2019

A potential vulnerability reported in ThinkPad USB-C Dock Firmware version 3.7.2 may allow a denial of service.

Zikula 1.3.0 build #3168 and probably prior has XSS flaw due to improper sanitization of the 'themename' parameter by se

masqmail 0.2.21 through 0.2.30 improperly calls seteuid() in src/log.c and src/masqmail.c that results in improper privi

On the x86-64 architecture, the GNU C Library (aka glibc) before 2.31 fails to ignore the LD_PREFER_MAP_32BIT_EXEC envir

When using an authentication mechanism other than PKI, when the user clicks Log Out in NiFi versions 1.0.0 to 1.9.2, NiF

When updating a Process Group via the API in NiFi versions 1.3.0 to 1.9.2, the response to the request includes all of i

The XMLFileLookupService in NiFi versions 1.3.0 to 1.9.2 allowed trusted users to inadvertently configure a potentially

lightdm before 0.9.6 writes in .dmrc and Xauthority files using root permissions while the files are in user controlled

foomatic-rip filter v4.0.12 and prior used insecurely creates temporary files for storage of PostScript data by renderin

In AngularJS before 1.7.9 the function `merge()` could be tricked into adding or modifying properties of `Object.prototy

foomatic-rip filter, all versions, used insecurely creates temporary files for storage of PostScript data by rendering t

Pixie versions 1.0.x before 1.0.3, and 2.0.x before 2.0.2 allow SQL Injection in the limit() function due to improper sa

Cloud Foundry Routing, all versions before 0.193.0, does not properly validate nonce input. A remote unauthenticated mal

ktsuss versions 1.4 and prior spawns the GTK interface to run as root. This can allow a local attacker to escalate privi

Unbound 1.6.4 through 1.9.4 contain a vulnerability in the ipsec module that can cause shell code execution after receiv

Node-cookie-signature before 1.0.6 is affected by a timing attack due to the type of comparison used.

RubyGems passenger 4.0.0 betas 1 and 2 allows remote attackers to delete arbitrary files during the startup process.

nuSOAP before 0.7.3-5 does not properly check the hostname of a cert.

Falconpl before 0.9.6.9-git20120606 misuses the libcurl API which may allow remote attackers to interfere with security

ktsuss versions 1.4 and prior has the uid set to root and does not drop privileges prior to executing user specified com

Multiple Stack-based Buffer Overflow vulnerabilities exists in Sniffit prior to 0.3.7 via a crafted configuration file t

uzbl: Information disclosure via world-readable cookies storage file

gnusound 0.7.5 has format string issue

nginx http proxy module does not verify peer identity of https origin server which could facilitate man-in-the-middle at

tog-Pegasus has a package hash collision DoS vulnerability

cobbler has local privilege escalation via the use of insecure location for PYTHON_EGG_CACHE

cobbler: Web interface lacks CSRF protection when using Django framework

mpack 1.6 has information disclosure via eavesdropping on mails sent by other users

hhvm before 3.12.11 has a use-after-free in the serialize_memoize_param() and ResourceBundle::__construct() functions.

surf: cookie jar has read access from other local user

Code42 server through 7.0.2 for Windows has an Untrusted Search Path. In certain situations, a non-administrative attack

Code42 app through version 7.0.2 for Windows has an Untrusted Search Path. In certain situations, a non-administrative a

Apache Shiro before 1.4.2, when using the default "remember me" configuration, cookies could be susceptible to a padding

Trusted Boot (tboot) before 1.8.2 has a 'loader.c' Security Bypass Vulnerability

/usr/lib/lua/luci/controller/admin/autoupgrade.lua on PHICOMM K2(PSG1218) V22.5.9.163 devices allows remote authenticate

In elliptic-php versions priot to 1.0.6, Timing attacks might be possible which can result in practical recovery of the

Cross-site Scripting (XSS) in Jenkins main before 1.482 and LTS before 1.466.2 allows remote attackers to inject arbitra

Cross-site Scripting (XSS) in Jenkins main before 1.482 and LTS before 1.466.2 allows remote attackers to inject arbitra

A symlink issue exists in Iceweasel-firegpg before 0.6 due to insecure tempfile handling.

Norton App Lock, prior to 1.4.0.503, may be susceptible to a bypass exploit. In this type of circumstance, the exploit c

XXE attack vulnerability on Micro Focus Operations Agent, affected version 12.0, 12.01, 12.02, 12.03, 12.04, 12.05, 12.0

Multiple cross-site scripting (XSS) vulnerabilities in Mailbird before 2.7.5.0 r allow remote attackers to execute arbit

The 8.1.1 and 8.2.0 releases of Apache Solr contain an insecure setting for the ENABLE_REMOTE_JMX_OPTS configuration opt

Apache Atlas versions 0.8.3 and 1.1.0 were found vulnerable to Stored Cross-Site Scripting in the search functionality

Cross-site Scripting (XSS) in Jenkins main before 1.482 and LTS before 1.466.2 allows remote attackers to inject arbitra

Jenkins main before 1.482 and LTS before 1.466.2 allows remote attackers with read access and HTTP access to Jenkins mas

An issue was discovered in signmgr.dll 6.5.0.819 in Comodo Internet Security through 12.0. A DLL Preloading vulnerabilit

pimcore/pimcore before 6.3.0 is vulnerable to SQL Injection. An attacker with limited privileges (classes permission) ca

authentication issues vulnerability, which exists in V2.1.14 and below versions of C520V21 smart camera devices. An atta

permission and access control vulnerability, which exists in V2.1.14 and below versions of C520V21 smart camera devices.