2019

Cross-site request forgery (CSRF) vulnerability in Personalized WooCommerce Cart Page 2.4 and earlier allows remote atta

Cross-site request forgery (CSRF) vulnerability in Related YouTube Videos versions prior to 1.9.9 allows remote attacker

Cross-site request forgery (CSRF) vulnerability in HTML5 Maps 1.6.5.6 and earlier allows remote attackers to hijack the

Cross-site request forgery (CSRF) vulnerability in Custom CSS Pro 1.0.3 and earlier allows remote attackers to hijack th

index.php/admin/permissions in Ignited CMS through 2017-02-19 allows CSRF to add an administrator.

Flarum before 0.1.0-beta.9 allows CSRF against all POST endpoints, as demonstrated by changing admin settings.

On AVTECH Room Alert 3E devices before 2.2.5, an attacker with access to the device's web interface may escalate privile

In ImageMagick 7.0.8-50 Q16, ComplexImages in MagickCore/fourier.c has a heap-based buffer over-read because of incorrec

Dynacolor FCM-MB40 v1.2.0.0 devices have CSRF in all scripts under cgi-bin/.

/usr/sbin/default.sh and /usr/apache/htdocs/cgi-bin/admin/hardfactorydefault.cgi on Dynacolor FCM-MB40 v1.2.0.0 devices

In FileInputStream::Read of file_input_stream.cc, there is a possible memory corruption due to uninitialized data. This

In ihevcd_sao_shift_ctb of ihevcd_sao.c, there is a possible out of bounds write due to a missing bounds check. This cou

In ihevcd_parse_pps of ihevcd_parse_headers.c, there is a possible out of bounds write due to a missing bounds check. Th

In MakeMPEG4VideoCodecSpecificData of AVIExtractor.cpp, there is a possible out of bounds write due to an incorrect boun

MailEnable Enterprise Premium 10.23 did not use appropriate access control checks in a number of areas. As a result, it

TYPO3 8.x through 8.7.26 and 9.x through 9.5.7 allows Deserialization of Untrusted Data.

TRENDnet TEW-827DRU with firmware up to and including 2.04B03 contains a stack-based buffer overflow while returning an

In MobaXterm 11.1, the mobaxterm: URI handler has an argument injection vulnerability that allows remote attackers to ex

An issue was discovered in Eventum 3.5.0. CSRF in htdocs/manage/users.php allows creating another user with admin privil

An issue has been found in third-party PNM decoding associated with libpng 1.6.35. It is a stack-based buffer overflow i

On eQ-3 HomeMatic CCU2 devices before 2.41.8 and CCU3 devices before 3.43.16, automatic login configuration (aka setAuto

Helpy before 2.2.0 allows agents to edit admins.

CSRF in the Agent/Center component of CyberPower PowerPanel Business Edition 3.4.0 allows an attacker to submit POST req

GitLab CE/EE, versions 8.8 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an a

Wikimedia MediaWiki through 1.32.1 allows CSRF.

An issue was discovered on D-Link DIR-818LW devices with firmware 2.06betab01. There is a command injection in HNAP1 (ex

An issue was discovered on D-Link DIR-818LW devices with firmware 2.06betab01. There is a command injection in HNAP1 (ex

A cross-site request forgery vulnerability in Jenkins Docker Plugin 1.1.6 and earlier in DockerAPI.DescriptorImpl#doTest

Jenkins Mashup Portlets Plugin stored credentials unencrypted on the Jenkins master where they can be viewed by users wi

Jenkins Gogs Plugin stored credentials unencrypted in job config.xml files on the Jenkins master where they can be viewe

Jenkins Port Allocator Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they ca

Jenkins Caliper CI Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be

An CSRF issue was discovered in the JN-Jones MyBB-2FA plugin through 2014-11-05 for MyBB. An attacker can forge a reques

D-Link DIR-655 C devices before 3.02B05 BETA03 allow CSRF for the entire management console.

An issue was discovered in Squid 4.0.23 through 4.7. When checking Basic Authentication with HttpHeader::getAuth, Squid

In Apache Kafka versions between 0.11.0.0 and 2.1.0, it is possible to manually craft a Produce request which bypasses t

The Zoom Client before 4.4.53932.0709 on macOS allows remote code execution, a different vulnerability than CVE-2019-134

In Mirumee Saleor 2.7.0 (fixed in 2.8.0), CSRF protection middleware was accidentally disabled, which allowed attackers

A remote code execution vulnerability exists in Microsoft SQL Server when it incorrectly handles processing of internal

A remote code execution vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects

A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle obje

A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle obje

A remote code execution vulnerability exists in .NET software when the software fails to check the source markup of a fi

A remote code execution vulnerability exists in the way that DirectWrite handles objects in memory, aka 'DirectWrite Rem

A remote code execution vulnerability exists in the way that DirectWrite handles objects in memory, aka 'DirectWrite Rem

A remote code execution vulnerability exists in the way that DirectWrite handles objects in memory, aka 'DirectWrite Rem

A remote code execution vulnerability exists in the way that DirectWrite handles objects in memory, aka 'DirectWrite Rem

A remote code execution vulnerability exists in the way that DirectWrite handles objects in memory, aka 'DirectWrite Rem

A remote code execution vulnerability exists in the way that DirectWrite handles objects in memory, aka 'DirectWrite Rem

A remote code execution vulnerability exists in the way that DirectWrite handles objects in memory, aka 'DirectWrite Rem