2019

In Medtronic Valleylab FT10 Energy Platform (VLFT10GEN) version 2.1.0 and lower and version 2.0.3 and lower, and Valleyl

The 9000EV5.0R1B12 version, and all earlier versions of ZTE product ZXUPN-9000E are impacted by the input validation vul

The 9000EV5.0R1B12 version, and all earlier versions of ZTE product ZXUPN-9000E are impacted by vulnerability of permiss

While investigating UBSAN errors in https://github.com/apache/arrow/pull/5365 it was discovered Apache Arrow versions 0.

It was discovered that the C++ implementation (which underlies the R, Python and Ruby implementations) of Apache Arrow 0

Escalation of privileges in EnergyCAP 7 through 7.5.6 allows an attacker to access data. If an unauthenticated user clic

A CSV injection in the codepress-admin-columns (aka Admin Columns) plugin 3.4.6 for WordPress allows malicious users to

JEUS 7 Fix#0~5 and JEUS 8Fix#0~1 versions contains a directory traversal vulnerability caused by improper input paramete

Brocade SANnav versions before v2.0, logs plain text database connection password while triggering support save.

A vulnerability, in The ReportsTrustManager class of Brocade SANnav versions before v2.0, could allow an attacker to per

Password-based encryption (PBE) algorithm, of Brocade SANnav versions before v2.0, has a weakness in generating cryptogr

Brocade SANnav versions before v2.0 use a hard-coded password, which could allow local authenticated attackers to access

The authentication mechanism, in Brocade SANnav versions before v2.0, logs plaintext account credentials at the ‘trace’

A vulnerability, in Brocade SANnav versions before v2.0, could allow remote attackers to brute-force a valid session ID.

In Tasy EMR, Tasy WebPortal Versions 3.02.1757 and prior, there is an information exposure vulnerability which may allow

mod_ruid2 before 0.9.8 improperly handles file descriptors which allows remote attackers to bypass security using a CGI

An information-exposure vulnerability was discovered where openstack-mistral's undercloud log files containing clear-tex

It was found that the Syndesis configuration for Cross-Origin Resource Sharing was set to allow all origins. An attacker

A flaw was found in the 'deref' plugin of 389-ds-base where it could use the 'search' permission to display attribute va

A flaw was found in the Ceph RGW configuration with Beast as the front end handling client requests. An unauthenticated

A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads

tuned before 2.x allows local users to kill running processes due to insecure permissions with tuned's ktune service.

The Atlassian Troubleshooting and Support Tools plugin prior to version 1.17.2 allows an unprivileged user to initiate p

Matrix Synapse before 1.5.0 mishandles signature checking on some federation APIs. Events sent over /send_join, /send_le

gri before 2.12.18 generates temporary files in an insecure way.

FireGPG before 0.6 handle user’s passphrase and decrypted cleartext insecurely by writing pre-encrypted cleartext and th

In JON 2.1.x before 2.1.2 SP1, users can obtain unauthorized security information about private resources managed by JBo

An access control issue in MantisBT before 1.2.13 allows users with "Reporter" permissions to change any issue to "New".

Gambas before 3.4.0 allows remote attackers to move or manipulate directory contents or perform symlink attacks due to t

The web server Monkeyd produces a world-readable log (/var/log/monkeyd/master.log) on gentoo.

frysk packages through 2008-08-05 as shipped in Red Hat Enterprise Linux 5 are built with an insecure RPATH set in the E

clamav 0.91.2 suffers from a floating point exception when using ScanOLE2.

strapi before 3.0.0-beta.17.5 mishandles password resets within packages/strapi-admin/controllers/Auth.js and packages/s

TWiki before 5.1.4 allows remote attackers to execute arbitrary shell commands by sending a crafted '%MAKETEXT{}%' param

Lintian before 2.5.12 allows remote attackers to gather information about the "host" system using crafted symlinks.

viewvc 1.0.3 allows improper access control to files in a repository when using the "forbidden" configuration option.

Mondo 2.24 has insecure handling of temporary files.

In Linux 2.6 before 2.6.23, the TRACE_IRQS_ON function in iret_exc calls a C function without ensuring that the segments

Eximious Logo Designer 3.82 has a User Mode Write AV starting at ExiCustomPathLib!ExiCustomPathLib::CGradientColorsProfi

Eximious Logo Designer 3.82 has Heap Corruption starting at ntdll!RtlpNtMakeTemporaryKey+0x0000000000001a78.

Eximious Logo Designer 3.82 has a User Mode Write AV starting at ExiVectorRender!StrokeText_Blend+0x00000000000003a7.

GNUBOARD5 5.3.1.9 has XSS that allows remote attackers to inject arbitrary web script or HTML via the "board tail conten

Cross-site Scripting (XSS) in Mahara before 1.5.9 and 1.6.x before 1.6.4 allows remote attackers to inject arbitrary web

ldap-git-backup before 1.0.4 exposes password hashes due to incorrect directory permissions.

syscp 1.4.2.1 allows attackers to add arbitrary paths via the documentroot of a domain by appending a colon to it and se

The keygen.sh script in Shibboleth SP 2.0 (located in /usr/local/etc/shibboleth by default) uses OpenSSL to create a DES

Rob Richards XmlSecLibs, all versions prior to v3.0.3, as used for example by SimpleSAMLphp, performed incorrect validat

The Sec Consult Security Lab reported an information disclosure vulnerability in MF910S product to ZTE PSIRT in October

Gource through 0.26 logs to a predictable file name (/tmp/gource-$UID.tmp), enabling attackers to overwrite an arbitrary

gitolite before 1.4.1 does not filter src/ or hooks/ from path names.