2019

An issue was discovered in the image-manager in Xoops 2.5.10. When any image with a JavaScript payload as its name is ho

An issue was discovered in the image-manager in Xoops 2.5.10. When the breadcrumb showing the category name is hovered o

Buffer overflow in WLAN NAN function due to lack of check of count value received in NAN availability attribute in Snapd

Possible buffer overflow issue due to lack of length check when parsing the extended cap IE header length in Snapdragon

Lack of check of address range received from firmware response allows modem to respond arbitrary pages into its address

BT process died and BT toggled due to null pointer dereference when invalid vendor pass through command sent from remote

Device record of the pairing device used after free during ACL disconnection in Snapdragon Auto, Snapdragon Compute, Sna

Lack of input validation for data received from user space can lead to OOB access in WLAN in Snapdragon Auto, Snapdragon

Lack of check of extscan change results received from firmware can lead to an out of buffer read in Snapdragon Auto, Sna

While processing QCA_NL80211_VENDOR_SUBCMD_AVOID_FREQUENCY vendor command, driver does not validate the data obtained fr

Possible use after free issue due to improper input validation in volume listener library in Snapdragon Auto, Snapdragon

Improper validation of read and write index of tx and rx fifo`s before using for data copy from fifo can lead to out-of-

Buffer overflow scenario if the client sends more than 5 io_vec requests to the server in Snapdragon Auto, Snapdragon Co

Use after free issue occurs If another instance of open for voice_svc node has been called from application without clos

Boot image not getting verified by AVB in Snapdragon Auto, Snapdragon Mobile, Snapdragon Wearables in MDM9607, MSM8909W,

Possible null-pointer dereference can occur while parsing avi clip during copy in Snapdragon Auto, Snapdragon Compute, S

Ilch 2.1.22 allows remote code execution because php is listed under "Allowed files" on the index.php/admin/media/settin

Ilch 2.1.22 allows stored XSS via the title, text, or email id to the Jobs Tab.

contrib/pmdb2diag/pmdb2diag.c in Rsyslog v8.1908.0 allows out-of-bounds access because the level length is mishandled.

CloudBoot through 2019-03-08 allows SQL Injection via a crafted Status field in JSON data to the api/osinstall/v1/device

In Metinfo 7.0.0beta, a SQL Injection was discovered in app/system/language/admin/language_general.class.php via the adm

In Metinfo 7.0.0beta, a SQL Injection was discovered in app/system/product/admin/product_admin.class.php via the admin/?

In the Linux kernel before 5.0.3, a memory leak exits in hsr_dev_finalize() in net/hsr/hsr_device.c if hsr_add_port fail

In the Linux kernel before 5.0, a memory leak exists in sit_init_net() in net/ipv6/sit.c when register_netdev() fails to

eBrigade before 5.0 has evenement_choice.php chxCal SQL Injection.

eBrigade before 5.0 has evenements.php cid SQL Injection.

eBrigade before 5.0 has evenement_ical.php evenement SQL Injection.

A DOM based XSS in GFI Kerio Control v9.3.0 allows embedding of malicious code and manipulating the login page to send b

SuiteCRM 7.10.x and 7.11.x before 7.10.20 and 7.11.8 has XSS.

CDG through 2017-01-01 allows downloadDocument.jsp?command=download&pathAndName= directory traversal.

In phpBB before 3.1.7-PL1, includes/acp/acp_bbcodes.php has improper verification of a CSRF token on the BBCode page in

Plataformatec Simple Form has Incorrect Access Control in file_method? in lib/simple_form/form_builder.rb, because a use

The Keybase app 2.13.2 for iOS provides potentially insufficient notice that it is employing a user's private key to sig

Zcashd in Zcash before 2.0.7-3 allows discovery of the IP address of a full node that owns a shielded address, related t

NSA Ghidra through 9.0.4, when experimental mode is enabled, allows arbitrary code execution if the Read XML Files featu

The documentation XML-RPC server in Python through 2.7.16, 3.x through 3.6.9, and 3.7.x through 3.7.4 has XSS via the se

Flower 0.9.3 has XSS via a crafted worker name. NOTE: The project author stated that he doesn't think this is a valid vu

Flower 0.9.3 has XSS via the name parameter in an @app.task call. NOTE: The project author stated that he doesn't think

Dell EMC ECS versions prior to 3.4.0.0 contain an improper restriction of excessive authentication attempts vulnerabilit

Dell EMC Integrated Data Protection Appliance versions prior to 2.3 contain a stored cross-site scripting vulnerability.

Dell EMC Integrated Data Protection Appliance versions prior to 2.3 do not limit the number of authentication attempts t

Dell EMC Integrated Data Protection Appliance versions prior to 2.3 contain a password storage vulnerability in the ACM

Exim 4.92 through 4.92.2 allows remote code execution, a different vulnerability than CVE-2019-15846. There is a heap-ba

An integer overflow in WhatsApp media parsing libraries allows a remote attacker to perform an out-of-bounds write on th

Xpdf 4.01.01 has an out-of-bounds write in the vertProfile part of the TextPage::findGaps function in TextOutputDev.cc,

Dolibarr 9.0.5 has stored XSS in an Email Template section to mails_templates.php. A user with no privileges can inject

Dolibarr 9.0.5 has stored XSS in a User Profile in a Signature section to card.php. A user with the "Create/modify other

Dolibarr 9.0.5 has stored XSS in a User Note section to note.php. A user with no privileges can inject script to attack

Dolibarr 9.0.5 has stored XSS vulnerability via a User Group Description section to card.php. A user with the "Create/mo

In Platform, there is a possible bypass of user interaction requirements due to background app interception. This could