2019

An Authentication Bypass vulnerability exists in NETGEAR Centria WNDR4700 Firmware 1.0.0.34 in http://<router_ip>/apply.

A Symlink Traversal vulnerability exists in NETGEAR Centria WNDR4700 Firmware 1.0.0.34.

Heap corruption in Intel(R) Baseboard Management Controller firmware may allow an unauthenticated user to potentially en

Insufficient session validation in Intel(R) Baseboard Management Controller firmware may allow an unauthenticated user t

Adobe Illustrator CC versions 23.1 and earlier have a memory corruption vulnerability. Successful exploitation could lea

Adobe Illustrator CC versions 23.1 and earlier have a memory corruption vulnerability. Successful exploitation could lea

Adobe Media Encoder versions 13.1 and earlier have an out-of-bounds write vulnerability. Successful exploitation could l

In klibc 1.5.20 and 1.5.21, the DHCP options written by ipconfig to /tmp/net-$DEVICE.conf are not properly escaped. This

Unprotected Storage of Credentials vulnerability in McAfee Advanced Threat Defense (ATD) prior to 4.8 allows local attac

An exploitable command injection vulnerability exists in the Config editor of the Exhibitor Web UI versions 1.0.9 to 1.7

SibSoft Xfilesharing through 2.5.1 allows cgi-bin/up.cgi arbitrary file upload. This can be combined with CVE-2019-18951

In Fuji Electric V-Server 4.0.6 and prior, several heap-based buffer overflows have been identified, which may allow an

Undocumented TELNET service in TRENDnet TEW-691GR and TEW-692GR when a web page named backdoor contains an HTML paramete

offlineimap before 6.3.4 added support for SSL server certificate validation but it is still possible to use SSL v2 prot

In ProxyResolverV8::SetPacScript of proxy_resolver_v8.cc, there is a possible memory corruption due to a use after free.

In FindSharedFunctionInfo of objects.cc, there is a possible out of bounds read due to a mistake in AST traversal. This

In okToConnect of HidHostService.java, there is a possible permission bypass due to an incorrect state check. This could

Symlink Traversal vulnerability in NETGEAR WNR3500U and WNR3500L due to misconfiguration in the SMB service.

An SSRF issue was discovered in Enghouse Web Chat 6.1.300.31. In any POST request, one can replace the port number at We

Symlink Traversal vulnerability in TP-LINK TL-WDR4300 and TL-1043ND..

FUDForum 3.0.9 is vulnerable to Stored XSS via the nlogin parameter. This may result in remote code execution. An attack

Symlink Traversal vulnerability in ASUS RT-AC66U and RT-N56U due to misconfiguration in the SMB service.

The BIOS tamper detection mechanism was not triggered in Lenovo ThinkPad T460p, BIOS versions up to R07ET90W, and T470p,

The Web server component of TIBCO Software Inc.'s TIBCO EBX contains multiple vulnerabilities that theoretically allow a

libpoe-component-irc-perl before v6.32 does not remove carriage returns and line feeds. This can be used to execute arbi

A security feature bypass vulnerability exists in the way that Office Click-to-Run (C2R) components handle a specially c

A security feature bypass vulnerability exists where a NETLOGON message is able to obtain the session key and sign messa

A remote code execution vulnerability exists in Microsoft Exchange through the deserialization of metadata via PowerShel

An issue was discovered in Picture_Manage_mvc.aspx in AUO SunVeillance Monitoring System before v1.1.9e. There is an inc

A remote code execution vulnerability exists when Windows Hyper-V Network Switch on a host server fails to properly vali

A remote code execution vulnerability exists when Windows Hyper-V Network Switch on a host server fails to properly vali

Systematic IRIS WebForms 5.4 and its functionalities can be accessed and used without any form of authentication.

File Sharing Wizard version 1.5.0 build 2008 is affected by a Structured Exception Handler based buffer overflow vulnera

In Helm 2.x before 2.15.2, commands that deal with loading a chart as a directory or packaging a chart provide an opport

Elgg through 1.7.10 has a SQL injection vulnerability

gdk-pixbuf through 2.31.1 has GIF loader buffer overflow when initializing decompression tables due to an input validati

FUDForum 3.0.9 is vulnerable to Stored XSS via the User-Agent HTTP header. This may result in remote code execution. An

Certain D-Link devices have a hardcoded Alphanetworks user account with TELNET access because of /etc/config/image_sign

Escalation of privileges in EnergyCAP 7 through 7.5.6 allows an attacker to access data. If an unauthenticated user clic

Matrix Synapse before 1.5.0 mishandles signature checking on some federation APIs. Events sent over /send_join, /send_le

gri before 2.12.18 generates temporary files in an insecure way.

clamav 0.91.2 suffers from a floating point exception when using ScanOLE2.

strapi before 3.0.0-beta.17.5 mishandles password resets within packages/strapi-admin/controllers/Auth.js and packages/s

TWiki before 5.1.4 allows remote attackers to execute arbitrary shell commands by sending a crafted '%MAKETEXT{}%' param

Mondo 2.24 has insecure handling of temporary files.

syscp 1.4.2.1 allows attackers to add arbitrary paths via the documentroot of a domain by appending a colon to it and se

gitolite before 1.4.1 does not filter src/ or hooks/ from path names.

Potential security vulnerabilities have been identified with HPE Nimble Storage systems in multi array group configurati

A wrong type is used for a return value from strlen in WebKit in Google Chrome before Blink M12 on 64-bit platforms.

An issue was discovered in the Linux kernel through 5.3.9. There is a use-after-free when aa_label_parse() fails in aa_a