shell/index.cgi?stripped=1, or the

ColossusCoinXT through 1.0.5 (a chain-based proof-of-stake cryptocurrency) allows a remote denial of service, exploitabl

The email-ingestion feature in Best Practical Request Tracker 4.1.13 through 4.4 allows denial of service by remote atta

A stored cross-site scripting (XSS) issue was discovered in ControlByWeb X-320M-I Web-Enabled Instrumentation-Grade Data

A Denial of Service (DOS) issue was discovered in ControlByWeb X-320M-I Web-Enabled Instrumentation-Grade Data Acquisiti

BMC Remedy Mid-Tier 7.1.00 and 9.1.02.003 for BMC Remedy AR System has Incorrect Access Control in ITAM forms, as demons

In Qemu 3.0.0, lsi_do_msgin in hw/scsi/lsi53c895a.c allows out-of-bounds access by triggering an invalid msg_len value.

internal/advanced_comment_system/index.php and internal/advanced_comment_system/admin.php in Advanced Comment System, ve

Attendance Monitoring System 1.0 has SQL Injection via the 'id' parameter to student/index.php?view=view, event/index.ph

SaltOS 3.1 r8126 contains a database download vulnerability.

A hidden backdoor on PATLITE NH-FB Series devices with firmware version 1.45 or earlier, NH-FV Series devices with firmw

An issue was discovered in SecurEnvoy SecurAccess 9.3.502. When put in Debug mode and used for RDP connections, the appl

KioWare Server version 4.9.6 and older installs by default to "C:\kioware_com" with weak folder permissions granting any

IBM WebSphere MQ 9.0.2, 9.0.3, 9.0.4, 9.0.5, 9.1.0.0, and 9.1.0.1 console is vulnerable to cross-site scripting. This vu

LayerBB 1.1.1 allows XSS via the titles of conversations (PMs).

LayerBB before 1.1.3 allows CSRF for adding a user via admin/new_user.php, deleting a user via admin/members.php/delete_

The Receptionist for iPad could allow a local attacker to obtain sensitive information, caused by an error in the contac

Envoy Passport for Android and Envoy Passport for iPhone could allow a local attacker to obtain sensitive information, c

Envoy Passport for Android and Envoy Passport for iPhone could allow a local attacker to obtain sensitive information, c

eVisitorPass contains default administrative credentials. An attacker could exploit this vulnerability to gain full acce

eVisitorPass could allow a local attacker to gain elevated privileges on the system, caused by an error while in kiosk m

eVisitorPass could allow a local attacker to gain elevated privileges on the system, caused by an error with the Virtual