2019

In MiniShare 1.4.1, there is a stack-based buffer overflow via an HTTP CONNECT request, which allows an attacker to achi

In the Dark Horse Comics application 1.3.21 for Android, token information (equivalent to the username and password) is

In the PowerSchool Mobile application 1.1.8 for Android, the username and password are stored in the log during authenti

In the Seesaw Parent and Family application 6.2.5 for Android, the username and password are stored in the log during au

The Infinite Design application 3.4.12 for Android sends a username and password via TCP without any encryption during l

In the Orbitz application 19.31.1 for Android, the username and password are stored in the log during authentication, an

A flaw was found in the Keycloak REST API before version 8.0.0 where it would permit user access from a realm the user w

In haml versions prior to version 5.0.0.beta.2, when using user input to perform tasks on the server, characters like <

In the DoorDash application through 11.5.2 for Android, the username and password are stored in the log during authentic

safer-eval before 1.3.2 are vulnerable to Arbitrary Code Execution. A payload using constructor properties can escape th

safer-eval before 1.3.4 are vulnerable to Arbitrary Code Execution. A payload using constructor properties can escape th

Intelbras IWR 1000N 1.6.4 devices allow disclosure of the administrator login name and password because v1/system/user i

Connect2id Nimbus JOSE+JWT before v7.9 can throw various uncaught exceptions while parsing a JWT, which could result in

Glue Smart Lock 2.7.8 devices do not properly block guest access in certain situations where the network connection is u

There is HTML Injection in the Note field in Dolibarr ERP/CRM 10.0.2 via user/note.php.

There is a heap-based buffer over-read in the fmt_entry function in tinfo/comp_hash.c in the terminfo library in ncurses

There is a heap-based buffer over-read in the _nc_find_entry function in tinfo/comp_hash.c in the terminfo library in nc

JIZHICMS 1.5.1 allows admin.php/Admin/adminadd.html CSRF to add an administrator.

The csv-parse module before 4.4.6 for Node.js is vulnerable to Regular Expression Denial of Service. The __isInt() funct

A flaw was found in the "Leaf and Chain" OCSP policy implementation in JSS' CryptoManager versions after 4.4.6, 4.5.3, 4

Ubisoft Uplay 92.0.0.6280 has Insecure Permissions.

Dell ImageAssist versions prior to 8.7.15 contain an information disclosure vulnerability. Dell ImageAssist stores some

In NCH Express Invoice v7.12, persistent cross site scripting (XSS) exists via the Invoices/Items/Customers/Quotes input

AutoPi Wi-Fi/NB and 4G/LTE devices before 2019-10-15 allows an attacker to perform a brute-force attack or dictionary at

Certain D-Link products are affected by: Buffer Overflow. This affects DIR-880L 1.08B04 and DIR-895 L/R 1.13b03. The imp

An issue was discovered in BMC Patrol Agent 9.0.10i. Weak execution permissions on the PatrolAgent SUID binary could all

An issue was discovered in BMC Patrol Agent 9.0.10i. Weak execution permissions on the best1collect.exe SUID binary coul

A memory error in the function SSL_accept in nostromo nhttpd through 1.9.6 allows an attacker to trigger a denial of ser

Directory Traversal in the function http_verify in nostromo nhttpd through 1.9.6 allows an attacker to achieve remote co

OX App Suite 7.10.1 and 7.10.2 allows XSS.

OX App Suite through 7.10.2 has Insecure Permissions.

OX App Suite 7.10.1 and 7.10.2 allows SSRF.

idreamsoft iCMS 7.0.15 allows remote attackers to cause a denial of service (resource consumption) via a query for many

tonyy dormsystem through 1.3 allows SQL Injection in admin.php.

There are some web interfaces without authentication requirements on D-Link DIR-412 A1-1.14WW routers. An attacker can g

ESET Cyber Security 6.7.900.0 for macOS allows a local attacker to execute unauthorized commands as root by abusing an u

CloudCTI HIP Integrator Recognition Configuration Tool allows privilege escalation via its EXQUISE integration. This too

SonarSource SonarQube before 7.8 has XSS in project links on account/projects.

A file-rename filter bypass exists in admin/media/rename.php in WBCE CMS 1.4.0 and earlier. This can be exploited by an

A cross-site scripting (XSS) vulnerability in the login form (/ScadaBR/login.htm) in ScadaBR 1.0CE allows a remote attac

A vulnerability was found in Ansible engine 2.x up to 2.8 and Ansible tower 3.x up to 3.5. When a module has an argument

A flaw was found in wildfly-core before 7.2.5.GA. The Management users with Monitor, Auditor and Deployer Roles should n

IBM FileNet Content Manager 5.5.2 and 5.5.3 in specific configurations, could log the web service user credentials into

An issue was discovered in the Popup Maker plugin before 1.8.13 for WordPress. An unauthenticated attacker can partially

An issue was discovered in MetInfo v7.0.0 beta. There is SQL Injection via the admin/?n=tags&c=index&a=doSaveTags URI.

An issue was discovered in idreamsoft iCMS v7.0.14. There is a spider_project.admincp.php SQL injection vulnerability in

parserIfLabel in inc/zzz_template.php in ZZZCMS zzzphp 1.7.3 allows remote attackers to execute arbitrary code because t

In ImageMagick before 7.0.8-62, TraceBezier in MagickCore/draw.c has a use-after-free.

tif_getimage.c in LibTIFF through 4.0.10, as used in GDAL through 3.0.1 and other products, has an integer overflow that

GDAL through 3.0.1 has a poolDestroy double free in OGRExpatRealloc in ogr/ogr_expat.cpp when the 10MB threshold is exce