2019

makepasswd 1.10 default settings generate insecure passwords

Null pointer dereference can occur while parsing invalid chunks while playing the nonstandard clip in Snapdragon Auto, S

An issue was discovered in NiceHash Miner before 2.0.3.0. A missing rate limit while adding a wallet via Email address a

konversation before 1.2.3 allows attackers to cause a denial of service.

An Integer Overflow exists in WebKit in Google Chrome before Blink M11 in the macOS WebCore::GraphicsContext::fillRect f

Dump Servlet information leak in jetty before 6.1.22.

The Customer Context Filter in Atlassian Jira Service Desk Server and Jira Service Desk Data Center before 3.9.17, from

DjVuLibre 3.5.27 has a NULL pointer dereference in the function DJVU::filter_fv at IW44EncodeCodec.cpp.

Portainer before 1.22.1 allows Directory Traversal.

Two memory leaks in the sja1105_static_config_upload() function in drivers/net/dsa/sja1105/sja1105_spi.c in the Linux ke

A memory leak in the komeda_wb_connector_add() function in drivers/gpu/drm/arm/display/komeda/komeda_wb_connector.c in t

A memory leak in the sof_dfsentry_write() function in sound/soc/sof/debug.c in the Linux kernel through 5.3.9 allows att

A memory leak in the dwc3_pci_probe() function in drivers/usb/dwc3/dwc3-pci.c in the Linux kernel through 5.3.9 allows a

A vulnerability exists in kernel/time/clocksource.c in the Linux kernel before 2.6.34 where on non-GENERIC_TIME systems

The keygen.sh script in Shibboleth SP 2.0 (located in /usr/local/etc/shibboleth by default) uses OpenSSL to create a DES

viewvc 1.0.3 allows improper access control to files in a repository when using the "forbidden" configuration option.

The web server Monkeyd produces a world-readable log (/var/log/monkeyd/master.log) on gentoo.

Gambas before 3.4.0 allows remote attackers to move or manipulate directory contents or perform symlink attacks due to t

FireGPG before 0.6 handle user’s passphrase and decrypted cleartext insecurely by writing pre-encrypted cleartext and th

A flaw was found in the Ceph RGW configuration with Beast as the front end handling client requests. An unauthenticated

mod_ruid2 before 0.9.8 improperly handles file descriptors which allows remote attackers to bypass security using a CGI

Password-based encryption (PBE) algorithm, of Brocade SANnav versions before v2.0, has a weakness in generating cryptogr

It was discovered that the C++ implementation (which underlies the R, Python and Ruby implementations) of Apache Arrow 0

While investigating UBSAN errors in https://github.com/apache/arrow/pull/5365 it was discovered Apache Arrow versions 0.

In wolfSSL 4.1.0 through 4.2.0c, there are missing sanity checks of memory accesses in parsing ASN.1 certificate data wh

Envoy 1.12.0 allows a remote denial of service because of resource loops, as demonstrated by a single idle TCP connectio

A Denial Of Service vulnerability exists in the safe-svg (aka Safe SVG) plugin through 1.9.4 for WordPress, related to u

A Denial Of Service vulnerability exists in the safe-svg (aka Safe SVG) plugin through 1.9.4 for WordPress, related to p

A Denial Of Service vulnerability exists in the SVG Sanitizer module through 8.x-1.0-alpha1 for Drupal because access to

darylldoyle svg-sanitizer before 0.12.0 mishandles script and data values in attributes, as demonstrated by unexpected w

psutil (aka python-psutil) through 5.6.5 can have a double free. This occurs because of refcount mishandling within a wh

Python Twisted 14.0 trustRoot is not respected in HTTP client

Istio 1.3.x before 1.3.5 allows Denial of Service because continue_on_listener_filters_timeout is set to True, a related

mwlib 0.13 through 0.13.4 has a denial of service vulnerability when parsing #iferror magic functions

The json-jwt gem before 1.11.0 for Ruby lacks an element count during the splitting of a JWE string.

OpenStack Keystone: extremely long passwords can crash Keystone by exhausting stack space

includes/class-coming-soon-creator.php in the igniteup plugin through 3.4 for WordPress allows unauthenticated arbitrary

A vulnerability in Hitachi Command Suite 7.x and 8.x before 8.6.5-00 allows an unauthenticated remote user to read inter

A vulnerability in Hitachi Command Suite 7.x and 8.x before 8.7.0-00 allows an unauthenticated remote user to trigger a

AUO SunVeillance Monitoring System before v1.1.9e is vulnerable to mvc_send_mail.aspx (MailAdd parameter) SQL Injection.

A spoofing vulnerability exists when Azure Stack fails to validate certain requests, aka 'Azure Stack Spoofing Vulnerabi

A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka 'VBScrip

A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft

A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft

A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft

A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet

NULL pointer dereference vulnerability in ZNC before 0.092 caused by traffic stats when there are unauthenticated connec

A double-free vulnerability exists in WebKit in Google Chrome before Blink M12 in the WebCore::CSSSelector function.

The Intercom plugin through 1.2.1 for WordPress leaks a Slack Access Token in source code. An attacker can obtain a lot

WP SlackSync plugin through 1.8.5 for WordPress leaks a Slack Access Token in source code. An attacker can obtain a lot