2019

The handle_request function in lib/HTTPServer.pm in Monitorix before 3.3.1 allows remote attackers to execute arbitrary

go.cgi in GoScript 2.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) query s

Blink XT2 Sync Module firmware prior to 2.13.11 allows remote attackers to execute arbitrary commands on the device due

An issue was discovered in Zoho ManageEngine ADSelfService Plus 5.6 Build 5607. An exposed service allows an unauthentic

A vulnerability in GMS allow unauthenticated user to SQL injection in Webservice module. This vulnerability affected GMS

An issue was discovered in the ROS communications-related packages (aka ros_comm or ros-melodic-ros-comm) through 1.14.3

class.userpeer.php in MFScripts YetiShare 3.5.2 through 4.5.3 uses an insecure method of creating password reset hashes

The UPnP endpoint URL /gena.cgi in the D-Link DIR-859 Wi-Fi router 1.05 and 1.06B01 Beta01 allows an Unauthenticated rem

php-shellcommand versions before 1.6.1 have a command injection vulnerability. Successful exploitation could lead to arb

In all versions of ClickHouse before 19.14, an OOB read, OOB write and integer underflow in decompression algorithms can

Buffer overflow in Senkas Kolibri 2.0 allows remote attackers to execute arbitrary code via a long URI in a POST request

An issue was discovered on Alcatel-Lucent OmniVista 4760 devices. A remote unauthenticated attacker can chain a director

Collabtive 1.0 has incorrect access control

thttpd 2007 has buffer underflow.

AVTECH AVN801 DVR has a security bypass via the administration login captcha

Hikvision DS-2CD7153-E IP Camera has security bypass via hardcoded credentials

Static HTTP Server 1.0 has a Local Overflow

Magnolia CMS before 4.5.9 has multiple access bypass vulnerabilities

An issue was discovered in Citrix Application Delivery Controller (ADC) and Gateway 10.5, 11.1, 12.0, 12.1, and 13.0. Th

wp_kses_bad_protocol in wp-includes/kses.php in WordPress before 5.3.1 mishandles the HTML5 colon named entity, allowing

Belkin N900 router (F9K1104v1) contains an Authentication Bypass using "Javascript debugging".

An authentication bypass exists in the web management interface in Belkin F5D8236-4 v2.

M5 lite 10 with versions of 8.0.0.182(C00) have an insufficient input validation vulnerability. Due to the input validat

D-Link DIR-601 B1 2.00NA devices are vulnerable to authentication bypass. They do not check for authentication at the se

libESMTP through 1.0.6 mishandles domain copying into a fixed-size buffer in ntlm_build_type_2 in ntlm/ntlmstruct.c, as

mongo-express before 0.54.0 is vulnerable to Remote Code Execution via endpoints that uses the `toBSON` method. A misuse

In GraphicsMagick 1.4 snapshot-20191208 Q8, there is a heap-based buffer over-read in the function EncodeImage of coders

In ImageMagick 7.0.9-7 Q16, there is a use-after-free in the function MngInfoDiscardObject of coders/png.c, related to R

In GraphicsMagick 1.4 snapshot-20190423 Q8, there is a heap-based buffer overflow in the function ImportRLEPixels of cod

In GraphicsMagick 1.4 snapshot-20190403 Q8, there is a use-after-free in ThrowException and ThrowLoggedException of magi

In ImageMagick 7.0.8-43 Q16, there is a heap-based buffer over-read in the function WritePNGImage of coders/png.c, relat

In ImageMagick 7.0.8-43 Q16, there is a heap-based buffer overflow in the function WriteSGIImage of coders/sgi.c.

Stack-based overflow vulnerability in the logMess function in Open TFTP Server SP 1.66 and earlier allows remote attacke

Stack-based overflow vulnerability in the logMess function in Open TFTP Server MT 1.65 and earlier allows remote attacke

Format string vulnerability in the logMess function in TFTP Server MT 1.65 and earlier allows remote attackers to perfor

Format string vulnerability in the logMess function in TFTP Server SP 1.66 and earlier allows remote attackers to perfor

Heap-based overflow vulnerability in TFTP Server SP 1.66 and earlier allows remote attackers to perform a denial of serv

Due to a logic error in the code, upload-image-with-ajax v1.0 allows arbitrary files to be uploaded to the web root allo

A vulnerability in SonicWall Email Security appliance allow an unauthenticated user to perform remote code execution. Th

Weak default password cause vulnerability in SonicWall Email Security appliance which leads to attacker gain access to a

All versions up to V4.01.01.02 of ZTE ZXCLOUD GoldenData VAP product have encryption problems vulnerability. Attackers c

Equinox Control Expert all versions, is vulnerable to an SQL injection attack, which may allow an attacker to remotely e

Versions of handlebars prior to 4.3.0 are vulnerable to Prototype Pollution leading to Remote Code Execution. Templates

NeuVector 3.1 when configured to allow authentication via Active Directory, does not enforce non-empty passwords which a

Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be explo

An issue was discovered on Xiaomi DGNWG03LM, ZNCZ03LM, MCCGQ01LM, WSDCGQ01LM, RTCGQ01LM devices. Because of insecure key

An issue was discovered on ASUS HG100, MW100, WS-101, TS-101, AS-101, MS-101, DL-101 devices using ZigBee PRO. Because o

Improper restriction of communications to Log Forwarding Card (LFC) on PA-7000 Series devices with second-generation Swi

cups (Common Unix Printing System) 'Listen localhost:631' option not honored correctly which could provide unauthorized

The "301 Redirects - Easy Redirect Manager" plugin before 2.45 for WordPress allows users (with subscriber or greater ac