2019

Session data between cluster nodes during cluster synchronization is not properly encrypted in Pulse Secure Pulse Connec

LOYTEC LGATE-902 6.3.2 devices allow Arbitrary file deletion.

Incorrect access control in the database manager component in Odoo Community 10.0 and 11.0 and Odoo Enterprise 10.0 and

Various Lexmark devices have a Buffer Overflow (issue 1 of 2).

Various Lexmark devices have a Buffer Overflow (issue 2 of 2).

On Telus Actiontec WEB6000Q v1.1.02.22 devices, an attacker can login with root level access with the user "root" and pa

The Quantenna WiFi Controller on Telus Actiontec WEB6000Q v1.1.02.22 allows login with root level access with the user "

Missing Access Control in the "Free Time" component of several Zyxel UAG, USG, and ZyWall devices allows a remote attack

A vulnerability in the web-based management interface of Cisco Data Center Network Manager (DCNM) could allow an unauthe

A vulnerability in the web-based management interface of Cisco Data Center Network Manager (DCNM) could allow an unauthe

In Couchbase Sync Gateway 2.1.2, an attacker with access to the Sync Gateway’s public REST API was able to issue additio

A vulnerability reported in Lenovo Service Bridge before version 4.1.0.1 could allow remote code execution.

A vulnerability reported in Lenovo Service Bridge before version 4.1.0.1 could allow remote code execution.

FeHelper through 2019-06-19 allows arbitrary code execution during a JSON format operation, as demonstrated by the {"a":

LiveZilla Server before 8.0.1.1 is vulnerable to SQL Injection in functions.internal.build.inc.php via the parameter p_d

An issue was discovered in Mongoose before 6.15. The parse_mqtt() function in mg_mqtt.c has a critical heap-based buffer

The ASUS HiVivo aspplication before 5.6.27 for ASUS Watch has Missing SSL Certificate Validation.

LiveZilla Server before 8.0.1.1 is vulnerable to SQL Injection in server.php via the p_ext_rse parameter.

Citrix AppDNA before 7 1906.1.0.472 has Incorrect Access Control.

The QMP guest_exec command in QEMU 4.0.0 and earlier is prone to OS command injection, which allows the attacker to achi

The QMP migrate command in QEMU version 4.0.0 and earlier is vulnerable to OS command injection, which allows the remote

Akamai CloudTest before 58.30 allows remote code execution.

SQL injection vulnerability in ChronoScan version 1.5.4.3 and earlier allows an unauthenticated attacker to execute arbi

The default configuration of glot-www through 2018-05-19 allows remote attackers to execute arbitrary code because glot-

OpenStack Magnum passes OpenStack credentials into the Heat templates creating its instances. While these should just be

On Shenzhen Cylan Clever Dog Smart Camera DOG-2W and DOG-2W-V4 devices, an attacker on the network can login remotely to

Check Point Endpoint Security Client for Windows, with the VPN blade, before version E80.83, starts a process without us

An issue was discovered in EthereumJ 1.8.2. There is Unsafe Deserialization in ois.readObject in mine/Ethash.java and de

The ASUS Vivobaby application before 1.1.09 for Android has Missing SSL Certificate Validation.

A vulnerability in Cisco Digital Network Architecture (DNA) Center could allow an unauthenticated, adjacent attacker to

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Supporte

BZ2_decompress in decompress.c in bzip2 through 1.0.6 has an out-of-bounds write when there are many selectors.

Delta Electronics DeviceNet Builder 2.04 has a User Mode Write AV starting at ntdll!RtlQueueWorkItem+0x00000000000005e3.

Delta Electronics DeviceNet Builder 2.04 has a User Mode Write AV starting at image00400000+0x000000000017a45e.

In getReadIndex and getWriteIndex of FifoControllerBase.cpp, there is a possible out-of-bounds write due to an integer o

In serviceDied of HalDeathHandlerHidl.cpp, there is a possible memory corruption due to a use after free. This could lea

RedwoodHQ 2.5.5 does not require any authentication for database operations, which allows remote attackers to create adm

SQL Injection exists in Twilio WEB To Fax Machine System 1.0 via the email or password parameter to login_check.php, or

SQL Injection exists in the Micro Deal Factory 2.4.0 component for Joomla! via the id parameter, or the PATH_INFO to myd

SQL Injection exists in the Dutch Auction Factory 2.0.2 component for Joomla! via the filter_order_Dir or filter_order p

SQL Injection exists in the Auction Factory 4.5.5 component for Joomla! via the filter_order_Dir or filter_order paramet

An Insufficient Access Control vulnerability (leading to credential disclosure) in coreconfigsnapshot.php (aka configura

VTech Storio Max before 56.D3JM6 allows remote command execution via shell metacharacters in an Android activity name. I

An issue was discovered in the update function in the wpForo Forum plugin before 1.5.2 for WordPress. A registered forum

EXCELLENT INFOTEK BiYan v1.57 ~ v2.8 allows an attacker to leak user information (Password) without being authenticated,

SQL injection exists in Scriptzee Hotel Booking Engine 1.0 via the hotels h_room_type parameter.

SQL injection exists in Scriptzee Flippa Marketplace Clone 1.0 via the site-search sortBy or sortDir parameter.

SQL injection exists in Scriptzee Education Website 1.0 via the college_list.html subject, city, or country parameter.

SQL Injection exists in the Jimtawl 2.2.7 component for Joomla! via the id parameter.

SQL Injection exists in the AMGallery 1.2.3 component for Joomla! via the filter_category_id parameter.