2019

The optinmonster plugin before 1.1.4.6 for WordPress has incorrect access control for shortcodes because of a nonce leak

The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control for admin_init settings changes.

The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpi_user_id for invoice retrieval.

The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpi_paypal payer metadata updates.

The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpi_interkassa payer metadata updates

The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpi_twocheckout payer metadata update

IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 Network Deployment could allow a remote attacker to obtain sensi

The Reset Password feature in Pagekit 1.0.17 gives a different response depending on whether the e-mail address of a val

Jenkins Aqua MicroScanner Plugin 1.0.7 and earlier transmitted configured credentials in plain text as part of the globa

In BIG-IP 15.0.0, 14.1.0-14.1.0.6, 14.0.0-14.0.0.5, 13.0.0-13.1.1.5, 12.1.0-12.1.4.1, 11.5.1-11.6.4, BIG-IQ 7.0.0, 6.0.0

SilverStripe through 4.3.3 has incorrect access control for protected files uploaded via Upload::loadIntoFile(). An atta

On versions 13.0.0-13.1.0.1, 12.1.0-12.1.4.1, 11.6.1-11.6.4, and 11.5.1-11.5.9, BIG-IP platforms where AVR, ASM, APM, PE

In MediaWiki through 1.33.0, Special:Redirect allows information disclosure of suppressed usernames via a User ID Lookup

Platinum UPnP SDK 1.2.0 allows Directory Traversal in Core/PltHttpServer.cpp because it checks for /.. where it should b

In SilverStripe assets 4.0, there is broken access control on files.

Arm Mbed TLS before 2.19.0 and Arm Mbed Crypto before 2.0.0, when deterministic ECDSA is enabled, use an RNG with insuff

IBM QRadar SIEM 7.2 and 7.3 is vulnerable to Server Side Request Forgery (SSRF). This may allow an unauthenticated attac

In Honeywell Performance IP Cameras and Performance NVRs, the integrated web server of the affected devices could allow

In the Versioned Files module through 2.0.3 for SilverStripe 3.x, unpublished versions of files are publicly exposed to

An issue was discovered in CKFinder through 2.6.2.1 and 3.x through 3.5.0. The documentation has misleading information

SuiteCRM 7.10.x before 7.10.20 and 7.11.x before 7.11.8 allows unintended public exposure of files.

If a wildcard ('*') is specified for the host in Content Security Policy (CSP) directives, any port or path restriction

In the Wallpaper Manager service, there is a possible information disclosure due to a missing permission check. Any appl

Zcashd in Zcash before 2.0.7-3 allows discovery of the IP address of a full node that owns a shielded address, related t

IBM Sterling File Gateway 2.2.0.0 through 6.0.1.0 displays sensitive information in HTTP requests which could be used in

IBM WebSphere Application Server Liberty could allow a remote attacker to obtain sensitive information caused by the imp

IBM Sterling File Gateway 2.2.0.0 through 6.0.1.0 could allow a remote attacker to traverse directories on the system. A

IBM Daeja ViewONE Virtual 5.0 through 5.0.6 could expose internal parameters to ViewONE clients that could be used in fu

In JetBrains Hub versions earlier than 2018.4.11436, there was no option to force a user to change the password and no p

The JetBrains Vim plugin before version 0.52 was storing individual project data in the global vim_settings.xml file. Th

Online Store System v1.0 delete_product.php doesn't check to see if a user authtenticated or has administrative rights a

IBM Security Directory Server 6.4.0 discloses sensitive information to unauthorized users. The information can be used t

Server metadata could be exposed because one of the error messages reflected the whole response back to the client in Je

UserHashedTableAuth in JetBrains Ktor framework before 1.2.0-rc uses a One-Way Hash with a Predictable Salt for storing

IBM WebSphere Application Server 7.0, 8.0, 8.5, 9.0, and Liberty could allow a remote attacker to obtain sensitive infor

rpcapd/daemon.c in libpcap before 1.9.1 mishandles certain length values because of reuse of a variable. This may open u

rpcapd/daemon.c in libpcap before 1.9.1 on non-Windows platforms provides details about why authentication failed, which

rpcapd/daemon.c in libpcap before 1.9.1 allows SSRF because a URL may be provided as a capture source.

sf-pcapng.c in libpcap before 1.9.1 does not properly validate the PHB header length before allocating memory.

IBM Security Key Lifecycle Manager 2.6, 2.7, 3.0, and 3.0.1 discloses sensitive information to unauthorized users. The i

The token generator in index.php in Centreon Web before 2.8.27 is predictable.

A vulnerability was found in OpenShift builds, versions 4.1 up to 4.3. Builds that extract source from a container image

SAP Process Integration, business-to-business add-on, versions 1.0, 2.0, does not perform authentication check properly

Controls for zone transfers may not be properly applied to Dynamically Loadable Zones (DLZs) if the zones are writable V

On MX Series, when the SIP ALG is enabled, receipt of a certain malformed SIP packet may crash the MS-PIC component on M

A security vulnerability exists in the Zingbox Inspector versions 1.294 and earlier, that can allow an attacker to easil

In OISF LibHTP before 0.5.31, as used in Suricata 4.1.4 and other products, an HTTP protocol parsing error causes the ht

An issue was discovered in Kirona Dynamic Resource Scheduling (DRS) 5.5.3.5. An unauthenticated user can access /osm/REG

There is a heap-based buffer over-read in the _nc_find_entry function in tinfo/comp_hash.c in the terminfo library in nc

Vulnerability in the Oracle Solaris product of Oracle Systems (component: Filesystem). Supported versions that are affec