2019

Multiple CSRF issues in Horde Groupware Webmail Edition 5.1.2 and earlier in basic.php.

TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 is open to a session fixation attack

A vulnerability in the HTTP API of Cisco Enterprise Chat and Email could allow an unauthenticated, remote attacker to do

An arbitrary file deletion vulnerability exists in Magento 2.1 prior to 2.1.19, Magento 2.2 prior to 2.2.10, Magento 2.3

The WebKit::WebPluginContainerImpl::handleEvent function in Google Chrome before Blink M11 allows an attacker to cause a

An arbitrary file deletion vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1.

Insecure authentication and session management vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to

A security bypass vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. A user wi

A SQL injection vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenti

A flaw was found in the samba client, all samba versions before samba 4.11.2, 4.10.10 and 4.9.15, where a malicious serv

LibSass 3.6.1 has uncontrolled recursion in Sass::Eval::operator()(Sass::Binary_Expression*) in eval.cpp.

LibSass before 3.6.3 allows a heap-based buffer over-read in Sass::weaveParents in ast_sel_weave.cpp.

LibSass before 3.6.3 allows a NULL pointer dereference in Sass::Parser::parseCompoundSelector in parser_selectors.cpp.

TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows Information Disclosure on the backend.

TYPO3 before 4.5.4 allows Information Disclosure in the backend.

TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to extract arbitrary information

TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to delete arbitrary files on the

TYPO3 before 4.4.9 and 4.5.x before 4.5.4 does not apply proper access control on ExtDirect calls which allows remote at

Firmware not able to send EXT scan response to host within 1 sec due to resource consumption issue in Snapdragon Auto, S

A stale layout root is set as an input element in WebKit in Google Chrome before Blink M13 when a child of a keygen with

Apache CXF before 3.3.4 and 3.2.11 does not restrict the number of message attachments present in a given message. This

Samsung Galaxy S8 plus (Android version: 8.0.0, Build Number: R16NW.G955USQU5CRG3, Baseband Vendor: Qualcomm Snapdragon

Samsung Galaxy S8 plus (Android version: 8.0.0, Build Number: R16NW.G955USQU5CRG3, Baseband Vendor: Qualcomm Snapdragon

Portainer before 1.22.1 has Incorrect Access Control (issue 2 of 4).

Use after free vulnerability in documentloader in WebKit in Google Chrome before Blink M13 in DocumentWriter::replaceDoc

Incorrect handling of timer information in Timer.cpp in WebKit in Google Chrome before Blink M13.

An issue exists in WebKit in Google Chrome before Blink M12. when clearing lists in AnimationControllerPrivate that sign

Drupal 6.x before 6.16 and 5.x before version 5.22 does not properly block users under certain circumstances. A user wit

Gource through 0.26 logs to a predictable file name (/tmp/gource-$UID.tmp), enabling attackers to overwrite an arbitrary

In JON 2.1.x before 2.1.2 SP1, users can obtain unauthorized security information about private resources managed by JBo

A flaw was found in the 'deref' plugin of 389-ds-base where it could use the 'search' permission to display attribute va

It was found that the Syndesis configuration for Cross-Origin Resource Sharing was set to allow all origins. An attacker

IBM QRadar Advisor 1.0.0 through 2.4.0 uses incomplete blacklisting for input validation which allows attackers to bypas

NVIDIA Windows GPU Display Driver, R390 driver version, contains a vulnerability in NVIDIA Control Panel in which it inc

qpid-cpp 1.0 crashes when a large message is sent and the Digest-MD5 mechanism with a security layer is in use .

ImageMagick before 7.0.9-0 allows remote attackers to cause a denial of service because XML_PARSE_HUGE is not properly r

HornetQ REST is vulnerable to XML External Entity due to insecure configuration of RestEasy

ZyXEL P-1302-T10D v3 devices with firmware version 2.00(ABBX.3) and earlier do not properly enforce access control and c

An information disclosure vulnerability exists when DirectWrite improperly discloses the contents of its memory, aka 'Di

An elevation of privilege vulnerability exists when Visual Studio fails to properly validate hardlinks while extracting

An information disclosure vulnerability exists when DirectWrite improperly discloses the contents of its memory, aka 'Di

An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its m

An information disclosure vulnerability exists in Microsoft SharePoint when an attacker uploads a specially crafted file

It is possible to cause a DoS condition by causing the server to crash in alien-arena 7.33 by supplying various invalid

The encrypt/decrypt functions in Ruby on Rails 2.3 are vulnerable to padding oracle attacks.

Use after free vulnerability exists in WebKit in Google Chrome before Blink M12 in RenderLayerwhen removing elements wit

NVIDIA GeForce Experience (prior to 3.20.1) and Windows GPU Display Driver (all versions) contains a vulnerability in th

WebKit in Google Chrome before Blink M11 and M12 does not properly handle counter nodes, which allows remote attackers t

An issue exists in third_party/WebKit/Source/WebCore/svg/animation/SVGSMILElement.h in WebKit in Google Chrome before Bl

letodms 3.3.6 has CSRF via change password