2019

An issue was discovered in LibreNMS 1.50.1. An authenticated user can perform a directory traversal attack against the /

BIRD Internet Routing Daemon 1.6.x through 1.6.7 and 2.x through 2.0.5 has a stack-based buffer overflow. The BGP daemon

Onigmo through 6.2.0 has a NULL pointer dereference in onig_error_code_to_str because of fetch_token in regparse.c.

Onigmo through 6.2.0 has an out-of-bounds read in parse_char_class because of missing codepoint validation in regenc.c.

Oniguruma before 6.9.3 allows Stack Exhaustion in regcomp.c because of recursion in regparse.c.

An issue was discovered in GitLab Community and Enterprise Edition 11.8.x before 11.8.10, 11.9.x before 11.9.11, and 11.

An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x befor

An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x befor

In Limesurvey before 3.17.14, the entire database is exposed through browser caching.

Limesurvey before 3.17.14 uses an anti-CSRF cookie without the HttpOnly flag, which allows attackers to access a cookie

The sitebuilder-dynamic-components plugin through 1.0 for WordPress has PHP object injection via an AJAX request.

Solr versions 1.3.0 to 1.4.1, 3.1.0 to 3.6.2 and 4.0.0 to 4.10.4 are vulnerable to an XML resource consumption attack (a

The Recruitment module in Humanica Humatrix 7 1.0.0.203 and 1.0.0.681 allows an unauthenticated attacker to change the p

In SAP Business Objects Business Intelligence Platform, before versions 4.1, 4.2 and 4.3, some dynamic pages (like jsp)

SAP Kernel (RFC), KRNL32NUC, KRNL32UC and KRNL64NUC before versions 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL64UC, before versi

In Couchbase Server 4.6.3 and 5.5.0, secondary indexing encodes the entries to be indexed using collatejson. When index

In Couchbase Server 5.0.0, when an invalid Remote Cluster Certificate was entered as part of the reference creation, XDC

HTTP cookie in Micro Focus Service manager, Versions 9.30, 9.31, 9.32, 9.33, 9.34, 9.35, 9.40, 9.41, 9.50, 9.51, 9.52, 9

Modifiable read only check box In Micro Focus Service Manager, versions 9.60p1, 9.61, 9.62. This vulnerability could be

In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to edit an

An issue was discovered in py-lmdb 0.97. mdb_node_del does not validate a memmove in the case of an unexpected node->mn_

An issue was discovered in py-lmdb 0.97. There is a divide-by-zero error in the function mdb_env_open2 if mdb_env_read_h

McAfee Web Gateway (MWG) earlier than 7.8.2.13 is vulnerable to a remote attacker exploiting CVE-2019-9517, potentially

In the Eclipse Paho Java client library version 1.2.0, when connecting to an MQTT server using TLS and setting a host na

Dino before 2019-09-10 does not properly check the source of a carbons message in module/xep/0280_message_carbons.vala.

Dino before 2019-09-10 does not check roster push authorization in module/roster/module.vala.

Dino before 2019-09-10 does not properly check the source of an MAM message in module/xep/0313_message_archive_managemen

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Mi

A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka 'VBScrip

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Mi

A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet

A denial of service vulnerability exists in Microsoft Exchange Server software when the software fails to properly handl

A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka 'VBScrip

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Mi

A security feature bypass vulnerability exists when Microsoft Yammer App for Android fails to apply the correct Intune M

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Mi

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Mi

A denial of service vulnerability exists when .NET Core improperly handles web requests, aka '.NET Core Denial of Servic

An exploitable denial-of-service vulnerability exists in the session handling functionality of the NETGEAR N300 (WNR2000

An exploitable denial-of-service vulnerability exists in the Host Access Point Daemon (hostapd) on the NETGEAR N300 (WNR

includes/wizard/wizard.php in the Ocean Extra plugin through 1.5.8 for WordPress allows unauthenticated options changes

An unauthenticated attacker can achieve unauthorized access to sensitive data by exploiting Windows SMB protocol on a cl

On Tenda N301 wireless routers, a long string in the wifiSSID parameter of a goform/setWifi POST request causes the devi

A vulnerability has been identified in SIMATIC TDC CP51M1 (All versions < V1.1.7). An attacker with network access to th

CODESYS V3 web server, all versions prior to 3.5.14.10, allows an attacker to send specially crafted http or https reque

Bower before 1.8.8 has a path traversal vulnerability permitting file write in arbitrary locations via install command,

ifw8 Router ROM v4.31 allows credential disclosure by reading the action/usermanager.htm HTML source code.

In Wireshark 3.0.0 to 3.0.3 and 2.6.0 to 2.6.10, the Gryphon dissector could go into an infinite loop. This was addresse

The mail-masta plugin 1.0 for WordPress has local file inclusion in count_of_send.php and csvexport.php.

The estatik plugin before 2.3.0 for WordPress has unauthenticated arbitrary file upload via es_media_images[] to wp-admi