2019

In DjVuLibre 3.5.27, the sorting functionality (aka GArrayTemplate<TYPE>::sort) allows attackers to cause a denial-of-se

In DjVuLibre 3.5.27, the bitmap reader component allows attackers to cause a denial-of-service error (resource exhaustio

In DjVuLibre 3.5.27, DjVmDir.cpp in the DJVU reader component allows attackers to cause a denial-of-service (application

WriteTIFFImage in coders/tiff.c in ImageMagick 7.0.8-43 Q16 allows attackers to cause a denial-of-service (application c

The XWD image (X Window System window dumping file) parsing component in ImageMagick 7.0.8-41 Q16 allows attackers to ca

The Recruitment module in Humanica Humatrix 7 1.0.0.203 and 1.0.0.681 allows an unauthenticated attacker to access all c

In GIFLIB before 2019-02-16, a malformed GIF file triggers a divide-by-zero exception in the decoder function DGifSlurp

Zabbix through 4.4.0alpha1 allows User Enumeration. With login requests, it is possible to enumerate application usernam

The easy-digital-downloads plugin before 2.9.16 for WordPress has XSS related to IP address logging.

The zendesk-help-center plugin before 1.0.5 for WordPress has multiple XSS issues.

The xo-security plugin before 1.5.3 for WordPress has XSS.

The Kunena extension before 5.1.14 for Joomla! allows XSS via BBCode.

lib/install/install.go in cnlh nps through 0.23.2 uses 0777 permissions for /usr/local/bin/nps and/or /usr/bin/nps, lead

check_input_term in sound/usb/mixer.c in the Linux kernel through 5.2.9 mishandles recursion, leading to kernel stack ex

An issue was discovered in WSO2 API Manager 2.6.0 before WSO2-CARBON-PATCH-4.4.0-4457. There is XSS via a crafted filena

xtrlock through 2.10 does not block multitouch events. Consequently, an attacker at a locked screen can send input to (a

drivers/net/wireless/ath/ath6kl/usb.c in the Linux kernel through 5.2.9 has a NULL pointer dereference via an incomplete

DWSurvey through 2019-07-22 has reflected XSS via the design/qu-multi-fillblank!answers.action surveyId parameter.

An issue was discovered in drivers/scsi/qedi/qedi_dbg.c in the Linux kernel before 5.1.12. In the qedi_dbg_* family of f

OSIsoft PI Web API 2018 and prior may allow disclosure of sensitive information.

In ClickHouse before 18.12.13, functions for loading CatBoost models allowed path traversal and reading arbitrary files

The implementations of SAE and EAP-pwd in hostapd and wpa_supplicant 2.x through 2.8 are vulnerable to side-channel atta

A reachable assertion in the lookup1_values function in stb_vorbis through 2019-03-04 allows an attacker to cause a deni

A NULL pointer dereference in the get_window function in stb_vorbis through 2019-03-04 allows an attacker to cause a den

Division by zero in the predict_point function in stb_vorbis through 2019-03-04 allows an attacker to cause a denial of

A vulnerability was found in Linux kernel's, versions up to 3.10, implementation of overlayfs. An attacker with local ac

Prospecta Master Data Online (MDO) 2.0 has Stored XSS.

Arista EOS through 4.21.0F allows a crash because 802.1x authentication is mishandled.

Arista CloudVision Portal through 2018.1.1 has Incorrect Permissions.

CMS Clipper 1.3.3 has XSS in the Security tab search, User Groups, Resource Groups, and User/Resource Group Links fields

The read_chunk function in flif-dec.cpp in Free Lossless Image Format (FLIF) 0.3 allows remote attackers to cause a deni

The Custom 404 Pro plugin 3.2.8 for WordPress has XSS via the wp-admin/admin.php?page=c4p-main page parameter.

The Rank Math SEO plugin 1.0.27 for WordPress allows non-admin users to reset the settings via the wp-admin/admin-post.p

The "CP Contact Form with PayPal" plugin before 1.2.98 for WordPress has XSS in CSS edition.

Evolution CMS 2.0.x allows XSS via a description and new category location in a template. NOTE: the vendor states that t

All versions up to V1.1.10P3T18 of ZTE ZXHN F670 product are impacted by cross-site scripting vulnerability (XSS). Due t

OpenCart 3.x, when the attacker has login access to the admin panel, allows stored XSS within the Source/HTML editing fe

The FV Flowplayer Video Player plugin before 7.3.15.727 for WordPress allows guests to obtain the email subscription lis

The toggle-the-title (aka Toggle The Title) plugin 1.4 for WordPress has XSS via the wp-admin/admin-ajax.php?action=upda

The limb-gallery (aka Limb Gallery) plugin 1.4.0 for WordPress has XSS via the wp-admin/admin-ajax.php?action=grsGallery

XSS exists in WEB STUDIO Ultimate Loan Manager 2.0 by adding a branch under the Branches button that sets the notes para

An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory. An attacker

An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory. An attacker

A spoofing vulnerability exists in the way Microsoft Outlook iOS software parses specifically crafted email messages. An

An elevation of privilege vulnerability exists when Microsoft Outlook initiates processing of incoming messages without

A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a speciall

An information disclosure vulnerability exists in the way Microsoft SharePoint handles session objects. An authenticated

An elevation of privilege exists in SyncController.dll. An attacker who successfully exploited the vulnerability could r

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Mi

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Mi