2019

Polipo before 1.0.4.1 suffers from a DoD vulnerability via specially-crafted HTTP POST / PUT request.

Cloud Foundry UAA Release, versions prior to v74.8.0, logs all query parameters to tomcat’s access file. If the query pa

The /webtools/control/xmlrpc endpoint in OFBiz XML-RPC event handler is exposed to External Entity Injection by passing

An issue was discovered in tls_verify_crl in ProFTPD through 1.3.6b. Failure to check for the appropriate field of a CRL

An issue was discovered in tls_verify_crl in ProFTPD before 1.3.6. A wrong iteration variable, used when checking a clie

An issue was discovered in tls_verify_crl in ProFTPD before 1.3.6. Direct dereference of a NULL pointer (a variable init

A local file inclusion flaw was found in the way the phpLDAPadmin before 0.9.8 processed certain values of the "Accept-L

An error-handling flaw was found in python-ecdsa before version 0.13.3. During signature decoding, malformed DER signatu

There is Sensitive Information in Cloudera Manager before 5.4.6 Diagnostic Support Bundles.

Cloudera CDH before 5.9 has Potentially Sensitive Information in Diagnostic Support Bundles.

An issue was discovered in GitLab Community and Enterprise Edition 8.15 through 12.4 in the Comments Search feature prov

typed_ast 1.3.0 and 1.3.1 has a handle_keywordonly_args out-of-bounds read. An attacker with the ability to cause a Pyth

typed_ast 1.3.0 and 1.3.1 has an ast_for_arguments out-of-bounds read. An attacker with the ability to cause a Python in

With pipelining enabled each incoming query on a TCP connection requires a similar resource allocation to a query receiv

An issue was discovered in GitLab Community and Enterprise Edition 11 through 12.4 when building Nested GraphQL queries.

An issue was discovered in Squid 3.x and 4.x through 4.8. Due to incorrect input validation, there is a heap-based buffe

An issue was discovered in Squid 2.x, 3.x, and 4.x through 4.8. Due to incorrect data management, it is vulnerable to in

WEBrick::HTTPAuth::DigestAuth in Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 has a regular expressi

The news module in CMSMS before 1.9.4.3 allows remote attackers to corrupt new articles.

Information Disclosure vulnerability in the 802.11 stack, as used in FreeBSD before 8.2 and NetBSD when using certain no

An Improper Input Validation vulnerability in the SSL VPN portal of FortiOS versions 6.2.1 and below, and 6.0.6 and belo

On F5 SSL Orchestrator 15.0.0-15.0.1 and 14.0.0-14.1.2, TMM may crash when processing SSLO data in a service-chaining co

On BIG-IP 15.0.0-15.0.1, 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, and 13.1.0-13.1.1.4, the TMM process may produce a core file

On BIG-IP 15.0.0-15.0.1, 14.1.0-14.1.0.5, 14.0.0-14.0.0.4, 13.1.0-13.1.1.5, 12.1.0-12.1.4.1, and 11.5.1-11.6.5, under ce

On BIG-IP 15.0.0-15.0.1, 14.1.0-14.1.2, 14.0.0-14.0.1, 13.1.0-13.1.3.1, 12.1.0-12.1.5, and 11.5.1-11.6.5.1, undisclosed

On BIG-IP 15.0.0-15.0.1, 14.1.0-14.1.2, 14.0.0-14.0.1, and 13.1.0-13.1.3.1, under certain conditions tmm may leak memory

On BIG-IP AFM 15.0.0-15.0.1, 14.0.0-14.1.2, and 13.1.0-13.1.3.1, when bad-actor detection is configured on a wildcard vi

On versions 15.0.0-15.0.1 and 14.0.0-14.1.2, when the BIG-IP is configured in HTTP/2 Full Proxy mode, specifically craft

An attacker may use a specially crafted message to force Relion 650 series (versions 1.3.0.5 and prior) or Relion 670 se

A downloadFile.php download_file path traversal vulnerability in rConfig through 3.9.3 allows attackers to list files in

A Directory Traversal in the Web interface of the Allied Telesis AT-GS950/8 until Firmware AT-S107 V.1.1.3 [1.00.047] al

There is a use of insufficiently random values vulnerability in Huawei ViewPoint products. An unauthenticated, remote at

The PGP signature parsing in Module::Signature before 0.74 allows remote attackers to cause the unsigned portion of a SI

illumos, as used in OmniOS Community Edition before r151030y, allows a kernel crash via an application with multiple thr

Zabbix before 5.0 represents passwords in the users table with unsalted MD5.

Anviz access control devices perform cleartext transmission of sensitive information (passwords/pins and names) when rep

Anviz access control devices expose credentials (names and passwords) by allowing remote attackers to query this informa

The Anviz Management System for access control has insufficient logging for device events such as door open requests.

Anviz access control devices are vulnerable to replay attacks which could allow attackers to intercept and replay open d

An issue was discovered in TitanHQ WebTitan before 5.18. Some functions, such as /history-x.php, of the administration i

An issue was discovered in TitanHQ WebTitan before 5.18. It contains a Remote Code Execution issue through which an atta

openslp: SLPIntersectStringList()' Function has a DoS vulnerability

ReviewBoard: has an access-control problem in REST API

When using the Azure backend with a shared access signature (SAS), Terraform versions prior to 0.12.17 may transmit the

webauth before 4.6.1 has authentication credential disclosure

The asn1_signature function in asn1.c in Cameron Hamilton-Rich axTLS through 2.1.5 has a Buffer Overflow that allows rem

process_certificate in tls1.c in Cameron Hamilton-Rich axTLS through 2.1.5 has a Buffer Overflow via a crafted TLS certi

A denial-of-service vulnerability exists in the processing of multi-part/form-data requests in the base GoAhead web serv

An exploitable denial-of-service vulnerability exists in the UDPRelay functionality of Shadowsocks-libev 3.3.2. When uti

TrevorC2 v1.1/v1.2 fails to prevent fingerprinting primarily via a discrepancy between response headers when responding