2019

Escalation of privilege vulnerability in the Palo Alto Networks Twistlock console 19.07.358 and earlier allows a Twistlo

Memory corruption in PAN-OS 8.1.9 and earlier, and PAN-OS 9.0.3 and earlier will allow an administrative user to cause a

Path traversal vulnerability in Micro Focus Verastream Host Integrator (VHI), versions 7.7 SP2 and earlier, The vulnerab

An issue was discovered on D-Link DIR-823G devices with firmware V1.0.2B05. There is a command injection in HNAP1 (explo

An issue was discovered on D-Link DIR-823G devices with firmware V1.0.2B05. There is a command injection in HNAP1 (explo

An issue was discovered on D-Link DIR-823G devices with firmware V1.0.2B05. There is a command injection in HNAP1 (explo

An issue was discovered on D-Link DIR-823G devices with firmware V1.0.2B05. There is a command injection in HNAP1 (explo

An issue was discovered on D-Link DIR-823G devices with firmware V1.0.2B05. There is a command injection in HNAP1 (explo

All versions of the HTTPie package prior to version 1.0.3 are vulnerable to Open Redirect that allows an attacker to wri

There is Missing SSL Certificate Validation in the pw3270 terminal emulator before version 5.1.

Cuberite before 2019-06-11 allows webadmin directory traversal via ....// because the protection mechanism simply remove

Search Guard Kibana Plugin versions before 5.6.8-7 and before 6.x.y-12 had an issue that an authenticated Kibana user co

openITCOCKPIT before 3.7.1 allows deletion of files, aka RVID 4-445b21.

openITCOCKPIT before 3.7.1 has CSRF, aka RVID 2-445b21.

An issue was discovered in OpenWrt libuci (aka Library for the Unified Configuration Interface) before 15.05.1 as used o

cgi-bin/cmh/webcam.sh in Vera Edge Home Controller 1.7.4452 allows remote unauthenticated users to execute arbitrary OS

The import-users-from-csv-with-meta plugin before 1.14.0.3 for WordPress has CSRF.

The import-users-from-csv-with-meta plugin before 1.14.2.1 for WordPress has directory traversal.

In GalliumOS 3.0, CONFIG_SECURITY_YAMA is disabled but /etc/sysctl.d/10-ptrace.conf tries to set /proc/sys/kernel/yama/p

In Docker before 18.09.4, an attacker who is capable of supplying or manipulating the build path for the "docker build"

The posts-in-page plugin before 1.3.0 for WordPress has ic_add_posts template='../ directory traversal.

The onelogin-saml-sso plugin before 2.2.0 for WordPress has a hardcoded @@@nopass@@@ password for just-in-time provision

The wp-file-upload plugin before 3.0.0 for WordPress has insufficient restrictions on upload of php, js, pht, php3, php4

The wp-file-upload plugin before 2.7.1 for WordPress has insufficient restrictions on upload of .js files.

The wp-file-upload plugin before 2.5.0 for WordPress has insufficient restrictions on upload of .php files.

The webp-express plugin before 0.14.11 for WordPress has insufficient protection against arbitrary file reading.

The traceroute function on the TP-Link TL-WR840N v4 router with firmware through 0.9.1 3.16 is vulnerable to remote code

An issue was discovered in Ampache through 3.9.1. The search engine is affected by a SQL Injection, so any user able to

The wpgform plugin before 0.94 for WordPress has eval injection in the CAPTCHA calculation.

The wp-file-upload plugin before 3.4.1 for WordPress has insufficient restrictions on upload of .php.js files.

When the Elastic APM agent for Python versions before 5.1.0 is run as a CGI script, there is a variable name clash flaw

Improper Verification of a Cryptographic Signature in OpenPGP.js <=4.1.2 allows an attacker to pass off unsigned data as

Improper Verification of a Cryptographic Signature in OpenPGP.js <=4.1.2 allows an attacker to forge signed messages by

NLTK Downloader before 3.4.5 is vulnerable to a directory traversal, allowing attackers to write arbitrary files via a .

Mirasys VMS before V7.6.1 and 8.x before V8.3.2 mishandles the Download() method of AutoUpdateService in SMServer.exe, l

osCommerce 2.3.4.1 has an incomplete '.htaccess' for blacklist filtering in the "product" page. Remote authenticated adm

osCommerce 2.3.4.1 has an incomplete '.htaccess' for blacklist filtering in the "product" page. Because of this filter,

A cleartext transmission of sensitive information vulnerability is present in Hickory Smart Ethernet Bridge from Belwith

The ad-inserter plugin before 2.4.22 for WordPress has remote code execution.

The ad-inserter plugin before 2.4.20 for WordPress has path traversal.

The post-pay-counter plugin before 2.731 for WordPress has no permissions check for an update-settinga action.

The ebook-download plugin before 1.2 for WordPress has directory traversal.

The profile-builder plugin before 2.1.4 for WordPress has no access control for activating or deactivating addons via AJ

Sphinx Technologies Sphinx 3.1.1 by default has no authentication and listens on 0.0.0.0, making it exposed to the inter

The ninja-forms plugin before 3.2.15 for WordPress has parameter tampering.

The gallery-by-supsystic plugin before 1.8.6 for WordPress has CSRF.

Rapid7 Nexpose versions 6.5.50 and prior suffer from insufficient session expiration when an administrator performs a se

Valve Steam Client for Windows through 2019-08-20 has weak folder permissions, leading to privilege escalation (to NT AU

Valve Steam Client for Windows through 2019-08-16 allows privilege escalation (to NT AUTHORITY\SYSTEM) because local use

A DLL hijacking vulnerability exists in the Trend Micro Security's 2019 consumer family of products (v15) Folder Shield