2019

A vulnerability in the web application of Cisco TelePresence Advanced Media Gateway could allow an authenticated, remote

ClamAV versions prior to 0.101.3 are susceptible to a zip bomb vulnerability where an unauthenticated attacker can cause

Multiple CSRF issues in Horde Groupware Webmail Edition 5.1.2 and earlier in basic.php.

Cache Poisoning issue exists in DNS Response Rate Limiting.

The Windows component of Centrify Authentication and Privilege Elevation Services 3.4.0, 3.4.1, 3.4.2, 3.4.3, 3.5.0, 3.5

An integer overflow was discovered in the CoAP library in Arm Mbed OS 5.14.0. The function sn_coap_builder_calc_needed_p

An issue was discovered in OXID eShop 6.x before 6.0.6 and 6.1.x before 6.1.5, OXID eShop Enterprise Edition Version 5.2

An issue was discovered in Lightbend Play Framework 2.5.x through 2.6.23. When configured to make requests using an auth

Buffer overflows were discovered in the CoAP library in Arm Mbed OS 5.14.0. The CoAP parser is responsible for parsing r

Nokogiri gem 1.5.x and 1.6.x has DoS while parsing XML entities by failing to apply limits

Nokogiri gem 1.5.x has Denial of Service via infinite loop when parsing XML documents

PhantomJS through 2.1.1 has an arbitrary file read vulnerability, as demonstrated by an XMLHttpRequest for a file:// URI

gdm3 3.14.2 and possibly later has an information leak before screen lock

Horde Groupware Web mail 5.1.2 has CSRF with requests to change permissions

Horde Groupware Webmail Edition has CSRF and XSS when saving search as a virtual address book

Cryptocat has an Unspecified Chat Participant User List Disclosure

Cryptocat before 2.0.22: cryptocat.js handlePresence() has cross site scripting

A security issue was discovered in the kube-state-metrics versions v1.7.0 and v1.7.1. An experimental feature was added

Open Build Service before version 0.165.4 diddn't validate TLS certificates for HTTPS connections with the osc client bi

TYPO3 before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 allows XSS and Open Redirection in the frontend login box

TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 allows Header Injection in the secur

An insecurity temporary file vulnerability exists in RHQ Mongo DB Drift Server through 2013-09-25 when unpacking zipped

TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 allows Spam Abuse in the native form

TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 contains insecure randomness in the

TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 allows XSS on the Extension Manager.

TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 allows Information Disclosure on the

TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 contains an insecure default value o

TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 allows SQL Injection on the backend.

Integer overflow in the extract_group_icon_cursor_resource function in b/wrestool/extract.c in icoutils before 0.31.1 al

The extract_group_icon_cursor_resource in wrestool/extract.c in icoutils before 0.31.1 can access unallocated memory, wh

Integer overflow in the check_offset function in b/wrestool/fileread.c in icoutils before 0.31.1 allows local users to c

The plural form formula in ngettext family of calls in php-gettext before 1.0.12 allows remote attackers to execute arbi

An eval() vulnerability exists in Python Software Foundation Djblets 0.7.21 and Beanbag Review Board before 1.7.15 when

A SQL injection vulnerability in a /login/forgot1 POST request in ARP-GUARD 4.0.0-5 allows unauthenticated remote attack

Real Time Engineers FreeRTOS+FAT 160919a has a use after free. The function FF_Close() is defined in ff_file.c. The file

A denial-of-service issue was discovered in the MQTT library in Arm Mbed OS 2017-11-02. The function readMQTTLenString()

The scipy.weave component in SciPy before 0.12.1 creates insecure temporary directories.

Insecure temporary file vulnerability in RedHat vsdm 4.9.6.

There is a possible tty hijacking in shadow 4.x before 4.1.5 and sudo 1.x before 1.7.4 via "su - user -c program". The u

One Identity Cloud Access Manager before 8.1.4 Hotfix 1 allows CSRF for logout requests.

One Identity Cloud Access Manager before 8.1.4 Hotfix 1 allows OTP bypass via vectors involving a man in the middle, the

Cryptocat before 2.0.22 has Multiparty Encryption Scheme Information Disclosure

Cryptocat before 2.0.22: Cryptocat.random() Function Array Key has Entropy Weakness

Cryptocat before 2.0.22 has Arbitrary Code Execution on Firefox Conversation Overview

Cryptocat before 2.0.22 has Nickname User Impersonation

Cryptocat before 2.0.42 has Group Chat ECC Private Key Generation Brute Force Weakness

Sudo through 1.8.29 allows local users to escalate to root if they have write access to file descriptor 3 of the sudo pr

An issue was discovered in drivers/media/platform/vivid in the Linux kernel through 5.3.8. It is exploitable for privile

Cryptocat before 2.0.22 has weak encryption in the Socialist Millionnaire Protocol

Cryptocat strophe.js before 2.0.22 has information disclosure