2019

Buffer overflow in PTP (Picture Transfer Protocol) of EOS series digital cameras (EOS-1D X firmware version 2.1.0 and ea

Buffer overflow in PTP (Picture Transfer Protocol) of EOS series digital cameras (EOS-1D X firmware version 2.1.0 and ea

Buffer overflow in PTP (Picture Transfer Protocol) of EOS series digital cameras (EOS-1D X firmware version 2.1.0 and ea

A CSRF issue was discovered in webparam?user&action=set&param=add in HTTPD on MicroDigital N-series cameras with firmwar

AdPlug 2.3.1 has multiple heap-based buffer overflows in Ca2mLoader::load() in a2m.cpp.

AdPlug 2.3.1 has multiple heap-based buffer overflows in CradLoader::load() in rad.cpp.

AdPlug 2.3.1 has multiple heap-based buffer overflows in CmtkLoader::load() in mtk.cpp.

cPanel before 58.0.4 has improper session handling for shared users (SEC-139).

cPanel before 58.0.4 allows code execution in the context of other user accounts through the PHP CGI handler (SEC-142).

cPanel before 57.9999.54 allows demo accounts to execute arbitrary code via ajax_maketext_syntax_util.pl (SEC-109).

In cPanel before 57.9999.54, /scripts/addpop and /scripts/delpop exposed TTYs (SEC-113).

In cPanel before 57.9999.54, /scripts/checkinfopages exposed a TTY to an unprivileged process (SEC-114).

In cPanel before 57.9999.54, /scripts/maildir_converter exposed a TTY to an unprivileged process (SEC-115).

In cPanel before 57.9999.54, /scripts/unsuspendacct exposed TTYs (SEC-116).

In cPanel before 57.9999.54, /scripts/enablefileprotect exposed TTYs (SEC-117).

A cross-site request forgery vulnerability in Jenkins JClouds Plugin 2.14 and earlier in BlobStoreProfile.DescriptorImpl

Jenkins Simple Travis Pipeline Runner Plugin 1.0 and earlier specifies unsafe values in its custom Script Security white

A cross-site request forgery vulnerability in Jenkins XL TestView Plugin 1.2.0 and earlier in XLTestView.XLTestDescripto

Incorrect authentication of application WebSocket connections in Loom Desktop for Mac up to 0.16.0 allows remote code ex

An issue was discovered in osTicket before 1.10.7 and 1.12.x before 1.12.1. CSV (aka Formula) injection exists in the ex

A vulnerability in the web-based management interface of Cisco Adaptive Security Appliance (ASA) Software could allow an

A vulnerability in the web-based management interface of Cisco HyperFlex Software could allow an unauthenticated, remote

Server Side Request Forgery (SSRF) exists in Zoho ManageEngine AssetExplorer 6.2.0 and before for the ClientUtilServlet

The Deny All Firewall plugin before 1.1.7 for WordPress allows wp-admin/options-general.php?page=daf_settings&daf_remove

6kbbs 7.1 and 8.0 allows CSRF via portalchannel_ajax.php (id or code parameter) or admin.php (fileids parameter).

Neet AirStream NAS1.1 devices have a password of ifconfig for the root account. This cannot be changed via the configura

Edimax Wi-Fi Extender devices allow goform/formwlencryptvxd CSRF with resultant PSK key disclosure.

The Bluetooth Low Energy (BLE) subsystem on Tapplock devices before 2018-06-12 allows replay attacks.

NCSOFT Game Launcher, NC Launcher2 2.4.1.691 and earlier versions have a vulnerability in the custom protocol handler th

A remote arbitrary file upload vulnerability was discovered in HPE 3PAR Service Processor version(s): prior to 5.0.5.1.

Wind River VxWorks 6.6 through 6.9 has a Buffer Overflow in the DHCP client component. There is an IPNET security vulner

A remote script injection vulnerability was discovered in HPE 3PAR StoreServ Management and Core Software Media version(

Bagisto 0.1.5 allows CSRF under /admin URIs.

The wp-database-backup plugin before 4.3.3 for WordPress has CSRF.

The wp-database-backup plugin before 4.3.1 for WordPress has CSRF.

The twitter-cards-meta plugin before 2.5.0 for WordPress has CSRF.

An issue was discovered in Frappe Framework 10 through 12 before 12.0.4. There exists an authenticated SQL injection.

An issue was discovered in custom/ajax_download.php in OpenEMR before 5.0.2 via the fileName parameter. An attacker can

The contact-form-to-email plugin before 1.2.66 for WordPress has CSRF.

UniSign 2.0.4.0 and earlier version contains a stack-based buffer overflow vulnerability which can overwrite the stack w

The web server component of TIBCO Software Inc.'s TIBCO LogLogic Enterprise Virtual Appliance, and TIBCO LogLogic Log Ma

The session cookie used by SAP Enable Now, version 1902, does not have the HttpOnly flag set. If an attacker runs script

SAP Commerce Cloud (Mediaconversion Extension), versions 6.4, 6.5, 6.6, 6.7, 1808, 1811, 1905, allows an authenticated B

A remote code execution vulnerability exists in the SAP NetWeaver UDDI Server (Services Registry), versions 7.10, 7.20,

The simple-fields plugin before 1.2 for WordPress has CSRF in the admin interface.

The wp-google-map-plugin plugin before 2.3.10 for WordPress has CSRF in the add/edit location feature.

The wp-google-map-plugin plugin before 2.3.10 for WordPress has CSRF in the add/edit map feature.

The wp-google-map-plugin plugin before 2.3.10 for WordPress has CSRF in the add/edit category feature.

The google-document-embedder plugin before 2.6.2 for WordPress has CSRF.

The simple-membership plugin before 3.3.3 for WordPress has multiple CSRF issues.