2019

cPanel before 70.0.23 allows demo accounts to execute code via the Landing Page (SEC-405).

cPanel before 68.0.15 allows string format injection in dovecot-xaps-plugin (SEC-318).

cPanel before 68.0.15 allows code execution in the context of the nobody account via Mailman archives (SEC-337).

cPanel before 64.0.21 allows demo accounts to execute code via Encoding API calls (SEC-242).

cPanel before 64.0.21 allows demo accounts to execute code via an ImageManager_dimensions API call (SEC-243).

cPanel before 64.0.21 allows file-read and file-write operations for demo accounts via the SourceIPCheck API (SEC-250).

cPanel before 64.0.21 allows demo accounts to execute code via the ClamScanner_getsocket API (SEC-251).

cPanel before 62.0.17 allows demo accounts to execute code via the Htaccess::setphppreference API (SEC-232).

cPanel before 62.0.17 allows demo accounts to execute code via an NVData_fetchinc API call (SEC-233).

CF CLI version prior to v6.45.0 (bosh release version 1.16.0) writes the client id and secret to its config file when th

Huawei smart phones Emily-L29C with versions of 8.1.0.132a(C432), 8.1.0.135(C782), 8.1.0.154(C10), 8.1.0.154(C461), 8.1.

A remote session reuse vulnerability was discovered in HPE 3PAR Service Processor version(s): prior to 5.0.5.1.

A remote information disclosure vulnerability was discovered in HPE 3PAR StoreServ Management and Core Software Media ve

Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 20

IBM i 7.4 users who have done a Restore User Profile (RSTUSRPRF) on a system which has been configured with Db2 Mirror f

It was discovered that there was a ECDSA timing attack in the libgcrypt20 cryptographic library. Version affected: 1.8.4

SilverStripe through 4.3.3 allows session fixation in the "change password" form.

If a Content Security Policy (CSP) directive is defined that uses a hash-based source that takes the empty string as inp

IBM WebSphere Application Server - Liberty could allow a remote attacker to bypass security restrictions caused by impro

The MDM server component of TIBCO Software Inc's TIBCO MDM contains multiple vulnerabilities that theoretically allow an

Lintian before 2.5.12 allows remote attackers to gather information about the "host" system using crafted symlinks.

Order processing in SAP ERP Sales (corrected in SAP_APPL 6.0, 6.02, 6.03, 6.04, 6.05, 6.06, 6.16, 6.17, 6.18) and S4HANA

libuser 0.56 and 0.57 has a TOCTOU (time-of-check time-of-use) race condition when copying and removing directory trees.

In the Linux kernel before 5.3.11, there is a use-after-free bug that can be caused by a malicious USB device in the dri

Norton Password Manager, prior to 6.6.2.5, may be susceptible to a cross origin resource sharing (CORS) vulnerability, w

Norton Password Manager, prior to 6.6.2.5, may be susceptible to a cross origin resource sharing (CORS) vulnerability, w

Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.3, macOS M

There's a possible information leak / session hijack vulnerability in Rack (RubyGem rack). This vulnerability is patched

The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed users with edit_post capabil

Electronic Arts Karotz Smart Rabbit 12.07.19.00 allows Python module hijacking

An issue was discovered in GitLab Community and Enterprise Edition before 11.4.13, 11.5.x before 11.5.6, and 11.6.x befo

Improper setting of device configuration in system firmware for Intel(R) NUC kits may allow a privileged user to potenti

Norton App Lock prior to 1.4.0.445 can be susceptible to a bypass exploit. In this type of circumstance, the exploit can

IBM Security Identity Manager 6.0 and 7.0 could allow an attacker to create unexpected control flow paths through the ap

An information disclosure vulnerability exists when Windows Hyper-V on a host operating system fails to properly validat

Buffer overflow in an OS component in Intel CSME before versions 11.8.60, 11.11.60, 11.22.60 or 12.0.20 and Intel TXE ve

In the Linux kernel before 5.2.3, drivers/block/floppy.c allows a denial of service by setup_format_params division-by-z

IBM Intelligent Operations Center V5.1.0 through V5.2.0 could disclose detailed error messages, revealing sensitive info

A denial of service vulnerability exists when Microsoft Hyper-V on a host server fails to properly validate input from a

Vulnerability in the MySQL Server product of Oracle MySQL (component: Client programs). Supported versions that are affe

The Sec Consult Security Lab reported an information disclosure vulnerability in MF910S product to ZTE PSIRT in October

A denial of service vulnerability exists when Microsoft Hyper-V on a host server fails to properly validate input from a

P30 smartphones with versions earlier than ELLE-AL00B 9.1.0.193(C00E190R2P1) have an insufficient verification vulnerabi

Smartphones with software of ELLE-AL00B 9.1.0.109(C00E106R1P21), 9.1.0.113(C00E110R1P21), 9.1.0.125(C00E120R1P21), 9.1.0

Python keyring has insecure permissions on new databases allowing world-readable files to be created

ChinaMobile PLC Wireless Router GPN2.4P21-C-CN devices with firmware W2001EN-00 have XSS via the cgi-bin/webproc?getpage

Osclass 3.7.4 has XSS via the query string to index.php, a different vulnerability than CVE-2014-6280.

Multiple cross-site scripting (XSS) vulnerabilities in Plikli CMS 4.0.0 allow remote attackers to inject arbitrary web s

A reflected cross-site scripting (XSS) vulnerability in Dolibarr 8.0.2 allows remote attackers to inject arbitrary web s

Cross-site scripting in event_script.js in VIVOTEK Network Camera Series products with firmware 0x06x to 0x08x allows re