2019

Reflected Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaSc

Reflected Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaSc

Self - Stored Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or Ja

Reflected Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, as multiple views under web/skins/classic/view

app/Core/Paginator.php in Kanboard before 1.2.8 has XSS in pagination sorting.

An issue was discovered in crop_page in PoDoFo 0.9.6. For a crafted PDF document, pPage->GetObject()->GetDictionary().Ad

Spice, versions 0.5.2 through 0.14.1, are vulnerable to an out-of-bounds read due to an off-by-one error in memslot_get_

Debian tmpreaper version 1.6.13+nmu1 has a race condition when doing a (bind) mount via rename() which could result in l

When using PySpark , it's possible for a different local user to connect to the Spark application and impersonate the us

GUP (generic update process) in LightySoft LogMX before 7.4.0 does not properly verify the authenticity of updates, whic

png_image_free in png.c in libpng 1.6.x before 1.6.37 has a use-after-free because png_image_free_function is called und

An issue was discovered in CSS-TRICKS Chat2 through 2015-05-05. The userid parameter in jumpin.php has a SQL injection v

liblivemedia in Live555 before 2019.02.03 mishandles the termination of an RTSP stream after RTP/RTCP-over-RTSP has been

www/resource.py in Buildbot before 1.8.1 allows CRLF injection in the Location header of /auth/login and /auth/logout vi

Limited plaintext disclosure exists in PRIMX Zed Entreprise for Windows before 6.1.2240, Zed Entreprise for Windows (ANS

In Poppler 0.73.0, a heap-based buffer over-read (due to an integer signedness error in the XRef::getEntry function in X

In the GNU C Library (aka glibc or libc6) through 2.29, the memcmp function for the x32 architecture can incorrectly ret

kernel/bpf/verifier.c in the Linux kernel before 4.20.6 performs undesirable out-of-bounds speculation on pointer arithm

LCDS Laquis SCADA prior to version 4.1.0.4150 allows out of bounds read when opening a specially crafted project file, w

A path traversal vulnerability was found in module static-resource-server 1.7.2 that allows unauthorized read access to

A prototype pollution vulnerability was found in module extend <2.0.2, ~<3.0.2 that allows an attacker to inject arbitra

A prototype pollution vulnerability was found in node.extend <1.1.7, ~<2.0.1 that allows an attacker to inject arbitrary

A prototype pollution vulnerability was found in module mpath <0.5.1 that allows an attacker to inject arbitrary propert

A prototype pollution vulnerability was found in just-extend <4.0.0 that allows attack to inject properties onto Object.

A prototype pollution vulnerability was found in lodash <4.17.11 where the functions merge, mergeWith, and defaultsDeep

A prototype pollution vulnerability was found in defaults-deep <=0.2.4 that would allow a malicious user to inject prope

Path Traversal vulnerability in module m-server <1.4.1 allows malicious user to access unauthorized content of any file

A XSS vulnerability was found in module m-server <1.4.2 that allows malicious Javascript code or HTML to be executed, du

A deficiency in the access control in module express-cart <=1.1.5 allows unprivileged users to add new users to the appl

A server directory traversal vulnerability was found on node module mcstatic <=0.0.20 that would allow an attack to acce

A XSS vulnerability was found in html-page <=2.1.1 that allows malicious Javascript code to be executed in the user's br

A XSS vulnerability was found in module public <0.1.4 that allows malicious Javascript code to run in the browser, due t

Path traversal vulnerability in http-live-simulator <1.0.7 causes unauthorized access to arbitrary files on disk by appe

Path Traversal vulnerability in Photo Station versions: 5.7.2 and earlier in QTS 4.3.4, 5.4.4 and earlier in QTS 4.3.3,

LCDS Laquis SCADA prior to version 4.1.0.4150 allows execution of script code by opening a specially crafted report form

Clustered Data ONTAP versions 9.0 through 9.4 are susceptible to a vulnerability which allows remote authenticated attac

In the Linux kernel before 4.9.3, fs/xfs/xfs_aops.c allows local users to cause a denial of service (system crash) becau

Cross-Site Request Forgery (CSRF) vulnerability in McAfee ePO (legacy) Cloud allows unauthenticated users to perform uni

A vulnerability in the "capro" (Call Processor) process component of Avaya Aura Communication Manager could allow a remo

Zen Load Balancer 3.10.1 allows remote authenticated admin users to execute arbitrary commands as root via shell metacha

Artica Proxy 3.06.200056 allows remote attackers to execute arbitrary commands as root by reading the ressources/setting

In Pylons Colander through 1.6, the URL validator allows an attacker to potentially cause an infinite loop thereby causi

An issue was discovered on D-Link DIR-823G devices with firmware through 1.02B03. A command Injection vulnerability allo

An issue was discovered on D-Link DIR-823G devices with firmware through 1.02B03. A command Injection vulnerability allo

typora through 0.9.64 has XSS, with resultant remote command execution, during inline rendering of a mathematical formul

typora through 0.9.63 has XSS, with resultant remote command execution, during block rendering of a mathematical formula

A reliance on a static, hard-coded credential in the design of the cloud-based storage system of Practecol's Guardzilla

The product CMS-770 (Software Versions 1.7.1 and prior)is vulnerable that an attacker can read sensitive configuration f

NVIDIA Tegra Gralloc module contains a vulnerability in driver in which it does not validate input parameter of the regi

In OpenJDK + Eclipse OpenJ9 version 0.11.0 builds, the public jdk.crypto.jniprovider.NativeCrypto class contains public