2019

Koji through 1.18.0 allows remote Directory Traversal, with resultant Privilege Escalation.

An issue was discovered in fastadmin 1.0.0.20190705_beta. There is a public/admin/general.config/edit CSRF vulnerability

A vulnerability has been identified in SIMATIC IT UADM (All versions < V1.3). An authenticated remote attacker with netw

An information disclosure vulnerability exists in Microsoft SQL Server Management Studio (SSMS) when it improperly enfor

An elevation of privilege vulnerability exists in Microsoft SharePoint, aka 'Microsoft SharePoint Elevation of Privilege

A denial of service vulnerability exists when Windows improperly handles objects in memory, aka 'Windows Denial of Servi

A denial of service vulnerability exists when Windows improperly handles objects in memory, aka 'Windows Denial of Servi

A denial of service vulnerability exists when Windows improperly handles objects in memory, aka 'Windows Denial of Servi

An information disclosure vulnerability exists when Microsoft Edge based on Edge HTML improperly handles objects in memo

An information disclosure vulnerability exists in Microsoft SQL Server Management Studio (SSMS) when it improperly enfor

find_abstract_instance in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binut

An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.32. I

Bento4 1.5.1.0 has a NULL pointer dereference in AP4_DescriptorListInspector::Action in Core/Ap4Descriptor.h, related to

Bento4 1.5.1.0 has a NULL pointer dereference in AP4_DescriptorListWriter::Action in Core/Ap4Descriptor.h, related to AP

Bento4 1.5.1.0 has a NULL pointer dereference in AP4_Descriptor::GetTag in Core/Ap4Descriptor.h, related to AP4_StsdAtom

Tracker PDF-XChange Editor before 8.0.330.0 has an NTLM SSO hash theft vulnerability using crafted FDF or XFDF files (a

An issue was discovered in Landing-CMS 0.0.6. There is a CSRF vulnerability that can change the admin's password via the

The Infinite Design application 3.4.12 for Android sends a username and password via TCP without any encryption during l

NETGEAR JNR1010 devices before 1.0.0.32 allow cgi-bin/webproc CSRF via the :InternetGatewayDevice.X_TWSZ-COM_URL_Filter.

The Yale Bluetooth Key application for mobile devices allows unauthorized unlock actions by sniffing Bluetooth Low Energ

An arbitrary file read vulnerability in Jenkins Google OAuth Credentials Plugin 0.9 and earlier allowed attackers able t

A missing permission check in Jenkins CRX Content Package Deployer Plugin 1.8.1 and earlier allowed attackers with Overa

Jenkins Bumblebee HP ALM Plugin 4.1.3 and earlier unconditionally disabled SSL/TLS and hostname verification for connect

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Encryption). Supported versions

Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component: Studio). The supported versi

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: PS). Supported versions that are affected

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are af

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are af

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are af

Vulnerability in the Oracle FLEXCUBE Direct Banking product of Oracle Financial Services Applications (component: eMail)

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Parser). Supported versions that are affec

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: C API). Supported versions that are affect

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that ar

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that ar

A packet containing a malformed DUID can cause the Kea DHCPv6 server process (kea-dhcp6) to exit due to an assertion fai

An invalid hostname option can trigger an assertion failure in the Kea DHCPv4 server process (kea-dhcp4), causing the se

A vulnerability in the web-based management interface of Cisco SPA100 Series Analog Telephone Adapters (ATAs) could allo

A vulnerability in the web-based management interface of Cisco SPA100 Series Analog Telephone Adapters (ATAs) could allo

A vulnerability in the web-based management interface of Cisco SPA100 Series Analog Telephone Adapters (ATAs) could allo

A vulnerability in the web-based management interface of Cisco SPA100 Series Analog Telephone Adapters (ATAs) could allo

A vulnerability in the Control and Provisioning of Wireless Access Points (CAPWAP) protocol implementation of Cisco Airo

A vulnerability in the bridge protocol data unit (BPDU) forwarding functionality of Cisco Aironet Access Points (APs) co

A Local File Inclusion (LFI) issue in the addon CUx-Daemon 1.11a of the eQ-3 Homematic CCU-Firmware 2.35.16 until 2.45.6

In FusionPBX up to v4.5.7, the file app/music_on_hold/music_on_hold.php uses an unsanitized "file" variable coming from

In FusionPBX up to v4.5.7, the file app\xml_cdr\xml_cdr_delete.php uses an unsanitized "rec" variable coming from the UR

In FusionPBX up to v4.5.7, the file resources\download.php uses an unsanitized "f" variable coming from the URL, which t

Stephan Mooltipass Moolticute through 0.42.1 (and possibly earlier versions) has Incorrect Access Control.

WUSTL XNAT 1.7.5.3 allows XXE attacks via a POST request body.

Jenkins Mattermost Notification Plugin 2.7.0 and earlier stored webhook URLs containing a secret token unencrypted in it

A missing permission check in Jenkins Dynatrace Application Monitoring Plugin allows attackers with Overall/Read permiss