2019

SEP (Mac client) prior to and including 12.1 RU6 MP9 and prior to 14.2 RU1 may be susceptible to a CSV/DDE injection (al

The Vivo V7 Android device with a build fingerprint of vivo/1718/1718:7.1.2/N2G47H/compil11021857:user/release-keys cont

IBM Tivoli Storage Productivity Center (IBM Spectrum Control Standard Edition 5.2.1 through 5.2.17) allows users to rema

Vulnerability in the Enterprise Manager Ops Center component of Oracle Enterprise Manager Products Suite (subcomponent:

Open directories in Ivanti LANDESK Management Suite (LDMS, aka Endpoint Manager) 10.0.1.168 Service Update 5 may lead to

A remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than versio

An elevation of privilege vulnerability exists when the Windows User Profile Service (ProfSvc) improperly handles symlin

An elevation of privilege vulnerability exists when the Windows Shell fails to validate folder shortcuts. An attacker wh

Code injection vulnerability in Palo Alto Networks Traps 5.0.5 and earlier may allow an authenticated attacker to inject

A security feature bypass vulnerability exists when Active Directory Federation Services (ADFS) improperly updates its l

Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: Open Fabrics Tools). The supp

Vulnerability in the Oracle Outside In Technology component of Oracle Fusion Middleware (subcomponent: Outside In Filter

A cross-site request forgery vulnerability in Jenkins Maven Release Plugin 0.14.0 and earlier in the M2ReleaseAction#doS

cPanel before 74.0.8 allows demo accounts to execute arbitrary code via the Fileman::viewfile API (SEC-444).

cPanel before 70.0.23 allows demo accounts to execute code via awstats (SEC-362).

cPanel before 70.0.23 allows demo accounts to execute code via the Landing Page (SEC-405).

cPanel before 68.0.15 allows string format injection in dovecot-xaps-plugin (SEC-318).

cPanel before 68.0.15 allows code execution in the context of the nobody account via Mailman archives (SEC-337).

cPanel before 64.0.21 allows demo accounts to execute code via Encoding API calls (SEC-242).

cPanel before 64.0.21 allows demo accounts to execute code via an ImageManager_dimensions API call (SEC-243).

cPanel before 64.0.21 allows file-read and file-write operations for demo accounts via the SourceIPCheck API (SEC-250).

cPanel before 64.0.21 allows demo accounts to execute code via the ClamScanner_getsocket API (SEC-251).

cPanel before 62.0.17 allows demo accounts to execute code via the Htaccess::setphppreference API (SEC-232).

cPanel before 62.0.17 allows demo accounts to execute code via an NVData_fetchinc API call (SEC-233).

CF CLI version prior to v6.45.0 (bosh release version 1.16.0) writes the client id and secret to its config file when th

Huawei smart phones Emily-L29C with versions of 8.1.0.132a(C432), 8.1.0.135(C782), 8.1.0.154(C10), 8.1.0.154(C461), 8.1.

A remote session reuse vulnerability was discovered in HPE 3PAR Service Processor version(s): prior to 5.0.5.1.

A remote information disclosure vulnerability was discovered in HPE 3PAR StoreServ Management and Core Software Media ve

Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 20

IBM i 7.4 users who have done a Restore User Profile (RSTUSRPRF) on a system which has been configured with Db2 Mirror f

It was discovered that there was a ECDSA timing attack in the libgcrypt20 cryptographic library. Version affected: 1.8.4

SilverStripe through 4.3.3 allows session fixation in the "change password" form.

If a Content Security Policy (CSP) directive is defined that uses a hash-based source that takes the empty string as inp

IBM WebSphere Application Server - Liberty could allow a remote attacker to bypass security restrictions caused by impro

The MDM server component of TIBCO Software Inc's TIBCO MDM contains multiple vulnerabilities that theoretically allow an

Lintian before 2.5.12 allows remote attackers to gather information about the "host" system using crafted symlinks.

Order processing in SAP ERP Sales (corrected in SAP_APPL 6.0, 6.02, 6.03, 6.04, 6.05, 6.06, 6.16, 6.17, 6.18) and S4HANA

libuser 0.56 and 0.57 has a TOCTOU (time-of-check time-of-use) race condition when copying and removing directory trees.

In the Linux kernel before 5.3.11, there is a use-after-free bug that can be caused by a malicious USB device in the dri

Norton Password Manager, prior to 6.6.2.5, may be susceptible to a cross origin resource sharing (CORS) vulnerability, w

Norton Password Manager, prior to 6.6.2.5, may be susceptible to a cross origin resource sharing (CORS) vulnerability, w

Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.3, macOS M

There's a possible information leak / session hijack vulnerability in Rack (RubyGem rack). This vulnerability is patched

The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed users with edit_post capabil

Electronic Arts Karotz Smart Rabbit 12.07.19.00 allows Python module hijacking

An issue was discovered in GitLab Community and Enterprise Edition before 11.4.13, 11.5.x before 11.5.6, and 11.6.x befo

Improper setting of device configuration in system firmware for Intel(R) NUC kits may allow a privileged user to potenti

Norton App Lock prior to 1.4.0.445 can be susceptible to a bypass exploit. In this type of circumstance, the exploit can

IBM Security Identity Manager 6.0 and 7.0 could allow an attacker to create unexpected control flow paths through the ap

An information disclosure vulnerability exists when Windows Hyper-V on a host operating system fails to properly validat