2019

An issue was discovered in JetBrains TeamCity 2018.2.4. A TeamCity Project administrator could get access to potentially

A local file disclosure flaw was found in Elastic Code versions 7.3.0, 7.3.1, and 7.3.2. If a malicious code repository

JetBrains Upsource before 2019.1.1412 was not properly escaping HTML tags in a code block comments, leading to XSS.

Catalog.cc in Xpdf 4.02 has a NULL pointer dereference because Catalog.pageLabels is initialized too late in the Catalog

In Snowtide PDFxStream before 3.7.1 (for Java), a crafted PDF file can trigger an extremely long running computation bec

The JetBrains Vim plugin before version 0.52 was storing individual project data in the global vim_settings.xml file. Th

In JetBrains Hub versions earlier than 2018.4.11436, there was no option to force a user to change the password and no p

JetBrains YouTrack versions before 2019.2.53938 had a possible XSS through issue attachments when using the Firefox brow

IBM Jazz Reporting Service (JRS) 6.0, 6.0.1, 6.0.2, 6.0.3, 6.0.4, 6.0.5, 6.0.6, and 6.0.6.1 is vulnerable to cross-site

IBM Jazz Reporting Service (JRS) 6.0, 6.0.1, 6.0.2, 6.0.3, 6.0.4, 6.0.5, 6.0.6, and 6.0.6.1 is vulnerable to cross-site

IBM Jazz Reporting Service (JRS) 6.0, 6.0.1, 6.0.2, 6.0.3, 6.0.4, 6.0.5, 6.0.6, and 6.0.6.1 is vulnerable to cross-site

IBM Daeja ViewONE Virtual 5.0 through 5.0.6 could expose internal parameters to ViewONE clients that could be used in fu

Pivotal Application Manager, versions 666.0.x prior to 666.0.36, versions 667.0.x prior to 667.0.22, versions 668.0.x pr

JetBrains IntelliJ IDEA before 2019.2 was resolving the markdown plantuml artifact download link via a cleartext http co

JetBrains YouTrack versions before 2019.1.52584 had a possible XSS in the issue titles.

Jenkins HTML Publisher Plugin 1.20 and earlier did not escape the project and build display names in the HTML report fra

RSA BSAFE Crypto-C Micro Edition, all versions prior to 4.1.4, is vulnerable to three (3) different Improper Clearing of

Cargo prior to Rust 1.26.0 may download the wrong dependency if your package.toml file uses the `package` configuration

Description: Western Digital SSD Dashboard before 2.5.1.0 and SanDisk SSD Dashboard before 2.5.1.0 applications are pote

Insufficient sanitization during device search in Netdisco 2.042010 allows for reflected XSS via manipulation of a URL p

IBM Sterling File Gateway 2.2.0.0 through 6.0.1.0 could allow a remote attacker to traverse directories on the system. A

IBM WebSphere Application Server Liberty could allow a remote attacker to obtain sensitive information caused by the imp

IBM WebSphere Application Server - Liberty could allow a remote attacker to bypass security restrictions caused by impro

IBM Sterling File Gateway 2.2.0.0 through 6.0.1.0 displays sensitive information in HTTP requests which could be used in

IBM WebSphere eXtreme Scale 8.6 Admin API is vulnerable to cross-site scripting. This vulnerability allows users to embe

IBM WebSphere eXtreme Scale 8.6 Admin Console could allow a remote attacker to hijack the clicking action of the victim.

IBM WebSphere eXtreme Scale 8.6 Admin Console is vulnerable to cross-site scripting. This vulnerability allows users to

An issue was discovered in the image-manager in Xoops 2.5.10. When any image with a JavaScript payload as its name is ho

An issue was discovered in the image-manager in Xoops 2.5.10. When the breadcrumb showing the category name is hovered o

Ilch 2.1.22 allows stored XSS via the title, text, or email id to the Jobs Tab.

In the Linux kernel before 5.0, a memory leak exists in sit_init_net() in net/ipv6/sit.c when register_netdev() fails to

A DOM based XSS in GFI Kerio Control v9.3.0 allows embedding of malicious code and manipulating the login page to send b

SuiteCRM 7.10.x and 7.11.x before 7.10.20 and 7.11.8 has XSS.

Zcashd in Zcash before 2.0.7-3 allows discovery of the IP address of a full node that owns a shielded address, related t

The documentation XML-RPC server in Python through 2.7.16, 3.x through 3.6.9, and 3.7.x through 3.7.4 has XSS via the se

Flower 0.9.3 has XSS via a crafted worker name. NOTE: The project author stated that he doesn't think this is a valid vu

Flower 0.9.3 has XSS via the name parameter in an @app.task call. NOTE: The project author stated that he doesn't think

Dell EMC Integrated Data Protection Appliance versions prior to 2.3 contain a stored cross-site scripting vulnerability.

Xpdf 4.01.01 has an out-of-bounds write in the vertProfile part of the TextPage::findGaps function in TextOutputDev.cc,

Dolibarr 9.0.5 has stored XSS in an Email Template section to mails_templates.php. A user with no privileges can inject

Dolibarr 9.0.5 has stored XSS in a User Profile in a Signature section to card.php. A user with the "Create/modify other

Dolibarr 9.0.5 has stored XSS in a User Note section to note.php. A user with no privileges can inject script to attack

Dolibarr 9.0.5 has stored XSS vulnerability via a User Group Description section to card.php. A user with the "Create/mo

In Bluetooth, there is a possible out of bounds read due to a missing bounds check. This could lead to local information

In Bluetooth, there is a possible out of bounds read due to a missing bounds check. This could lead to remote informatio

In libvpx, there is a possible information disclosure due to improper input validation. This could lead to remote inform

In Bluetooth, there is a possible out of bounds read due to a use after free. This could lead to remote information disc

In the Framework, it is possible to set up BROWSEABLE intents to take over certain URLs. This could lead to remote infor

In Bluetooth, there is a possible information disclosure due to a use after free. This could lead to local information d

In libandroidfw, there is a possible OOB read due to an integer overflow. This could lead to local information disclosur