2019

A code injection issue was discovered in PyXDG before 0.26 via crafted Python code in a Category element of a Menu XML d

Dell EMC OpenManage Server Administrator (OMSA) versions prior to 9.1.0.3 and prior to 9.2.0.4 contain an XML external e

On SOYAL AR-727H and AR-829Ev5 devices, all CGI programs allow unauthenticated POST access.

IBM Security Information Queue (ISIQ) 1.0.0, 1.0.1, and 1.0.2 is missing the HTTP Strict Transport Security header. User

The Security Camera CZ application through 1.6.8 for Android stores potentially sensitive recorded video in external dat

IBM Intelligent Operations Center (IOC) 5.1.0 through 5.2.0 does not require that users should have strong passwords by

IBM Intelligent Operations Center (IOC) 5.1.0 through 5.2.0 is vulnerable to user enumeration, allowing an attacker to b

In UrBackup 2.2.6, an attacker can send a malformed request to the client over the network, and trigger a fileservplugin

aubio v0.4.0 to v0.4.8 has a NULL pointer dereference in new_aubio_filterbank via invalid n_filters.

aubio v0.4.0 to v0.4.8 has a new_aubio_onset NULL pointer dereference.

An issue was discovered on Moxa AWK-3121 1.14 devices. It is intended that an administrator can download /systemlog.log

Dameware Remote Mini Control version 12.1.0.34 and prior contains a unauthenticated remote heap overflow due to the serv

In Bevywise MQTTRoute 1.1 build 1018-002, a connect packet combined with a malformed unsubscribe request packet can be u

An XML external entities (XXE) vulnerability in Jenkins Token Macro Plugin 2.7 and earlier allowed attackers able to con

All versions up to BD_R218V2.4 of ZTE MF920 product are impacted by information leak vulnerability. Due to some interfac

A Directory Traversal issue was discovered in SSHServerAPI.dll in Progress ipswitch WS_FTP Server 2018 before 8.6.1. An

A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory.

A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft brow

A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft brow

A remote code execution vulnerability exists in the way that Microsoft browsers access objects in memory. The vulnerabil

A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft brow

A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft brow

A vulnerability has been identified in SIEMENS LOGO!8 (6ED1052-xyyxx-0BA8 FS:01 to FS:06 / Firmware version V1.80.xx and

Fuji Electric V-Server before 6.0.33.0 is vulnerable to denial of service via a crafted UDP message sent to port 8005. A

XML Entity Expansion (Billion Laughs Attack) on Pippo 1.12.0 results in Denial of Service.Entities are created recursive

Under certain conditions the PI Integration Builder Web UI of SAP NetWeaver Process Integration (versions: SAP_XIESR: 7.

An issue was discovered in the Linux kernel before 4.20.15. The nfc_llcp_build_tlv function in net/nfc/llcp_commands.c m

In http.c in Embedthis GoAhead before 4.1.1 and 5.x before 5.0.1, a header parsing vulnerability causes a memory asserti

Out of bounds memory read and access due to improper array index validation may lead to unexpected behavior while decodi

radare2 through 3.5.1 mishandles the RParse API, which allows remote attackers to cause a denial of service (application

An issue was discovered in Tyto Sahi Pro through 7.x.x and 8.0.0. A directory traversal (arbitrary file access) vulnerab

Genie Access WIP3BVAF WISH IP 3MP IR Auto Focus Bullet Camera devices through 3.x are vulnerable to directory traversal

An issue was discovered on Linksys WRT1900ACS 1.0.3.187766 devices. An ability exists for an unauthenticated user to bro

An issue was discovered in RubyGems 2.6 and later through 3.0.2. Since Gem::CommandManager#run calls alert_error without

An issue was discovered in RubyGems 2.6 and later through 3.0.2. Since Gem::UserInteraction#verbose calls say without es

An issue was discovered in RubyGems 2.6 and later through 3.0.2. The gem owner command outputs the contents of the API r

An issue was discovered in RubyGems 2.6 and later through 3.0.2. Gem::GemcutterUtilities#with_response may output the AP

In UrBackup 2.2.6, an attacker can send a malformed request to the client over the network, and trigger a fileservplugin

OX App Suite 7.10.1 and earlier allows Information Exposure.

Artha ~ The Open Thesaurus 1.0.3.0 has a Buffer Overflow.

In firmware version MS_2.6.9900 of Columbia Weather MicroServer, the BACnet daemon does not properly validate input, whi

An issue was discovered in Netdata 1.10.0. Log Injection (or Log Forgery) exists via a %0a sequence in the url parameter

Jonathan Looney discovered that the TCP_SKB_CB(skb)->tcp_gso_segs value was subject to an integer overflow in the Linux

Jonathan Looney discovered that the Linux kernel default MSS is hard-coded to 48 bytes. This allows a remote peer to fra

Zucchetti HR Portal through 2019-03-15 allows Directory Traversal. Unauthenticated users can escape outside of the restr

An issue was discovered on TP-Link TL-WR1043ND V2 devices. The credentials can be easily decoded and cracked by brute-fo

EXCELLENT INFOTEK BiYan v1.57 ~ v2.8 allows an attacker to leak user information without being authenticated, by sending

In createEffect of AudioFlinger.cpp, there is a possible memory corruption due to a race condition. This could lead to l

Alternate Pic View 2.600 has a User Mode Write AV starting at PicViewer!PerfgrapFinalize+0x00000000000a8868.

Alternate Pic View 2.600 has a Read Access Violation at the Instruction Pointer after a call from PicViewer!PerfgrapFina