2019

Memory corruption in PAN-OS 7.1.24 and earlier, PAN-OS 8.0.19 and earlier, PAN-OS 8.1.9 and earlier, and PAN-OS 9.0.3 an

The proxystatistics module before 3.1.0 for SimpleSAMLphp allows SQL Injection in lib/Auth/Process/DatabaseCommand.php.

The Acclaim block plugin before 2019-06-26 for Moodle allows SQL Injection via delete_records.

Tasking Manager before 3.4.0 allows SQL Injection via custom SQL.

Path traversal vulnerability in Micro Focus Verastream Host Integrator (VHI), versions 7.7 SP2 and earlier, The vulnerab

GNU Libextractor through 1.9 has a heap-based buffer over-read in the function EXTRACTOR_dvi_extract_method in plugins/d

An issue was discovered on D-Link DIR-823G devices with firmware V1.0.2B05. There is a command injection in HNAP1 (explo

An issue was discovered on D-Link DIR-823G devices with firmware V1.0.2B05. There is a command injection in HNAP1 (explo

An issue was discovered on D-Link DIR-823G devices with firmware V1.0.2B05. There is a command injection in HNAP1 (explo

An issue was discovered on D-Link DIR-823G devices with firmware V1.0.2B05. There is a command injection in HNAP1 (explo

An issue was discovered on D-Link DIR-823G devices with firmware V1.0.2B05. There is a command injection in HNAP1 (explo

Little Snitch versions 4.4.0 fixes a vulnerability in a privileged helper tool. However, the operating system may have m

Little Snitch versions 4.3.0 to 4.3.2 have a local privilege escalation vulnerability in their privileged helper tool. T

All versions of the HTTPie package prior to version 1.0.3 are vulnerable to Open Redirect that allows an attacker to wri

deeply is vulnerable to Prototype Pollution in versions before 3.1.0. The function assign-deep could be tricked into add

set-value is vulnerable to Prototype Pollution in versions lower than 3.0.1. The function mixin-deep could be tricked in

mixin-deep is vulnerable to Prototype Pollution in versions before 1.3.2 and version 2.0.0. The function mixin-deep coul

There is Missing SSL Certificate Validation in the pw3270 terminal emulator before version 5.1.

comelz Quark before 2019-03-26 allows directory traversal to locations outside of the project directory.

Power-Response before 2019-02-02 allows directory traversal (up to the application's main directory) via a plugin.

Swoole before 4.2.13 allows directory traversal in swPort_http_static_handler.

jc21 Nginx Proxy Manager before 2.0.13 allows %2e%2e%2f directory traversal.

Cuberite before 2019-06-11 allows webadmin directory traversal via ....// because the protection mechanism simply remove

The ServiceExecutor resource in Jira before version 8.3.2 allows remote attackers to trigger the creation of export file

The /rest/issueNav/1/issueTable resource in Jira before version 8.3.2 allows remote attackers to enumerate usernames via

Several worklog rest resources in Jira before version 7.13.7, and from version 8.0.0 before version 8.3.2 allow remote a

The wikirenderer component in Jira before version 7.13.6, and from version 8.0.0 before version 8.3.2 allows remote atta

The Uninstall REST endpoint in Atlassian Universal Plugin Manager before version 2.22.19, from version 3.0.0 before vers

Search Guard Kibana Plugin versions before 5.6.8-7 and before 6.x.y-12 had an issue that an authenticated Kibana user co

Search Guard Kibana Plugin versions before 5.6.8-7 and before 6.x.y-12 had an issue that an attacker can redirect the us

Search Guard versions before 23.1 had an issue that an administrative user is able to retrieve bcrypt password hashes of

The ChangeSharedFilterOwner resource in Jira before version 7.13.6, from version 8.0.0 before version 8.2.3, and from ve

The ViewSystemInfo class doGarbageCollection method in Jira before version 7.13.6, from version 8.0.0 before version 8.2

Various exposed resources of the ViewLogging class in Jira before version 7.13.6, from version 8.0.0 before version 8.2.

The AddResolution.jspa resource in Jira before version 7.13.6, from version 8.0.0 before version 8.2.3, and from version

The startup.jsp resource in Jira before version 7.13.6, from version 8.0.0 before version 8.2.3, and from version 8.3.0

The MigratePriorityScheme resource in Jira before version 8.3.2 allows remote attackers to inject arbitrary HTML or Java

The Privacy > Phone Number feature in the Telegram app 5.10 for Android and iOS provides an incorrect indication that th

openITCOCKPIT before 3.7.1 allows SSRF, aka RVID 5-445b21.

openITCOCKPIT before 3.7.1 allows deletion of files, aka RVID 4-445b21.

openITCOCKPIT before 3.7.1 has reflected XSS, aka RVID 3-445b21.

openITCOCKPIT before 3.7.1 has CSRF, aka RVID 2-445b21.

openITCOCKPIT before 3.7.1 allows code injection, aka RVID 1-445b21.

Ignite Realtime Openfire before 4.4.1 has reflected XSS via an LDAP setup test.

DfE School Experience before v16333-GA has XSS via a teacher training URL.

django-js-reverse (aka Django JS Reverse) before 0.9.1 has XSS via js_reverse_inline.

Bolt before 3.6.10 has XSS via createFolder or createFile in Controller/Async/FilesystemManager.php.

Bolt before 3.6.10 has XSS via an image's alt or title field.

Bolt before 3.6.10 has XSS via a title that is mishandled in the system log.

selectize-plugin-a11y before 1.1.0 has XSS via the msg field.