2019

In Counter-Strike: Global Offensive before 8/29/2019, community game servers can display unsafe HTML in a disconnection

Silver Peak EdgeConnect SD-WAN before 8.1.7.x allows remote attackers to obtain potentially sensitive stack traces by se

An issue was discovered in Plataformatec Devise before 4.7.1. It confirms accounts upon receiving a request with a blank

An issue was discovered in LibreNMS through 1.47. Information disclosure can occur: an attacker can fingerprint the exac

Seneca < 3.9.0 contains a vulnerability that could lead to exposing environment variables to unauthorized users.

An authorization issue was discovered in the GitLab CE/EE CI badge images endpoint which could result in disclosure of t

An issue was discovered in GitLab Community and Enterprise Edition before 11.8.9, 11.9.x before 11.9.10, and 11.10.x bef

An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x befor

A path disclosure vulnerability was found in Limesurvey before 3.17.14 that allows a remote attacker to discover the pat

Limesurvey before 3.17.14 does not enforce SSL/TLS usage in the default configuration.

Limesurvey before 3.17.14 allows remote attackers to bruteforce the login form and enumerate usernames when the LDAP aut

OnCommand Workflow Automation versions prior to 5.0 shipped without certain HTTP Security headers configured which could

An issue was discovered in Couchbase Server 5.5.x through 5.5.3 and 6.0.0. The Memcached "connections" stat block comman

OpenSSL 1.1.1 introduced a rewritten random number generator (RNG). This was intended to include protection in the event

In Couchbase Server 6.0.0 and 5.5.0, the eventing service exposes system diagnostic profile via an HTTP endpoint that do

In Mendix 7.23.5 and earlier, issue in XML import mappings allow DOCTYPE declarations in the XML input that is potential

The /rest/api/1.0/render resource in Jira before version 8.4.0 allows remote anonymous attackers to determine if an atta

The /rest/api/latest/groupuserpicker resource in Jira before version 8.4.0 allows remote attackers to enumerate username

McAfee Web Gateway (MWG) earlier than 7.8.2.13 is vulnerable to a remote attacker exploiting CVE-2019-9511, potentially

Easy!Appointments 1.3.2 plugin for WordPress allows Sensitive Information Disclosure (Username and Password Hash).

OpenCV 4.1.1 has an out-of-bounds read in hal_baseline::v_load in core/hal/intrin_sse.hpp when called from computeSSDMea

Cobham Sea Tel v170 224521 through v194 225444 devices allow attackers to obtain potentially sensitive information, such

An issue was discovered in GitLab Community and Enterprise Edition 11.9.x and 11.10.x before 11.10.1. Merge requests cre

An issue was discovered in GitLab Community and Enterprise Edition through 12.2.1. Embedded images and media files in ma

An issue was discovered in GitLab Community and Enterprise Edition 11.2 through 12.2.1. Insufficient permission checks w

An issue was discovered in GitLab Community and Enterprise Edition 12.0 through 12.2.1. Non-members were able to comment

An issue was discovered in GitLab Community and Enterprise Edition 12.2 through 12.2.1. The project import API could be

An issue was discovered in GitLab Community and Enterprise Edition 12.0 through 12.2.1. Under certain conditions, merge

An issue was discovered in GitLab Community and Enterprise Edition 7.9 through 12.2.1. EXIF Geolocation data was not bei

Online upgrade information in some firmware packages of Dahua products is not encrypted. Attackers can obtain this infor

IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to traverse directories on the sys

SPIP before 3.1.11 and 3.2 before 3.2.5 provides different error messages from the password-reminder page depending on w

A vulnerability in the statistics collection service of Cisco HyperFlex Software could allow an unauthenticated, remote

Some Dahua products have information leakage issues. Attackers can obtain the IP address and device model information of

Pydio 6.0.8 mishandles error reporting when a directory allows unauthenticated uploads, and the remote-upload option is

The optinmonster plugin before 1.1.4.6 for WordPress has incorrect access control for shortcodes because of a nonce leak

The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control for admin_init settings changes.

The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpi_user_id for invoice retrieval.

The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpi_paypal payer metadata updates.

The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpi_interkassa payer metadata updates

The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpi_twocheckout payer metadata update

IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 Network Deployment could allow a remote attacker to obtain sensi

The Reset Password feature in Pagekit 1.0.17 gives a different response depending on whether the e-mail address of a val

Jenkins Aqua MicroScanner Plugin 1.0.7 and earlier transmitted configured credentials in plain text as part of the globa

In BIG-IP 15.0.0, 14.1.0-14.1.0.6, 14.0.0-14.0.0.5, 13.0.0-13.1.1.5, 12.1.0-12.1.4.1, 11.5.1-11.6.4, BIG-IQ 7.0.0, 6.0.0

SilverStripe through 4.3.3 has incorrect access control for protected files uploaded via Upload::loadIntoFile(). An atta

On versions 13.0.0-13.1.0.1, 12.1.0-12.1.4.1, 11.6.1-11.6.4, and 11.5.1-11.5.9, BIG-IP platforms where AVR, ASM, APM, PE

In MediaWiki through 1.33.0, Special:Redirect allows information disclosure of suppressed usernames via a User ID Lookup

Platinum UPnP SDK 1.2.0 allows Directory Traversal in Core/PltHttpServer.cpp because it checks for /.. where it should b

In SilverStripe assets 4.0, there is broken access control on files.