2019

In Progress MOVEit Transfer 10.2 before 10.2.6 (2018.3), 11.0 before 11.0.4 (2019.0.4), and 11.1 before 11.1.3 (2019.1.3

plugin-fw/lib/yit-plugin-panel-wc.php in the YIT Plugin Framework through 3.3.8 for WordPress allows authenticated optio

An issue was discovered in Bitdefender BOX firmware versions before 2.1.37.37-34 that allows an attacker to pass arbitra

The 7520V3V1.0.0B09P27 version, and all earlier versions of ZTE product ZX297520V3 are impacted by a Command Injection v

A security vulnerability exists in a management port in the version of ZTE's ZXMP M721V3.10P01B10_M2NCP. An attacker cou

In JetBrains YouTrack before 2019.2.55152, removing tags from the issues list without the corresponding permission was p

In JetBrains Toolbox App before 1.15.5666 for Windows, privilege escalation was possible.

In JetBrains TeamCity before 2019.1.2, a non-destructive operation could be performed by a user without the correspondin

In JetBrains TeamCity before 2019.1.2, secure values could be exposed to users with the "View build runtime parameters a

In JetBrains TeamCity before 2019.1.4, reverse tabnabbing was possible on several pages.

Mumble: murmur-server has DoS due to malformed client query

burn allows file names to escape via mishandled quotation marks

python-docutils allows insecure usage of temporary files

overkill has buffer overflow via long player names that can corrupt data on the server machine

In JetBrains TeamCity before 2019.1.4, insecure Java Deserialization could potentially allow remote code execution.

In JetBrains TeamCity before 2019.1.2, access could be gained to the history of builds of a deleted build configuration

JetBrains MPS before 2019.2.2 exposed listening ports to the network.

JetBrains IntelliJ IDEA before 2019.2 allows local user privilege escalation, potentially leading to arbitrary code exec

In JetBrains Hub versions earlier than 2019.1.11738, username enumeration was possible through password recovery.

Jupyter Notebook before 5.5.0 does not use a CSP header to treat served files as belonging to a separate origin. Thus, f

An issue was discovered in Xen through 4.12.x allowing 32-bit PV guest OS users to gain guest OS privileges by installin

An issue was discovered in Xen through 4.12.x allowing attackers to gain host OS privileges via DMA in a situation where

An issue was discovered in Xen through 4.12.x allowing ARM guest OS users to cause a denial of service via a XENMEM_add_

An issue was discovered in Xen through 4.12.x allowing ARM guest OS users to cause a denial of service or gain privilege

An issue was discovered in Xen through 4.12.x allowing x86 PV guest OS users to gain host OS privileges by leveraging ra

An issue was discovered in Xen through 4.12.x allowing x86 PV guest OS users to cause a denial of service via a VCPUOP_i

In Apak Wholesale Floorplanning Finance 6.31.8.3 and 6.31.8.5, an attacker can send an authenticated POST request with a

The quarantine restoration function in Total Defense Anti-virus 11.5.2.28 is vulnerable to symbolic link attacks, allowi

The malware scan function in Total Defense Anti-virus 11.5.2.28 is vulnerable to a TOCTOU bug; consequently, symbolic li

A cross-site scripting (XSS) vulnerability in ikiwiki before 3.20101112 allows remote attackers to inject arbitrary web

Transmission before 1.92 allows attackers to prevent download of a file by corrupted data during the endgame.

Transmission before 1.92 allows an attacker to cause a denial of service (crash) or possibly have other unspecified impa

drbd8 allows local users to bypass intended restrictions for certain actions via netlink packets, similar to CVE-2009-37

A missing permission check was found in The CLI in JBoss Operations Network before 2.3.1 does not properly check permiss

An issue was discovered in Mooltipass Moolticute through v0.42.1 and v0.42.x-testing through v0.42.5-testing. There is a

European Commission eIDAS-Node Integration Package before 2.3.1 has Missing Certificate Validation because a certain Exp

European Commission eIDAS-Node Integration Package before 2.3.1 allows Certificate Faking because an attacker can sign a

A malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript

columnQuote in medoo before 1.7.5 allows remote attackers to perform a SQL Injection due to improper escaping.

systemd 239 through 245 accepts any certificate signed by a trusted certificate authority for DNS Over TLS. Server Name

The init script in autokey before 0.61.3-2 allows local attackers to write to arbitrary files via a symlink attack.

ClipSoft REXPERT 1.0.0.527 and earlier version allows remote attacker to arbitrary file deletion by issuing a HTTP GET r

ClipSoft REXPERT 1.0.0.527 and earlier version allows remote attacker to upload arbitrary local file via the ActiveX met

ClipSoft REXPERT 1.0.0.527 and earlier version allows directory traversal by issuing a special HTTP POST request with ..

ClipSoft REXPERT 1.0.0.527 and earlier version allows arbitrary file creation and execution via report print function of

ClipSoft REXPERT 1.0.0.527 and earlier version allows arbitrary file creation via a POST request with the parameter set

ClipSoft REXPERT 1.0.0.527 and earlier version have an information disclosure issue. When requesting web page associated

Authentication bypass vulnerability in the the web interface in Hunt CCTV, Capture CCTV, Hachi CCTV, NoVus CCTV, and Wel

In xpdf, the xref table contains an infinite loop which allows remote attackers to cause a denial of service (applicatio

xpdf allows remote attackers to cause a denial of service (NULL pointer dereference and crash) in the way it processes J