2019

Platform dependent weakness. This issue only impacts iSeries platforms. On these platforms, in BIG-IP (LTM, AAM, AFM, An

IBM API Connect 5.0.0.0 and 5.0.8.6 Developer Portal can be exploited by app developers to download arbitrary files from

IBM API Connect 5.0.0.0 and 5.0.8.6 Developer Portal is vulnerable to command injection. An attacker with a specially cr

IBM BigFix WebUI Profile Management 6 and Software Distribution 23 is vulnerable to SQL injection. A remote attacker cou

Moxa IKS-G6824A series Versions 4.5 and prior, EDS-405A series Version 3.8 and prior, EDS-408A series Version 3.8 and pr

Out-of-bounds read in Graphite2 Library in Firefox before 54 in graphite2::Silf::readGraphite function.

Within multiple XEROX products a vulnerability allows remote command execution on the Linux system, as the "nobody" user

A buffer overflow has been found in the Zephyr Project's getaddrinfo() implementation in 1.9.0 and 1.10.0.

An authentication bypass vulnerability in all versions of ValuePLUS Integrated University Management System (IUMS) allow

Auth0 Auth0-WCF-Service-JWT before 1.0.4 leaks the expected JWT signature in an error message when it cannot successfull

diag_tool.cgi on DASAN H660RM GPON routers with firmware 1.03-0022 lacks any authorization check, which allows remote at

An issue was discovered in JFrog Artifactory 6.7.3. By default, the access-admin account is used to reset the password o

All versions of SilverStripe 3 prior to 3.6.7 and 3.7.3, and all versions of SilverStripe 4 prior to 4.0.7, 4.1.5, 4.2.4

NVIDIA Jetson TX1 and TX2 contain a vulnerability in the Linux for Tegra (L4T) operating system (on all versions prior t

On D-Link DAP-1530 (A1) before firmware version 1.06b01, DAP-1610 (A1) before firmware version 1.06b01, DWR-111 (A1) bef

HP LaserJet Enterprise printers, HP PageWide Enterprise printers, HP LaserJet Managed printers, HP Officejet Enterprise

lighttpd before 1.4.54 has a signed integer overflow, which might allow remote attackers to cause a denial of service (a

The .NET SDK WebForm Viewer in SAP Crystal Reports for Visual Studio (fixed in version 2010) discloses sensitive databas

libxslt through 1.1.33 allows bypass of a protection mechanism because callers of xsltCheckRead and xsltCheckWrite permi

On Junos OS, rpcbind should only be listening to port 111 on the internal routing instance (IRI). External packets desti

When configuring a stateless firewall filter in Junos OS, terms named using the format "internal-n" (e.g. "internal-1",

A certain sequence of valid BGP or IPv6 BFD packets may trigger a stack based buffer overflow in the Junos OS Packet For

The getgrouplist function in the GNU C library (glibc) before version 2.3.5, when invoked with a zero argument, writes t

An issue was discovered in Joomla! before 3.9.5. The Media Manager component does not properly sanitize the folder param

An unauthenticated user can execute SQL statements that allow arbitrary read access to the underlying database, which ca

Cantemo Portal before 3.2.13, 3.3.x before 3.3.8, and 3.4.x before 3.4.9 has XSS. Leveraging this vulnerability would en

IBM BigFix Platform 9.5 could allow any authenticated user to upload any file to any location on the server with root pr

A configuration issue has been discovered in Forcepoint Email Security 8.4.x and 8.5.x: the product is left in a vulnera

An elevation of privilege vulnerability exists when Windows Admin Center improperly impersonates operations in certain s

An elevation of privilege vulnerability exists in the Microsoft Server Message Block (SMB) Server when an attacker with

A stack-based buffer overflow in Forcepoint Email Security version 8.5 allows an attacker to craft malicious input and p

Architectural Information System 1.0 and earlier versions have a Stack-based buffer overflow, allows remote attackers to

Roxy Fileman 1.4.5 allows attackers to execute renamefile.php (aka Rename File), createdir.php (aka Create Directory), f

Silverpeas 5.15 through 6.0.2 is affected by an authenticated Directory Traversal vulnerability that can be triggered du

Advantech WebAccess 8.3.4 is vulnerable to file upload attacks via unauthenticated RPC call. An unauthenticated, remote

A memory corruption vulnerability exists in the Windows DHCP client when an attacker sends specially crafted DHCP respon

A memory corruption vulnerability exists in the Windows DHCP client when an attacker sends specially crafted DHCP respon

A memory corruption vulnerability exists in the Windows DHCP client when an attacker sends specially crafted DHCP respon

application\admin\controller\User.php in ThinkAdmin V4.0 does not prevent continued use of an administrator's cookie-bas

The VStarCam vstc.vscam.client library and vstc.vscam shared object, as used in the Eye4 application (for Android, iOS,

In GraphicsMagick 1.4 snapshot-20190322 Q8, there is a heap-based buffer over-read in the function ReadMIFFImage of code

In GraphicsMagick 1.4 snapshot-20190322 Q8, there is a stack-based buffer overflow in the function SVGStartElement of co

A file inclusion vulnerability exists in the confd.exe module in Honeywell Experion PKS R40x before R400.6, R41x before

An arbitrary memory write vulnerability exists in the dual_onsrv.exe module in Honeywell Experion PKS R40x before R400.6

Hanwha Techwin SRN-4000, SRN-4000 firmware versions prior to SRN4000_v2.16_170401, A specially crafted http request and

pubRsaDecryptSignedElementExt in MatrixSSL 4.0.1 Open, as used in Inside Secure TLS Toolkit, has a stack-based buffer ov

In Airsonic 10.2.1, RecoverController.java generates passwords via org.apache.commons.lang.RandomStringUtils, which uses

Airsonic 10.2.1 uses Spring's default remember-me mechanism based on MD5, with a fixed key of airsonic in GlobalSecurity

Advantech WebAccess/SCADA, Versions 8.3.5 and prior. Multiple command injection vulnerabilities, caused by a lack of pro

Advantech WebAccess/SCADA, Versions 8.3.5 and prior. Multiple stack-based buffer overflow vulnerabilities, caused by a l