2019

cPanel before 74.0.8 allows self XSS in WHM Style Upload interface (SEC-437).

cPanel before 74.0.8 allows self XSS in the Site Software Moderation interface (SEC-434).

cPanel before 74.0.8 allows self XSS in the WHM Security Questions interface (SEC-433).

cPanel before 74.0.8 allows self XSS in the WHM "Create a New Account" interface (SEC-428).

XMFile::read in XMFile.cpp in milkyplay in MilkyTracker 1.02.00 has a heap-based buffer overflow.

An integer overflow issue has been reported in the general_composite_rect() function in pixman prior to version 0.32.8.

A Cross-Site Scripting (XSS) vulnerability in the Web UI of Avaya Aura Conferencing may allow code execution and potenti

An authentication bypass vulnerability was discovered in foreman-tasks before 0.15.7. Previously, commit tasks were sear

A flaw was found in moodle before versions 3.7.1, 3.6.5, 3.5.7. Teachers in an assignment group could modify group overr

A flaw was found in moodle before versions 3.7.1, 3.6.5, 3.5.7. Teachers in a quiz group could modify group overrides fo

A flaw was found in moodle before versions 3.7.1, 3.6.5, 3.5.7. Users with permission to delete entries from a glossary

Opengear console server firmware releases prior to 4.5.0 have a stored XSS vulnerability related to serial port logging.

Insufficient output sanitization in WallacePOS 1.4.3 allows a remote, authenticated attacker to conduct persistent cross

DrayTek routers before 2018-05-23 allow CSRF attacks to change DNS or DHCP settings, a related issue to CVE-2017-11649.

An exploitable denial of service vulnerability exists in the object lookup functionality of Yara 3.8.1. A specially craf

IBM StoreIQ 7.6.0.0. through 7.6.0.18 could allow an authenticated user to obtain sensitive information that a privilege

Jenkins Skytap Cloud CI Plugin 2.06 and earlier stored credentials unencrypted in job config.xml files on the Jenkins ma

Jenkins Google Kubernetes Engine Plugin 0.6.2 and earlier created a temporary file containing a temporary access token i

Jenkins Amazon EC2 Plugin 1.43 and earlier wrote the beginning of private keys to the Jenkins system log.

Jenkins Configuration as Code Plugin 1.24 and earlier did not reliably identify sensitive values expected to be exported

Jenkins Configuration as Code Plugin 1.24 and earlier did not escape values resulting in variable interpolation during c

Jenkins Maven Release Plugin 0.14.0 and earlier stored credentials unencrypted on the Jenkins master where they could be

A stored cross site scripting vulnerability in Jenkins Maven Release Plugin 0.14.0 and earlier allowed attackers to inje

A cross-site request forgery vulnerability in Jenkins Maven Release Plugin 0.14.0 and earlier in the M2ReleaseAction#doS

Jenkins Maven Integration Plugin 3.3 and earlier did not apply build log decorators to module builds, potentially reveal

A missing permission check in Jenkins Pipeline: Shared Groovy Libraries Plugin 2.14 and earlier allowed users with Overa

Jenkins Configuration as Code Plugin 1.20 and earlier did not treat the proxy password as a secret to be masked when log

Missing permission checks in Jenkins Configuration as Code Plugin 1.24 and earlier in various HTTP endpoints allowed use

A Vulnerability has been found in PowerDNS Authoritative Server before versions 4.1.9, 4.0.8 allowing a remote, authoriz

A flaw was discovered in the way Ansible templating was implemented in versions before 2.6.18, 2.7.12 and 2.8.2, causing

A flaw was discovered in fence-agents, prior to version 4.3.4, where using non-ASCII characters in a guest VM's comment

Kibana versions before 6.8.2 and 7.2.1 contain a server side request forgery (SSRF) flaw in the graphite integration for

A race condition flaw was found in the response headers Elasticsearch versions before 7.2.1 and 6.8.2 returns to a reque

Double Free in VLC versions <= 3.0.6 leads to a crash.

Cross-site scripting (XSS) vulnerability in http-file-server (all versions) allows an attacker with access to the server

Cross-site scripting (XSS) vulnerability in min-http-server (all versions) allows an attacker with access to the server

Bypassing lock protection exists in Nextcloud Android app 3.6.0 when creating a multi-account and aborting the process.

Bypass lock protection in the Nextcloud Android app prior to version 3.3.0 allowed access to files when being prompted f

Bypass lock protection in the Nextcloud Android app prior to version 3.6.1 allows accessing the files when repeatedly op

Improper sanitization of HTML in directory names in the Nextcloud Android app prior to version 3.7.0 allowed to style th

A missing check in the Nextcloud Server prior to version 15.0.1 causes leaking of calendar event names when adding or mo

J2B in libopenmpt before 0.4.2 allows an assertion failure during file parsing with debug STLs.

DSM in libopenmpt before 0.4.2 allows an assertion failure during file parsing with debug STLs.

libopenmpt before 0.4.5 allows a crash during playback due to an out-of-bounds read in XM and MT2 files.

libopenmpt before 0.3.11 allows a crash with certain malformed custom tunings in MPTM files.

libopenmpt before 0.3.13 allows a crash with malformed MED files.

edx-platform before 2018-07-18 allows XSS via a response to a Chemical Equation advanced problem.

An issue was discovered in Bitdefender products for Windows (Bitdefender Endpoint Security Tool versions prior to 6.6.8.

Crypto++ 8.3.0 and earlier contains a timing side channel in ECDSA signature generation. This allows a local or remote a

A vulnerability was found in PostgreSQL versions 11.x up to excluding 11.3, 10.x up to excluding 10.8, 9.6.x up to, excl