2019

The woo-address-book plugin before 1.6.0 for WordPress has save calls without nonce verification checks.

The handl-utm-grabber plugin before 2.6.5 for WordPress has CSRF via add_option and update_option.

In GNU Chess 6.2.5, there is a stack-based buffer overflow in the cmd_load function in frontend/cmd.cc via a crafted che

Windows binaries generated with InstallBuilder versions earlier than 19.7.0 are vulnerable to tampering even if they con

A relative path traversal vulnerability found in Advan VD-1 firmware versions up to 230. It allows attackers to download

A broken access control vulnerability found in Advan VD-1 firmware versions up to 230. An attacker can send a POST reque

The debugging endpoint /debug/pprof is exposed over the unauthenticated Kubelet healthz port. The go pprof endpoint is e

The Kubernetes kube-apiserver mistakenly allows access to a cluster-scoped custom resource if the request is made as if

The web api server on Port 8080 of ASUS HG100 firmware up to 1.05.12, which is vulnerable to Slowloris HTTP Denial of Se

Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in the shell component of Zephyr a

Use After Free vulnerability in the Zephyr shell allows a serial or telnet connected user to cause denial of service, an

nse_libssh2.cc in Nmap 7.70 is subject to a denial of service condition due to a double free when an SSH connection fail

Various Lexmark printers contain a denial of service vulnerability in the SNMP service that can be exploited to crash th

Docker Desktop Community Edition before 2.1.0.1 allows local users to gain privileges by placing a Trojan horse docker-c

An issue was discovered in Suricata 4.1.3. The code mishandles the case of sending a network packet with the right type,

An issue was discovered in Suricata 4.1.3. The function ftp_pasv_response lacks a check for the length of part1 and part

An issue was discovered in Suricata 4.1.3. The function process_reply_record_v3 lacks a check for the length of reply.da

An issue was discovered in Suricata 4.1.3. If the network packet does not have the right length, the parser tries to acc

An issue was discovered in Suricata 4.1.3. If the function filetracker_newchunk encounters an unsafe "Some(sfcm) => { ft

A vulnerability in the Virtual Shell (VSH) session management for Cisco NX-OS Software could allow an authenticated, rem

A vulnerability in the IPv6 traffic processing of Cisco NX-OS Software could allow an unauthenticated, remote attacker t

A vulnerability in the Simple Network Management Protocol (SNMP) input packet processor of Cisco FXOS Software and Cisco

A vulnerability in the Cisco Fabric Services component of Cisco NX-OS Software could allow an unauthenticated, remote at

CloudBerry Backup v6.1.2.34 allows local privilege escalation via a Pre or Post backup action. With only user-level acce

MyT Project Management 1.5.1 lacks CSRF protection and, for example, allows a user/create CSRF attack. This could lead t

In Knowage through 6.1.1, an authenticated user who accesses the datasources page will gain access to any data source cr

A sandbox bypass vulnerability in Jenkins Splunk Plugin 1.7.4 and earlier allowed attackers with Overall/Read permission

Jenkins 2.191 and earlier, LTS 2.176.2 and earlier allowed users to obtain CSRF tokens without an associated web session

The gigpress plugin before 2.3.11 for WordPress has SQL injection in the admin area, a different vulnerability than CVE-

In the TCP implementation (gnrc_tcp) in RIOT through 2019.07, the parser for TCP options does not terminate on all input

components/Modals/HelpModal.jsx in BloodHound 2.2.0 allows remote attackers to execute arbitrary OS commands (by spawnin

Edimax BR-6208AC V1 devices have Insufficient Compartmentalization between a host network and a guest network that are e

Edimax BR-6208AC V1 devices have Insufficient Compartmentalization between a host network and a guest network that are e

TP-Link Archer C3200 V1 and Archer C2 V1 devices have Insufficient Compartmentalization between a host network and a gue

TP-Link Archer C3200 V1 and Archer C2 V1 devices have Insufficient Compartmentalization between a host network and a gue

TP-Link Archer C3200 V1 and Archer C2 V1 devices have Insufficient Compartmentalization between a host network and a gue

D-link DIR-825AC G1 devices have Insufficient Compartmentalization between a host network and a guest network that are e

D-link DIR-825AC G1 devices have Insufficient Compartmentalization between a host network and a guest network that are e

D-link DIR-825AC G1 devices have Insufficient Compartmentalization between a host network and a guest network that are e

Edimax BR-6208AC V1 devices have Insufficient Compartmentalization between a host network and a guest network that are e

Multiple CSRF issues exist in MicroPyramid Django CRM 0.2.1 via /change-password-by-admin/, /api/settings/add/, /cases/c

The wp-members plugin before 3.2.8 for WordPress has CSRF.

The woocommerce-catalog-enquiry plugin before 3.1.0 for WordPress has an incorrect wp_upload directory for file uploads.

The sell-downloads plugin before 1.0.8 for WordPress has insufficient restrictions on brute-force guessing of purchase I

The insert-or-embed-articulate-content-into-wordpress plugin before 4.2999 for WordPress has insufficient restrictions o

The groundhogg plugin before 1.3.5 for WordPress has wp-admin/admin-ajax.php?action=bulk_action_listener remote code exe

The zoho-salesiq plugin before 1.0.9 for WordPress has CSRF.

The bbp-move-topics plugin before 1.1.6 for WordPress has CSRF.

The js-support-ticket plugin before 2.0.6 for WordPress has CSRF.

The link-log plugin before 2.0 for WordPress has HTTP Response Splitting.