2019

An issue was discovered in TitanHQ WebTitan before 5.18. It has a sudoers file that enables low-privilege users to execu

Anviz CrossChex access control management software 4.3.8.0 and 4.3.12 is vulnerable to a buffer overflow vulnerability.

Due to unencrypted and unauthenticated data communication, the wireless barcode scanner Inateck BCST-60 is prone to keys

Anviz access control devices allow unverified password change which allows remote attackers to change the administrator

Anviz access control devices are vulnerable to replay attacks which could allow attackers to intercept and replay open d

Anviz access control devices allow remote attackers to issue commands without a password.

The Anviz Management System for access control has insufficient logging for device events such as door open requests.

Anviz access control devices expose private Information (pin code and name) by allowing remote attackers to query this i

Anviz access control devices expose credentials (names and passwords) by allowing remote attackers to query this informa

Anviz access control devices perform cleartext transmission of sensitive information (passwords/pins and names) when rep

Code injection in pluginconfig.php in Image Uploader and Browser for CKEditor before 4.1.9 allows remote authenticated u

Trend Micro Security (Consumer) 2020 (v16.0.1221 and below) is affected by a DLL hijacking vulnerability that could allo

NAPC Xinet Elegant 6 Asset Library 6.1.655 allows Pre-Authentication SQL Injection via the /elegant6/login LoginForm[use

Django 2.1 before 2.1.15 and 2.2 before 2.2.8 allows unintended model editing. A Django model admin displaying inline re

Alfresco Enterprise before 5.2.5 allows stored XSS via an uploaded HTML document.

Kentico before 12.0.50 allows file uploads in which the Content-Type header is inconsistent with the file extension, lea

An issue was discovered in the Chat functionality of the TeamViewer desktop application 14.3.4730 on Windows. (The vendo

FreeSWITCH 1.6.10 through 1.10.1 has a default password in event_socket.conf.xml.

TestLink 1.9.19 has XSS via the lib/testcases/archiveData.php edit parameter, the index.php reqURI parameter, or the URI

LiteManager 4.5.0 has weak permissions (Everyone: Full Control) in the "LiteManagerFree - Server" folder, as demonstrate

SMPlayer 19.5.0 has a buffer overflow via a long .m3u file.

Remote Code Execution vulnerability in MuleSoft Mule CE/EE 3.x and API Gateway 2.x released before October 31, 2019 allo

An issue was discovered in OpenSC through 0.19.0 and 0.20.x through 0.20.0-rc3. libopensc/card-cac1.c mishandles buffer

An issue was discovered in OpenSC through 0.19.0 and 0.20.x through 0.20.0-rc3. libopensc/pkcs15-prkey.c has an incorrec

An issue was discovered in OpenSC through 0.19.0 and 0.20.x through 0.20.0-rc3. libopensc/card-setcos.c has an incorrect

An issue was discovered in amqp_handle_input in amqp_connection.c in rabbitmq-c 0.9.0. There is an integer overflow that

In Zmanda Management Console 3.3.9, ZMC_Admin_Advanced?form=adminTasks&action=Apply&command= allows CSRF, as demonstrate

An issue was discovered in tls_verify_crl in ProFTPD through 1.3.6b. A dereference of a NULL pointer may occur. This poi

Free Photo Viewer 1.3 allows remote attackers to execute arbitrary code via a crafted BMP and/or TIFF file that triggers

The CBC Gem application before 9.24.1 for Android and before 9.26.0 for iOS has Unencrypted Analytics.

The Anhui Huami Mi Fit application before 4.0.11 for Android has an Unencrypted Update Check.

Zabbix before 5.0 represents passwords in the users table with unsalted MD5.

relay_open in kernel/relay.c in the Linux kernel through 5.4.1 allows local users to cause a denial of service (such as

When GNOME Dia before 2019-11-27 is launched with a filename argument that is not a valid codepoint in the current encod

illumos, as used in OmniOS Community Edition before r151030y, allows a kernel crash via an application with multiple thr

The mpi_powm function in Libgcrypt before 1.6.3 and GnuPG before 1.4.19 allows attackers to obtain sensitive information

Libgcrypt before 1.6.3 and GnuPG before 1.4.19 does not implement ciphertext blinding for Elgamal decryption, which allo

Honor play smartphones with versions earlier than 9.1.0.333(C00E333R1P1T8) have an information disclosure vulnerability

Mate 20 RS smartphones with versions earlier than 9.1.0.135(C786E133R3P1) have an improper authorization vulnerability.

There is an information leak vulnerability in Huawei smart speaker Myna. When the smart speaker is paired with the cloud

Some Huawei home routers have an input validation vulnerability. Due to input parameter is not correctly verified, an at

Huawei Atlas 300, Atlas 500 have a buffer overflow vulnerability. A local, authenticated attacker may craft specific par

The PGP signature parsing in Module::Signature before 0.74 allows remote attackers to cause the unsigned portion of a SI

cabextract before 1.6 does not properly check for leading slashes when extracting files, which allows remote attackers t

verify_certificate_identity in the OpenSSL extension in Ruby before 2.0.0 patchlevel 645, 2.1.x before 2.1.6, and 2.2.x

Some Huawei home routers have an improper authorization vulnerability. Due to improper authorization of certain programs

HiSuite with 9.1.0.305 and earlier versions and 9.1.0.305(MAC) and earlier versions and HwBackup with earlier versions b

There is a use of insufficiently random values vulnerability in Huawei ViewPoint products. An unauthenticated, remote at

P30, P30 Pro, Mate 20 smartphones with software of versions earlier than ELLE-AL00B 9.1.0.193(C00E190R2P1), versions ear

P30, Mate 20, P30 Pro smartphones with software of versions earlier than ELLE-AL00B 9.1.0.193(C00E190R1P21), versions ea