2019

An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its m

An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its m

An information disclosure vulnerability in Android Apps using Microsoft Authentication Library (MSAL) 0.3.1-Alpha or lat

katello-headpin is vulnerable to CSRF in REST API

An issue was discovered in Xen through 4.12.x allowing 32-bit Arm guest OS users to cause a denial of service (out-of-bo

An issue was discovered in Xen through 4.12.x allowing x86 guest OS users to cause a denial of service (infinite loop) b

SAP Portfolio and Project Management, before versions S4CORE 102, 103, EPPM 100 and CPRXRPM 500_702, 600_740, 610_740; u

When using the cd4pe::root_configuration task to configure a Continuous Delivery for PE installation, the root user’s us

An exploitable denial-of-service vulnerability exists in the hostapd 2.6, where an attacker could trigger AP to send IAP

An exploitable denial-of-service vulnerability exists in the 802.11w security state handling for hostapd 2.6 connected c

Huawei S5700 and S6700 have a DoS security vulnerability. Attackers with certain permissions perform specific operations

Huawei smartphones HUAWEI Y9 2019 and Honor View 20 have a denial of service vulnerability. Due to insufficient input va

There is an out-of-bounds read vulnerability in the Advanced Packages feature of the Gauss100 OLTP database in CampusIns

imagemagick 6.8.9.6 has remote DOS via infinite loop

An issue was discovered in Cyrus IMAP before 2.5.15, 3.0.x before 3.0.13, and 3.1.x through 3.1.8. If sieve script uploa

IBM MQ and IBM MQ Appliance 9.1 CD, 9.1 LTS, 9.0 LTS, and 8.0 is vulnerable to a denial of service attack caused by chan

On D-Link DIR-615 devices, a normal user is able to create a root(admin) user from the D-Link portal.

A CSV injection vulnerability exists in the web UI of SolarWinds Serv-U FTP Server v15.1.7.

There is an information leakage vulnerability on some Huawei products(AR120-S;AR1200;AR1200-S;AR150;AR150-S;AR160;AR200;

Various resources in the Crowd Demo application of Atlassian Crowd before version 3.1.1 allow remote attackers to modify

_core_/plugins/medias in SPIP 3.2.x before 3.2.7 allows remote authenticated authors to inject content into the database

A user-supplied regular expression in Jenkins Build Failure Analyzer Plugin 1.24.1 and earlier was processed in a way th

Jenkins Rundeck Plugin 3.6.5 and earlier stores credentials unencrypted in its global configuration file and in job conf

Jenkins Redgate SQL Change Automation Plugin 2.0.3 and earlier stores credentials unencrypted in job config.xml files on

A missing permission check in Jenkins Team Concert Plugin 1.3.0 and earlier allows attackers with Overall/Read permissio

A missing permission check in Jenkins Alauda DevOps Pipeline Plugin 2.3.2 and earlier allows attackers with Overall/Read

A missing permission check in Jenkins Alauda Kubernetes Suport Plugin 2.3.0 and earlier allows attackers with Overall/Re

CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.856 through 0.9.8.864 allows an attacker to get a victim's session

CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.864 allows an attacker to get a victim's session file name from /ho

The Data access layer component of TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace and TIBCO

The Data access layer component of TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace and TIBCO

ELOG 3.1.4-57bea22 and below can be used as an HTTP GET request proxy when unauthenticated remote attackers send crafted

In Tautulli 2.1.9, CSRF in the /shutdown URI allows an attacker to shut down the remote media server. (Also, anonymous a

A validation issue was addressed with improved logic. This issue is fixed in iOS 12.2, tvOS 12.2, watchOS 5.2, Safari 12

A cross-origin issue existed with the fetch API. This was addressed with improved input validation. This issue is fixed

An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 12.2, macOS Mojave 10.14.4

A permissions issue existed in the handling of motion and orientation data. This issue was addressed with improved restr

Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.3, macOS M

An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 12.3, macOS Mojave 10.14.

Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.3, macOS M

An input validation issue was addressed with improved input validation. This issue is fixed in iOS 12.3, watchOS 5.2.1.

Some analytics data was sent using HTTP rather than HTTPS. This was addressed by no longer sending this analytics data.

An inconsistent user interface issue was addressed with improved state management. This issue is fixed in Safari 13.0.1.

bitstr_tell at bitstr.c in ffjpeg through 2019-08-21 has a NULL pointer dereference related to jfif_encode.

jfif_decode in jfif.c in ffjpeg through 2019-08-21 has a divide-by-zero error.

An information exposure vulnerability exists in gitlab.com <v12.3.2, <v12.2.6, and <v12.1.10 when using the blocking mer

An improper access control vulnerability exists in GitLab <12.3.3 that allows an attacker to obtain container and depend

An IDOR vulnerability exists in GitLab <v12.1.2, <v12.0.4, and <v11.11.6 that allowed uploading files from project archi

There was a man-in-the-middle (MITM) vulnerability present in the Confluence Previews plugin in Confluence Server and Co

Authenticated SQL Injection in SonicWall SMA100 allow user to gain read-only access to unauthorized resources using view