2019

RoxyFileman, as shipped with nopCommerce v4.2.0, is vulnerable to ../ path traversal via d or f to Admin/RoxyFileman/Pro

An issue was discovered in libsixel 1.8.2. There is a heap-based buffer overflow in the function load_pnm at frompnm.c,

An issue was discovered in libsixel 1.8.2. There is an integer overflow in the function sixel_decode_raw_impl at fromsix

An issue was discovered in libsixel 1.8.2. There is an integer overflow in the function sixel_encode_body at tosixel.c.

An issue was discovered in libsixel 1.8.2. There is a heap-based buffer overflow in the function sixel_decode_raw_impl a

safer-eval is a npm package to sandbox the he evaluation of code used within the eval function. Affected versions of thi

Insufficient checks in the USB packet handling of the ShapeShift KeepKey hardware wallet before firmware 6.2.2 allow out

An issue was discovered on Weidmueller IE-SW-VL05M 3.6.6 Build 16102415, IE-SW-VL08MT 3.5.2 Build 16102415, and IE-SW-PL

An issue was discovered on Weidmueller IE-SW-VL05M 3.6.6 Build 16102415, IE-SW-VL08MT 3.5.2 Build 16102415, and IE-SW-PL

An issue was discovered on Weidmueller IE-SW-VL05M 3.6.6 Build 16102415, IE-SW-VL08MT 3.5.2 Build 16102415, and IE-SW-PL

The username parameter of the TITool PrintMonitor solution during the login request is vulnerable to and/or time-based b

OpenSLP as used in ESXi and the Horizon DaaS appliances has a heap overwrite issue. VMware has evaluated the severity of

In all versions of libyang before 1.0-r5, a stack-based buffer overflow was discovered in the way libyang parses YANG fi

In all versions of libyang before 1.0-r5, a stack-based buffer overflow was discovered in the way libyang parses YANG fi

phpMyAdmin before 4.9.2 does not escape certain Git information, related to libraries/classes/Display/GitRevision.php an

This external control of file name or path vulnerability allows remote attackers to access or modify system files. To fi

This external control of file name or path vulnerability allows remote attackers to access or modify system files. To fi

This improper input validation vulnerability allows remote attackers to inject arbitrary code to the system. To fix the

This improper access control vulnerability allows remote attackers to gain unauthorized access to the system. To fix the

This improper link resolution vulnerability allows remote attackers to access system files. To fix this vulnerability, Q

reset/modules/advanced_form_maker_edit/multiupload/upload.php in the RESET.PRO Adobe Stock API integration 4.8 for Prest

reset/modules/fotoliaFoto/multi_upload.php in the RESET.PRO Adobe Stock API Integration for PrestaShop 1.6 and 1.7 allow

beegfs-ctl in ThinkParQ BeeGFS through 7.1.3 allows Authentication Bypass via communication with a BeeGFS metadata serve

A vulnerability was found in keycloak 7.x, when keycloak is configured with LDAP user federation and StartTLS is used in

lookupName in resolve.c in SQLite 3.30.1 omits bits from the colUsed bitmask in the case of a generated column, which al

The Lever PDF Embedder plugin 4.4 for WordPress does not block the distribution of polyglot PDF documents that are valid

libc in OpenBSD 6.6 allows authentication bypass via the -schallenge username, as demonstrated by smtpd, ldapd, or radiu

An SQL Injection vulnerability exists in MiniDLNA prior to 1.1.0

Fronius Solar Inverter devices before 3.14.1 (HM 1.12.1) allow attackers to bypass authentication because the password f

class.upload.php in verot.net class.upload before 1.0.3 and 2.x before 2.0.4, as used in the K2 extension for Joomla! an

Apache Olingo versions 4.0.0 to 4.6.0 provide the AbstractService class, which is public API, uses ObjectInputStream and

In the course of decompressing HPACK inside the HTTP2 protocol, an unexpected sequence of header table resize operations

Various APC functions accept keys containing null bytes as input, leading to premature truncation of input. This issue a

Insufficient boundary checks when processing a string in mb_ereg_replace allows access to out-of-bounds memory. This iss

Improper handling of close_notify alerts can result in an out-of-bounds read in AsyncSSLSocket. This issue affects folly

An invalid free in mb_detect_order can cause the application to crash or potentially result in remote code execution. Th

This command injection vulnerability in File Station allows attackers to execute commands on the affected device. To fix

This command injection vulnerability in Music Station allows attackers to execute commands on the affected device. To fi

An exploitable code execution vulnerability exists in the processing of multi-part/form-data requests within the base Go

An issue was discovered in SALTO ProAccess SPACE 5.4.3.0. An attacker can write arbitrary content to arbitrary files, as

In OkayCMS through 2.3.4, an unauthenticated attacker can achieve remote code execution by injecting a malicious PHP obj

Zanata 3.0.0 through 3.1.2 has RCE due to EL interpolation in logging

An issue was discovered in TitanHQ WebTitan before 5.18. It has a hidden support account (with a hard-coded password) in

An issue was discovered in TitanHQ WebTitan before 5.18. The proxy service (which is typically exposed to all users) all

Anviz CrossChex access control management software 4.3.8.0 and 4.3.12 is vulnerable to a buffer overflow vulnerability.

Due to unencrypted and unauthenticated data communication, the wireless barcode scanner Inateck BCST-60 is prone to keys

Anviz access control devices allow unverified password change which allows remote attackers to change the administrator

Anviz access control devices allow remote attackers to issue commands without a password.

Code injection in pluginconfig.php in Image Uploader and Browser for CKEditor before 4.1.9 allows remote authenticated u

NAPC Xinet Elegant 6 Asset Library 6.1.655 allows Pre-Authentication SQL Injection via the /elegant6/login LoginForm[use