2019

Vulnerability in the Oracle Application Testing Suite component of Oracle Enterprise Manager Products Suite (subcomponen

Vulnerability in the Enterprise Manager Base Platform component of Oracle Enterprise Manager Products Suite (subcomponen

Vulnerability in the Oracle Retail Merchandising System component of Oracle Retail Applications (subcomponent: Security

An issue was discovered in cairo 1.16.0. There is an infinite loop in the function _arc_error_normalized in the file cai

An issue was discovered in cairo 1.16.0. There is an assertion problem in the function _cairo_arc_in_direction in the fi

An issue was discovered in GNU Recutils 1.8. There is a NULL pointer dereference in the function rec_field_set_name() in

An issue was discovered in GNU Recutils 1.8. There is a memory leak in rec_extract_type in rec-utils.c in librec.a.

An issue was discovered in GNU Recutils 1.8. There is a memory leak in rec_buf_new in rec-buf.c when called from rec_par

An issue was discovered in GNU Recutils 1.8. There is a memory leak in rec_aggregate_reg_new in rec-aggregate.c in libre

An issue was discovered in GNU Recutils 1.8. There is a NULL pointer dereference in the function rec_fex_size() in the f

An issue was discovered in GNU Recutils 1.8. There is a double-free problem in the function rec_mset_elem_destroy() in t

A cross-site scripting (XSS) vulnerability exists in host.php (via tree.php) in Cacti before 1.2.0 due to lack of escapi

A cross-site scripting (XSS) vulnerability exists in graph_templates.php in Cacti before 1.2.0 due to lack of escaping o

A cross-site scripting (XSS) vulnerability exists in pollers.php in Cacti before 1.2.0 due to lack of escaping of uninte

A cross-site scripting (XSS) vulnerability exists in color_templates.php in Cacti before 1.2.0 due to lack of escaping o

MailEnable before 8.60 allows XXE via an XML document in the request.aspx Options parameter.

MailEnable before 8.60 allows Stored XSS via malformed use of "<img/src" with no ">" character in the body of an e-mail

MailEnable before 8.60 allows Privilege Escalation because admin accounts could be created as a consequence of %0A misha

MailEnable before 8.60 allows Directory Traversal for reading the messages of other users, uploading files, and deleting

SmarterTools SmarterMail before 13.3.5535 was vulnerable to stored XSS by bypassing the anti-XSS mechanisms. It was poss

The ES File Explorer File Manager application through 4.1.9.7.4 for Android allows remote attackers to read arbitrary fi

URI_FUNC() in UriParse.c in uriparser before 0.9.1 has an out-of-bounds read (in uriParse*Ex* functions) for an incomple

An issue was discovered in Joomla! before 3.9.2. Inadequate escaping in mod_banners leads to a stored XSS vulnerability.

An issue was discovered in Joomla! before 3.9.2. Inadequate checks of the Global Configuration Text Filter settings allo

An issue was discovered in Joomla! before 3.9.2. Inadequate checks of the Global Configuration helpurl settings allowed

An issue was discovered in Joomla! before 3.9.2. Inadequate escaping in com_contact leads to a stored XSS vulnerability.

An issue was discovered in NumPy before 1.16.3. It uses the pickle Python module unsafely, which allows remote attackers

An issue was discovered in NTPsec before 1.1.3. An authenticated attacker can cause a NULL pointer dereference and ntpd

An issue was discovered in NTPsec before 1.1.3. process_control() in ntp_control.c has a stack-based buffer over-read be

An issue was discovered in NTPsec before 1.1.3. Because of a bug in ctl_getitem, there is a stack-based buffer over-read

An issue was discovered in NTPsec before 1.1.3. An authenticated attacker can write one byte out of bounds in ntpd via a

Zemana AntiMalware before 3.0.658 Beta mishandles update logic.

Zenbership v107 has CSRF via admin/cp-functions/event-add.php.

Serendipity 2.0.4 has XSS via the serendipity_admin.php serendipity[body] parameter.

examples/benchmark/tls_bench.c in a benchmark tool in wolfSSL through 3.15.7 has a heap-based buffer overflow.

ABB Relion 630 devices 1.1 before 1.1.0.C0, 1.2 before 1.2.0.B3, and 1.3 before 1.3.0.A6 allow remote attackers to cause

The implementations of streams for bz2 and php://output improperly implemented their readImpl functions, returning -1 co

Wangle's AcceptRoutingHandler incorrectly casts a socket when accepting a TLS 1.3 connection, leading to a potential den

In Drupal's 3rd party module search auto complete prior to versions 7.x-4.8 there is a Cross Site Scripting vulnerabilit

The function number_format is vulnerable to a heap overflow issue when its second argument ($dec_points) is excessively

Juniper ATP uses DES and a hardcoded salt for password hashing, allowing for trivial de-hashing of the password file con

Juniper ATP Series Splunk credentials are logged in a file readable by authenticated local users. Using these credential

A persistent cross-site scripting (XSS) vulnerability in the Snort Rules configuration of Juniper ATP may allow authenti

A persistent cross-site scripting (XSS) vulnerability in the Zone configuration of Juniper ATP may allow authenticated u

A persistent cross-site scripting (XSS) vulnerability in RADIUS configuration menu of Juniper ATP may allow authenticate

A persistent cross-site scripting (XSS) vulnerability in the Email Collectors menu of Juniper ATP may allow authenticate

A persistent cross-site scripting (XSS) vulnerability in the Golden VM menu of Juniper ATP may allow authenticated user

Juniper ATP ships with hard coded credentials in the Cyphort Core instance which gives an attacker the ability to take f

On Juniper ATP, secret passphrase CLI inputs, such as "set mcm", are logged to /var/log/syslog in clear text, allowing a

Juniper ATP ships with hard coded credentials in the Web Collector instance which gives an attacker the ability to take