2019

cPanel before 55.9999.141 allows arbitrary code execution because of an unsafe @INC path (SEC-97).

cPanel before 55.9999.141 allows attackers to bypass a Security Policy by faking static documents (SEC-92).

cPanel before 55.9999.141 allows arbitrary code execution in the context of the root account because of MakeText interpo

GnuCOBOL 2.2 has a buffer overflow in cb_evaluate_expr in cobc/field.c via crafted COBOL source code.

cPanel before 11.54.0.4 allows arbitrary file-overwrite operations in scripts/quotacheck (SEC-81).

cPanel before 11.54.0.4 allows arbitrary file-read and file-write operations via scripts/fixmailboxpath (SEC-80).

cPanel before 11.54.0.4 allows arbitrary file-chown and file-chmod operations during Roundcube database conversions (SEC

cPanel before 11.54.0.4 allows arbitrary file-overwrite operations in scripts/check_system_storable (SEC-78).

cPanel before 11.54.0.4 allows code execution in the context of shared users via JSON-API (SEC-76).

cPanel before 11.54.0.4 allows arbitrary code execution during locale duplication (SEC-72).

cPanel before 11.54.0.4 allows SQL injection in bin/horde_update_usernames (SEC-71).

cPanel before 11.54.0.4 allows arbitrary code execution because of an unsafe @INC path (SEC-46).

On the Polycom Obihai Obi1022 VoIP phone with firmware 5.1.11, a command injection (missing input validation) issue in t

In cPanel before 70.0.23, OpenID providers can inject arbitrary data into cPanel session files (SEC-368).

cPanel before 70.0.23 allows code execution because "." is in @INC during a Perl syntax check of cpaddonsup (SEC-359).

cPanel before 70.0.23 allows arbitrary file-chmod operations during legacy incremental backups (SEC-338).

cPanel before 11.54.0.0 allows unauthorized zone modification via the WHM API (SEC-66).

cPanel before 11.54.0.0 allows unauthorized password changes via Webmail API commands (SEC-65).

cPanel before 11.54.0.4 allows arbitrary code execution via scripts/synccpaddonswithsqlhost (SEC-83).

cPanel before 11.52.0.13 does not prevent arbitrary file-read operations via get_information_for_applications (CPANEL-12

Windu CMS 2.2 allows CSRF via admin/users/?mn=admin.message.error to add an admin account.

It was discovered evolution-ews before 3.31.3 does not check the validity of SSL certificates. An attacker could abuse t

In Apache Solr, the DataImportHandler, an optional but popular module to pull in data from databases and other sources,

In cPanel before 71.9980.37, API tokens retain ACLs after those ACLs are removed from the corresponding accounts (SEC-39

A flaw was found in Jolokia versions from 1.2 to before 1.6.1. Affected versions are vulnerable to a system-wide CSRF. T

It was found that foreman, versions 1.x.x before 1.15.6, in Satellite 6 did not properly enforce access controls on cert

GnuCOBOL 2.2 has a buffer overflow in cb_push_op in cobc/field.c via crafted COBOL source code.

An issue was discovered on D-Link 6600-AP and DWL-3600AP Ax 4.2.0.14 21/03/2019 devices. There is use of weak ciphers fo

fmt_mtm_load_song in fmt/mtm.c in Schism Tracker 20190722 has a heap-based buffer overflow.

It was found that icedtea-web up to and including 1.7.2 and 1.8.2 was vulnerable to a zip-slip attack during auto-extrac

It was found that in icedtea-web up to and including 1.7.2 and 1.8.2 executable code could be injected in a JAR file wit

A flaw was found in moodle before versions 3.7.1, 3.6.5, 3.5.7. A sesskey (CSRF) token was not being utilised by the XML

It was found that icedtea-web though 1.7.2 and 1.8.2 did not properly sanitize paths from <jar/> elements in JNLP files.

nfdump 1.6.17 and earlier is affected by an integer overflow in the function Process_ipfix_template_withdraw in ipfix.c

Unrestricted upload of file with dangerous type in WallacePOS 1.4.3 allows a remote, authenticated attacker to execute a

Cross-site request forgery in WallacePOS 1.4.3 allows a remote attacker to perform sensitive application actions by tric

A vulnerability in the Link Layer Discovery Protocol (LLDP) subsystem of Cisco Nexus 9000 Series Application Centric Inf

Symantec Endpoint Protection, prior to 14.2 RU1 & 12.1 RU6 MP10 and Symantec Endpoint Protection Small Business Edition,

SAS Drug Development (SDD) before 32DRG02 mishandles logout actions, which allows a user (who was previously logged in)

An exploitable code execution vulnerability exists in the XPM image rendering function of SDL2_image 2.0.4. A specially

An exploitable code execution vulnerability exists in the XPM image rendering functionality of SDL2_image 2.0.4. A speci

An exploitable code execution vulnerability exists in the XCF image rendering functionality of SDL2_image 2.0.4. A speci

An exploitable code execution vulnerability exists in the PCX image-rendering functionality of SDL2_image 2.0.4. A speci

IBM StoreIQ 7.6.0.0. through 7.6.0.18 could allow a remote attacker to cause a denial of service attack using repeated r

CImg through 2.6.7 has a heap-based buffer overflow in _load_bmp in CImg.h because of erroneous memory allocation for a

A flaw was found in samba's Heimdal KDC implementation, versions 4.8.x up to, excluding 4.8.12, 4.9.x up to, excluding 4

A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.61 and earlier related to the handling of method poin

A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.61 and earlier related to the handling of type casts

Sigil before 0.9.16 is vulnerable to a directory traversal, allowing attackers to write arbitrary files via a ../ (dot d

A vulnerability has been found in PowerDNS Authoritative Server before versions 4.1.10, 4.0.8 allowing an authorized use