2019

cPanel before 11.54.0.4 allows arbitrary file-overwrite operations in scripts/quotacheck (SEC-81).

cPanel before 55.9999.141 does not perform as two-factor authentication check when possessing another account (SEC-101).

cPanel before 68.0.15 allows arbitrary code execution via Maketext injection in PostgresAdmin (SEC-313).

cPanel before 68.0.15 allows arbitrary code execution via Maketext injection in a Reseller style upload (SEC-314).

A remote code execution vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 pri

A remote code execution vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 pri

A remote code execution vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 pri

A remote code execution vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 pri

A server-side request forgery (SSRF) vulnerability exists in Magento Open Source prior to 1.9.4.2, and Magento Commerce

A file upload filter bypass exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.

A server-side request forgery (SSRF) vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Ma

A server-side request forgery (SSRF) vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Ma

A file upload restriction bypass exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to

A remote code execution vulnerability exists in Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14

A remote code execution vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 pri

An Incorrect Access Control issue was discovered on MicroDigital N-series cameras with firmware through 6400.0.8.5 becau

An issue was discovered on MicroDigital N-series cameras with firmware through 6400.0.8.5. The firmware update process i

A vulnerability in the web management interface of Cisco Small Business 220 Series Smart Switches could allow an authent

Jitbit Helpdesk before 9.0.3 allows remote attackers to escalate privileges because of mishandling of the User/AutoLogin

A remote session reuse vulnerability was discovered in HPE 3PAR StoreServ Management and Core Software Media version(s):

SAP Kernel (ABAP Debugger), versions KRNL32NUC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL

A vulnerability in the Intelligent Platform Management Interface (IPMI) of Cisco Integrated Management Controller (IMC)

A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) Software could all

A vulnerability in the Import Cisco IMC configuration utility of Cisco Integrated Management Controller (IMC) could allo

A vulnerability in the Redfish protocol of Cisco Integrated Management Controller (IMC) could allow an authenticated, re

A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) could allow an aut

A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) Supervisor, Cisco

osCommerce 2.3.4.1 has an incomplete '.htaccess' for blacklist filtering in the "product" page. Because of this filter,

osCommerce 2.3.4.1 has an incomplete '.htaccess' for blacklist filtering in the "product" page. Remote authenticated adm

When the Elastic APM agent for Python versions before 5.1.0 is run as a CGI script, there is a variable name clash flaw

Memory corruption in PAN-OS 8.1.9 and earlier, and PAN-OS 9.0.3 and earlier will allow an administrative user to cause a

The gigpress plugin before 2.3.11 for WordPress has SQL injection in the admin area, a different vulnerability than CVE-

A SQL injection vulnerability in Snare Central before 7.4.5 allows remote authenticated attackers to execute arbitrary S

An OS Command Injection vulnerability in Snare Central before 7.4.5 allows remote authenticated attackers to inject arbi

An issue was discovered in Alfresco Community Edition 5.2 201707. By leveraging multiple components in the Alfresco Soft

Silver Peak EdgeConnect SD-WAN before 8.1.7.x allows privilege escalation (by administrators) from the menu to a root Ba

An issue was discovered in LibreNMS through 1.47. There is a command injection vulnerability in html/includes/graphs/dev

An authentication issue was discovered in GitLab that allowed a bypass of email verification. This was addressed in GitL

In Limesurvey before 3.17.14, admin users can view, update, or delete reserved menu entries without proper permissions.

In Limesurvey before 3.17.14, admin users can access the plugin manager without proper permissions.

SAP NetWeaver Application Server Java Web Container, ENGINEAPI (before versions 7.10, 7.20, 7.30, 7.31, 7.40, 7.50) and

Philips IntelliVue WLAN, portable patient monitors, WLAN Version A, Firmware A.03.09, WLAN Version A, Firmware A.03.09,

Philips IntelliVue WLAN, portable patient monitors, WLAN Version A, Firmware A.03.09, WLAN Version A, Firmware A.03.09,

The xtremelocator plugin 1.5 for WordPress has SQL injection via the id parameter.

The zm-gallery plugin 1.0 for WordPress has SQL injection via the order parameter.

The zx-csv-upload plugin 1 for WordPress has SQL injection via the id parameter.

The Post Indexer plugin before 3.0.6.2 for WordPress has SQL injection via the period parameter by a super admin.

The fs-shopping-cart plugin 2.07.02 for WordPress has SQL injection via the pid parameter.

A command injection vulnerability is present in the web management interface of ArubaOS that permits an authenticated us

OpenEMR v5.0.1-6 allows code execution.