2019

serde serde_yaml 0.6.0 to 0.8.3 is affected by: Uncontrolled Recursion. The impact is: Denial of service by aborting. Th

yaml-rust 0.4.0 and earlier is affected by: Uncontrolled Recursion. The impact is: Denial of service by impossible to ca

In Octopus Deploy versions 3.0.19 to 2019.7.2, when a web request proxy is configured, an authenticated user (in certain

In FreeBSD 11.3-STABLE before r350217, 11.3-RELEASE before 11.3-RELEASE-p1, and 11.2-RELEASE before 11.2-RELEASE-p12, du

Mikrotik RouterOS before 6.44.5 (long-term release tree) is vulnerable to memory exhaustion. By sending a crafted HTTP r

Mikrotik RouterOS before 6.44.5 (long-term release tree) is vulnerable to stack exhaustion. By sending a crafted HTTP re

Exiv2::PngImage::readMetadata() in pngimage.cpp in Exiv2 0.27.99.0 allows attackers to cause a denial of service (heap-b

In Exiv2 0.27.99.0, there is an out-of-bounds read in Exiv2::MrwImage::readMetadata() in mrwimage.cpp. It could result i

An issue was discovered in Libav 12.3. There is an infinite loop in the function mov_probe in the file libavformat/mov.c

In Libav 12.3, there is an infinite loop in the function wv_read_block_header() in the file wvdec.c.

The Unity Web Player plugin before 4.6.6f2 and 5.x before 5.0.3f2 allows attackers to read messages or access online ser

The WP Fastest Cache plugin through 0.8.9.0 for WordPress allows remote attackers to delete arbitrary files because wp_p

Imgix through 2019-06-19 allows remote attackers to cause a denial of service (resource consumption) by manipulating a s

A CSRF vulnerability in Settings form in the Custom Simple Rss plugin 2.0.6 for WordPress allows attackers to change the

An issue was discovered in Libav 12.3. An access violation allows remote attackers to cause a denial of service (applica

In mpc8_read_header in libavformat/mpc8.c in Libav 12.3, an input file can result in an avio_seek infinite loop and hang

An issue was discovered in Libav 12.3. Division by zero in range_decode_culshift in libavcodec/apedec.c allows remote at

cPanel before 76.0.8 allows a persistent Virtual FTP accounts after removal of its associated domain (SEC-454).

A vulnerability was found in postgresql versions 11.x prior to 11.3. Using a purpose-crafted insert to a partitioned tab

libopenmpt before 0.3.13 allows a crash with malformed MED files.

libopenmpt before 0.3.11 allows a crash with certain malformed custom tunings in MPTM files.

libopenmpt before 0.4.5 allows a crash during playback due to an out-of-bounds read in XM and MT2 files.

DSM in libopenmpt before 0.4.2 allows an assertion failure during file parsing with debug STLs.

J2B in libopenmpt before 0.4.2 allows an assertion failure during file parsing with debug STLs.

Jenkins Maven Integration Plugin 3.3 and earlier did not apply build log decorators to module builds, potentially reveal

Jenkins Skytap Cloud CI Plugin 2.06 and earlier stored credentials unencrypted in job config.xml files on the Jenkins ma

DrayTek routers before 2018-05-23 allow CSRF attacks to change DNS or DHCP settings, a related issue to CVE-2017-11649.

An authentication bypass vulnerability was discovered in foreman-tasks before 0.15.7. Previously, commit tasks were sear

cPanel before 74.0.8 allows FTP access during account suspension (SEC-449).

cPanel before 11.54.0.4 lacks ACL enforcement in the AppConfig subsystem (SEC-85).

cPanel before 11.54.0.0 allows subaccounts to discover sensitive data through comet feeds (SEC-29).

cPanel before 11.54.0.0 allows a bypass of the e-mail sending limit (SEC-60).

cPanel before 55.9999.141 allows arbitrary file-read operations during authentication with caldav (SEC-108).

cPanel before 11.54.0.4 allows arbitrary file-read operations via the bin/fmq script (SEC-70).

cPanel before 11.54.0.4 allows certain file-read operations in bin/setup_global_spam_filter.pl (SEC-74).

The chcpass script in cPanel before 11.54.0.4 reveals a password hash (SEC-77).

cPanel before 11.54.0.4 allows certain file-chmod operations in scripts/secureit (SEC-82).

cPanel before 70.0.23 allows .htaccess restrictions bypass when Htaccess Optimization is enabled (SEC-401).

cPanel before 70.0.23 does not prevent e-mail account suspensions from being applied to unowned accounts (SEC-411).

cPanel before 55.9999.141 allows arbitrary file-read operations because of a multipart form processing error (SEC-99).

cPanel before 55.9999.141 allows FTP cPHulk bypass via account name munging (SEC-102).

cPanel before 68.0.27 creates world-readable files during use of WHM Apache Includes Editor (SEC-388).

cPanel before 57.9999.54 allows arbitrary file-read operations for Webmail accounts via Branding APIs (SEC-120).

cPanel before 57.9999.54 incorrectly sets log-file permissions in dnsadmin-startup and spamd-startup (SEC-124).

In cPanel before 57.9999.54, user log files become world-readable when rotated by cpanellogd (SEC-125).

In cPanel before 55.9999.141, Scripts/addpop reveals a command-line password in a process list (SEC-75).

In cPanel before 67.9999.103, the backup interface could return a backup archive with all MySQL databases (SEC-283).

In cPanel before 67.9999.103, a user account's backup archive could contain all MySQL databases on the server (SEC-284).

In Apache Tika 1.19 to 1.21, a carefully crafted 2003ml or 2006ml file could consume all available SAXParsers in the poo

A cross-site request forgery vulnerability in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior