2019

Linear eMerge 50P/5000P devices allow Cookie Path Traversal.

Linear eMerge 50P/5000P devices allow Authenticated Command Injection with root Code Execution.

Linear eMerge E3-Series devices have Cleartext Credentials in a Database.

Linear eMerge E3-Series devices have Hard-coded Credentials.

An issue was discovered on D-Link DCS-1130 devices. The device provides a user with the capability of setting a SMB fold

Linear eMerge E3-Series devices have Default Credentials.

Linear eMerge E3-Series devices allow Directory Traversal.

Linear eMerge E3-Series devices allow Command Injections.

An issue was discovered on D-Link DCS-1100 and DCS-1130 devices. The binary rtspd in /sbin folder of the device handles

An issue was discovered on D-Link DCS-1100 and DCS-1130 devices. The device has a custom telnet daemon as a part of the

verification.py in django-rest-registration (aka Django REST Registration library) before 0.5.0 relies on a static strin

A weak Cookie parameter is used in the web application of Moxa OnCell G3100-HSPA Series version 1.4 Build 16062919 and p

Remote code execution is possible in Cloudera Data Science Workbench version 1.3.0 and prior releases via unspecified at

There is Memory corruption in the web interface of Moxa OnCell G3100-HSPA Series version 1.5 Build 17042015 and prio,r a

Moxa OnCell G3100-HSPA Series version 1.6 Build 17100315 and prior use a proprietary monitoring protocol that does not p

Moxa OnCell G3100-HSPA Series version 1.6 Build 17100315 and prior use a proprietary configuration protocol that does no

Memory corruption issue was discovered in Moxa OnCell G3470A-LTE Series version 1.6 Build 18021314 and prior, a differen

SQL injection vulnerability in /wbg/core/_includes/authorization.inc.php in CMS Web-Gooroo through 2013-01-19 allows rem

An issue was discovered in Riello NetMan 204 14-2 and 15-2. The issue is with the login script and wrongpass Python scri

The Publish Service in FlexPaper (later renamed FlowPaper) 2.3.6 allows remote code execution via setup.php and change_c

A buffer overflow in DOSBox 0.74-2 allows attackers to execute arbitrary code.

In JetBrains YouTrack Confluence plugin versions before 1.8.1.3, it was possible to achieve Server Side Template Injecti

In several JetBrains IntelliJ IDEA Ultimate versions, an Application Server run configuration (for Tomcat, Jetty, Resin,

A query injection was possible in JetBrains YouTrack. The issue was fixed in YouTrack 2018.4.49168.

An Insecure Direct Object Reference, with Authorization Bypass through a User-Controlled Key, was possible in JetBrains

Certain actions could cause privilege escalation for issue attachments in JetBrains YouTrack. The issue was fixed in 201

In FreeBSD 12.0-STABLE before r349622, 12.0-RELEASE before 12.0-RELEASE-p7, 11.3-PRERELEASE before r349624, 11.3-RC3 bef

In several JetBrains IntelliJ IDEA versions, a Spring Boot run configuration with the default setting allowed remote att

In several JetBrains IntelliJ IDEA versions, creating remote run configurations of JavaEE application servers leads to s

In several versions of JetBrains IntelliJ IDEA Ultimate, creating Task Servers configurations leads to saving a cleartex

The Amcrest IPM-721S Amcrest_IPC-AWXX_Eng_N_V2.420.AC00.17.R.20170322 allows HTTP requests that permit enabling various

Amcrest IPM-721S V2.420.AC00.16.R.20160909 devices have default credentials that are hardcoded in the firmware and can b

Amcrest IPM-721S V2.420.AC00.16.R.20160909 devices have a timeout policy to wait for 5 minutes in case 30 incorrect pass

Amcrest IPM-721S V2.420.AC00.16.R.20160909 devices allow an unauthenticated attacker to download the administrative cred

An SSRF attack was possible on a JetBrains YouTrack server. The issue (1 of 2) was fixed in JetBrains YouTrack 2018.4.49

nsd-checkzone in NLnet Labs NSD 4.2.0 has a Stack-based Buffer Overflow in the dname_concatenate() function in dname.c.

CodeIgniter Rest Server (aka codeigniter-restserver) 2.7.1 allows XXE attacks.

Hawt Hawtio through 2.5.0 is vulnerable to SSRF, allowing a remote attacker to trigger an HTTP request from an affected

An issue was discovered in the VeronaLabs wp-statistics plugin before 12.6.7 for WordPress. The v1/hit endpoint of the A

A SQL Injection issue was discovered in webERP 4.15. Payments.php accepts payment data in base64 format. After this is d

AROX School-ERP Pro has a command execution vulnerability. import_stud.php and upload_fille.php do not have session cont

myTinyTodo 1.3.3 through 1.4.3 allows CSV Injection. This is fixed in 1.5.

Invoxia NVX220 devices allow TELNET access as admin with a default password.

BKS EBK Ethernet-Buskoppler Pro before 3.01 allows Unrestricted Upload of a File with a Dangerous Type.

WolfVision Cynap before 1.30j uses a static, hard-coded cryptographic secret for generating support PINs for the 'forgot

/web/Lib/Action/IndexAction.class.php in D-Link Central WiFi Manager CWM(100) before v1.03R0100_BETA6 allows remote atta

An issue was discovered in the D-Link Central WiFi Manager CWM(100) before v1.03R0100_BETA6. Input does not get validate

A SQL Injection was discovered in D-Link Central WiFi Manager CWM(100) before v1.03R0100_BETA6 in PayAction.class.php wi

Dynacolor FCM-MB40 v1.2.0.0 use /etc/appWeb/appweb.pass to store administrative web-interface credentials in cleartext.

The strong_password gem 0.0.7 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a