2019

An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its m

An information disclosure vulnerability exists in the Windows Event Viewer (eventvwr.msc) when it improperly parses XML

A denial of service exists in Microsoft IIS Server when the optional request filtering feature improperly handles reques

A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft brow

A denial of service vulnerability exists when Microsoft Hyper-V on a host server fails to properly validate input from a

A denial of service vulnerability exists when Microsoft Hyper-V on a host server fails to properly validate input from a

A denial of service vulnerability exists when Microsoft Hyper-V on a host server fails to properly validate input from a

A flaw was found in the CloudForms web interface, versions 5.8 - 5.10, where the RSS feed URLs are not properly restrict

A vulnerability was found in Apache HTTP Server 2.4.34 to 2.4.38. When HTTP/2 was enabled for a http: host or H2Upgrade

A vulnerability was found in Apache HTTP Server 2.4.17 to 2.4.38. Using fuzzed network input, the http/2 request handlin

A Directory Traversal issue was discovered in SSHServerAPI.dll in Progress ipswitch WS_FTP Server 2018 before 8.6.1. An

A vulnerability was found in Apache HTTP Server 2.4.0 to 2.4.38. When the path component of a request URL contains multi

All versions up to V20.18.40.R7.B1of ZTE NetNumen DAP product have an XSS vulnerability. Due to the lack of correct vali

All versions up to UKBB_WF820+_1.0.0B06 of ZTE WF820+ LTE Outdoor CPE product are impacted by Cross-Site Request Forgery

An issue was discovered in Joomla! before 3.9.7. The subform fieldtype does not sufficiently filter or validate input of

An issue was discovered in Joomla! before 3.9.7. The update server URL of com_joomlaupdate can be manipulated by non Sup

An issue was discovered in MISP 2.4.108. Organization admins could reset credentials for site admins (organization admin

A reflected cross site scripting vulnerability in Jenkins ElectricFlow Plugin 1.1.6 and earlier allowed attackers able t

A stored cross site scripting vulnerability in Jenkins ElectricFlow Plugin 1.1.5 and earlier allowed attackers able to c

Jenkins ElectricFlow Plugin 1.1.5 and earlier disabled SSL/TLS and hostname verification globally for the Jenkins master

Missing permission checks in Jenkins ElectricFlow Plugin 1.1.5 and earlier in various HTTP endpoints allowed users with

A missing permission check in Jenkins ElectricFlow Plugin 1.1.5 and earlier in Configuration#doTestConnection allowed us

A cross-site request forgery vulnerability in Jenkins ElectricFlow Plugin 1.1.5 and earlier in Configuration#doTestConne

HTML Injection has been discovered in the v0.19.0 version of the Fat Free CRM product via an authenticated request to th

A vulnerability exists in Rancher before 2.2.4 in the login component, where the errorMsg parameter can be tampered to d

The createComment mutation in the WPGraphQL 0.2.3 plugin for WordPress allows unauthenticated users to post comments on

WampServer before 3.1.9 has CSRF in add_vhost.php because the synchronizer pattern implemented as remediation of CVE-201

XSS on the PIX-Link Repeater/Router LV-WR09 with firmware v28K.MiniRouter.20180616 allows attackers to steal credentials

There is a Clickjacking vulnerability in Huawei HG255s product. An attacker may trick user to click a link and affect th

In Twisted before 19.2.1, twisted.web did not validate or sanitize URIs or HTTP methods, allowing an attacker to inject

In Hoteldruid before 2.3.1, a division by zero was discovered in $num_tabelle in tab_tariffe.php (aka the numtariffa1 pa

In uvc_parse_standard_control of uvc_driver.c, there is a possible out-of-bound read due to improper input validation. T

An issue was discovered on Moxa AWK-3121 1.19 devices. It provides functionality so that an administrator can change the

An issue was discovered on Moxa AWK-3121 1.14 devices. The session cookie "Password508" does not have an HttpOnly flag.

Micro Focus Solution Business Manager versions prior to 11.4.2 is susceptible to open redirect.

Maccms through 8.0 allows XSS via the site_keywords field to index.php?m=system-config because of tpl/module/system.php

admin\db\DoSql.php in EmpireCMS through 7.5 allows XSS via crafted SQL syntax to admin/admin.php.

A number of stored XSS vulnerabilities have been identified in the web configuration feature in ENTTEC Datagate Mk2 7004

Ubiquiti UniFi 52 devices, when Hotspot mode is used, allow remote attackers to bypass intended restrictions on "free ti

Xiaomi Stock Browser 10.2.4.g on Xiaomi Redmi Note 5 Pro devices and other Redmi Android phones allows content provider

Hasplm cookie in Gemalto Admin Control Center, all versions prior to 7.92, does not have 'HttpOnly' flag. This allows ma

Gemalto Admin Control Center, all versions prior to 7.92, uses cleartext HTTP to communicate with www3.safenet-inc.com t

IBM Intelligent Operations Center (IOC) 5.1.0 through 5.2.0 is vulnerable to cross-site scripting. This vulnerability al

Supra Smart Cloud TV allows remote file inclusion in the openLiveURL function, which allows a local attacker to broadcas

In Cloudera Navigator Key Trustee KMS 5.12 and 5.13, incorrect default ACL values allow remote access to purge and undel

This CVE relates to an unspecified cross site scripting vulnerability in Cloudera Manager.

IBM InfoSphere Information Server 11.5 and 11.7 is affected by an information disclosure vulnerability. Sensitive inform

IBM Security Information Queue (ISIQ) 1.0.0, 1.0.1, and 1.0.2 generates an error message that includes sensitive informa

IBM Security Information Queue (ISIQ) 1.0.0, 1.0.1, and 1.0.2 could allow a remote attacker to hijack the clicking actio

Xiaomi Mi 5s Plus devices allow attackers to trigger touchscreen anomalies via a radio signal between 198 kHz and 203 kH