2019

An information disclosure vulnerability exists when the Windows Hyper-V Network Switch on a host operating system fails

A tampering vulnerability exists in Microsoft Windows when a man-in-the-middle attacker is able to successfully bypass t

A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a speciall

A vulnerability has been identified in SIMATIC IT UADM (All versions < V1.3). An authenticated remote attacker with netw

A spoofing vulnerability exists when Microsoft Browsers does not properly parse HTTP content, aka 'Microsoft Browser Spo

LavaLite through 5.7 has XSS via a crafted account name that is mishandled on the Manage Clients screen.

z-song laravel-admin 1.7.3 has XSS via the Slug or Name on the Roles screen, because of mishandling on the "Operation lo

An issue was discovered in fastadmin 1.0.0.20190705_beta. There is a public/admin/general.config/edit CSRF vulnerability

EyouCms through 2019-07-11 has XSS related to the login.php web_recordnum parameter.

The client-dash (aka Client Dash) plugin 2.1.4 for WordPress allows XSS.

The liquid-speech-balloon (aka LIQUID SPEECH BALLOON) plugin before 1.0.7 for WordPress allows XSS with Internet Explore

In Redmine before 3.4.11 and 4.0.x before 4.0.4, persistent XSS exists due to textile formatting errors.

In OISF LibHTP before 0.5.31, as used in Suricata 4.1.4 and other products, an HTTP protocol parsing error causes the ht

PbootCMS 2.0.2 allows XSS via vectors involving the Pboot/admin.php?p=/Single/index/mcode/1 and Pboot/?contact/ URIs.

Koji through 1.18.0 allows remote Directory Traversal, with resultant Privilege Escalation.

A security vulnerability exists in the Zingbox Inspector versions 1.294 and earlier, that can allow an attacker to easil

An issue was discovered in Zoho ManageEngine DataSecurity Plus before 5.0.1 5012. An exposed service allows a basic user

A path traversal vulnerability in NFX150 Series and QFX10K Series, EX9200 Series, MX Series and PTX Series devices with

The PKI keys exported using the command "run request security pki key-pair export" on Junos OS may have insecure file pe

An Unprotected Storage of Credentials vulnerability in the identity and access management certificate generation procedu

On EX4600, QFX5100 Series, NFX Series, QFX10K Series, QFX5110, QFX5200 Series, QFX5110, QFX5200, QFX10K Series, vSRX, SR

The SRX flowd process, responsible for packet forwarding, may crash and restart when processing specific multicast packe

Receipt of a specific link-local IPv6 packet destined to the RE may cause the system to crash and restart (vmcore). By c

On MX Series, when the SIP ALG is enabled, receipt of a certain malformed SIP packet may crash the MS-PIC component on M

When an MX Series Broadband Remote Access Server (BRAS) is configured as a Broadband Network Gateway (BNG) with DHCPv6 e

An Improper Certificate Validation weakness in the SRX Series Application Identification (app-id) signature update clien

SSL-Proxy feature on SRX devices fails to handle a hardware resource limitation which can be exploited by remote SSL/TLS

SnapManager for Oracle prior to version 3.4.2P1 are susceptible to a vulnerability which when successfully exploited cou

Clustered Data ONTAP versions 9.0 and higher do not enforce hostname verification under certain circumstances making the

Exiv2 0.27.2 allows attackers to trigger a crash in Exiv2::getULong in types.cpp when called from Exiv2::Internal::CiffD

An XSS vulnerability in project list in OpenProject before 9.0.4 and 10.x before 10.0.2 allows remote attackers to injec

A race condition which may occur when discarding malformed packets can result in BIND exiting due to a REQUIRE assertion

Controls for zone transfers may not be properly applied to Dynamically Loadable Zones (DLZs) if the zones are writable V

IBM Maximo Asset Management 7.6.1.1 generates an error message that includes sensitive information that could be used in

Improper access control vulnerability in Configuration tool in McAfee Endpoint Security (ENS) Prior to 10.6.1 October 20

Code Injection vulnerability in EPSetup.exe in McAfee Endpoint Security (ENS) Prior to 10.6.1 October 2019 Update allows

The animate-it plugin before 2.3.5 for WordPress has XSS.

The animate-it plugin before 2.3.4 for WordPress has XSS.

cPanel before 82.0.15 allows self XSS in the WHM Update Preferences interface (SEC-528).

cPanel before 82.0.15 allows self stored XSS in the WHM SSL Storage Manager interface (SEC-527).

cPanel before 82.0.15 allows self XSS in the SSL Key Delete interface (SEC-526).

cPanel before 82.0.15 allows self XSS in LiveAPI example scripts (SEC-524).

cPanel before 82.0.15 allows self XSS in the SSL Certificate Upload interface (SEC-521).

An issue was discovered in the RENPHO application 3.0.0 for iOS. It transmits JSON data unencrypted to a server without

On certain Samsung P(9.0) phones, an attacker with physical access can start a TCP Dump capture without the user's knowl

The MDM server component of TIBCO Software Inc's TIBCO MDM contains multiple vulnerabilities that theoretically allow an

"managed-keys" is a feature which allows a BIND resolver to automatically maintain the keys used by trust anchors which

gif2png 2.5.13 has a memory leak in the writefile function.

OTCMS v3.85 has CSRF in the admin/member_deal.php Admin Panel page, leading to creation of a new management group accoun

S-CMS v1.5 has XSS in tpl.php via the member/member_login.php from parameter.