2019

An elevation of privilege vulnerability exists when the Diagnostics Hub Standard Collector Service improperly impersonat

A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Mi

An elevation of privilege vulnerability exists in the way that ws2ifsl.sys (Winsock) handles objects in memory, aka 'Win

An elevation of privilege vulnerability exists when the Windows Common Log File System (CLFS) driver improperly handles

A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka 'VBScrip

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Mi

Delta DCISoft 1.21 has a User Mode Write AV starting at CommLib!CCommLib::SetSerializeData+0x000000000000001b.

A remote code execution vulnerability exists in the Windows Remote Desktop Client when a user connects to a malicious se

A remote code execution vulnerability exists in the Windows Remote Desktop Client when a user connects to a malicious se

Delta Electronics TPEditor, Versions 1.94 and prior. Multiple out-of-bounds write vulnerabilities may be exploited by pr

Delta Electronics TPEditor, Versions 1.94 and prior. Multiple stack-based buffer overflow vulnerabilities may be exploit

Delta Electronics TPEditor, Versions 1.94 and prior. Multiple heap-based buffer overflow vulnerabilities may be exploite

The RSA Identity Governance and Lifecycle software and RSA Via Lifecycle and Governance products prior to 7.1.0 P08 cont

An issue was discovered in TeamViewer 14.2.2558. Updating the product as a non-administrative user requires entering adm

Dino before 2019-09-10 does not properly check the source of an MAM message in module/xep/0313_message_archive_managemen

Dino before 2019-09-10 does not check roster push authorization in module/roster/module.vala.

Dino before 2019-09-10 does not properly check the source of a carbons message in module/xep/0280_message_carbons.vala.

In the Eclipse Paho Java client library version 1.2.0, when connecting to an MQTT server using TLS and setting a host na

The driver in Micro-Star MSI Afterburner 4.6.2.15658 (aka RTCore64.sys and RTCore32.sys) allows any authenticated user t

McAfee Web Gateway (MWG) earlier than 7.8.2.13 is vulnerable to a remote attacker exploiting CVE-2019-9517, potentially

An issue was discovered in py-lmdb 0.97. There is a divide-by-zero error in the function mdb_env_open2 if mdb_env_read_h

An issue was discovered in py-lmdb 0.97. mdb_node_del does not validate a memmove in the case of an unexpected node->mn_

In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to edit an

TTLock devices do not properly restrict password-reset attempts, leading to incorrect access control and disclosure of s

Modifiable read only check box In Micro Focus Service Manager, versions 9.60p1, 9.61, 9.62. This vulnerability could be

HTTP cookie in Micro Focus Service manager, Versions 9.30, 9.31, 9.32, 9.33, 9.34, 9.35, 9.40, 9.41, 9.50, 9.51, 9.52, 9

In Couchbase Server 5.0.0, when an invalid Remote Cluster Certificate was entered as part of the reference creation, XDC

In Couchbase Server 4.6.3 and 5.5.0, secondary indexing encodes the entries to be indexed using collatejson. When index

In Supervisor through 4.0.2, an unauthenticated user can read log files or restart a service. Note: The maintainer respo

SAP Kernel (RFC), KRNL32NUC, KRNL32UC and KRNL64NUC before versions 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL64UC, before versi

Attackers may misuse an HTTP/REST endpoint of SAP HANA Extended Application Services (Advanced model), before version 1.

SAP NetWeaver Application Server Java Web Container, ENGINEAPI (before versions 7.10, 7.20, 7.30, 7.31, 7.40, 7.50) and

In SAP Business Objects Business Intelligence Platform, before versions 4.1, 4.2 and 4.3, some dynamic pages (like jsp)

The Recruitment module in Humanica Humatrix 7 1.0.0.203 and 1.0.0.681 allows an unauthenticated attacker to change the p

Solr versions 1.3.0 to 1.4.1, 3.1.0 to 3.6.2 and 4.0.0 to 4.10.4 are vulnerable to an XML resource consumption attack (a

The avada theme before 5.1.5 for WordPress has CSRF.

The sitebuilder-dynamic-components plugin through 1.0 for WordPress has PHP object injection via an AJAX request.

The examapp plugin 1.0 for WordPress has SQL injection via the wp-admin/admin.php?page=examapp_UserResult id parameter.

The jtrt-responsive-tables plugin before 4.1.2 for WordPress has SQL Injection via the admin/class-jtrt-responsive-table

The elementor plugin before 1.8.0 for WordPress has incorrect access control for internal functions.

Limesurvey before 3.17.14 uses an anti-CSRF cookie without the HttpOnly flag, which allows attackers to access a cookie

In Limesurvey before 3.17.14, admin users can access the plugin manager without proper permissions.

In Limesurvey before 3.17.14, admin users can view, update, or delete reserved menu entries without proper permissions.

In Limesurvey before 3.17.14, the entire database is exposed through browser caching.

An XML injection vulnerability was found in Limesurvey before 3.17.14 that allows remote attackers to import specially c

An issue was discovered in GitLab Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. The

An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x befor

An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x befor

An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x befor