2019

Technicolor C2000T and C2100T uses hard-coded cryptographic keys.

vdsm and vdsclient does not validate certficate hostname from another vdsm which could facilitate a man-in-the-middle at

offlineimap before 6.3.2 does not check for SSL server certificate validation when "ssl = yes" option is specified which

In Mitsubishi Electric MELSEC-Q Series Q03/04/06/13/26UDVCPU: serial number 21081 and prior, Q04/06/13/26UDPVCPU: serial

STMicroelectronics ST33TPHF2ESPI TPM devices before 2019-09-12 allow attackers to extract the ECDSA private key via a si

An issue was discovered on Zyxel GS1900 devices with firmware before 2.50(AAHH.0)C0. The firmware hashes and encrypts pa

Perdition before 2.2 may have weak security when handling outbound connections, caused by an error in the STARTTLS IMAP

A memory leak in the nfp_abm_u32_knode_replace() function in drivers/net/ethernet/netronome/nfp/abm/cls.c in the Linux k

Four memory leaks in the nfp_flower_spawn_phy_reprs() function in drivers/net/ethernet/netronome/nfp/flower/main.c in th

A memory leak in the nfp_flower_spawn_vnic_reprs() function in drivers/net/ethernet/netronome/nfp/flower/main.c in the L

Use of a hardcoded cryptographic key in the FortiGuard services communication protocol may allow a Man in the middle wit

Jenkins Google Compute Engine Plugin 4.1.1 and earlier does not verify SSH host keys when connecting agents created by t

The containers/image library used by the container tools Podman, Buildah, and Skopeo in Red Hat Enterprise Linux version

OpenStack Nova before 2012.1 allows someone with access to an EC2_ACCESS_KEY (equivalent to a username) to obtain the EC

SQLite 3.30.1 mishandles pExpr->y.pTab, as demonstrated by the TK_COLUMN case in sqlite3ExprCodeTarget in expr.c.

A flaw was found in the grub2-set-bootflag utility of grub2. A local attacker could run this utility under resource pres

verify_certificate_identity in the OpenSSL extension in Ruby before 2.0.0 patchlevel 645, 2.1.x before 2.1.6, and 2.2.x

The mpi_powm function in Libgcrypt before 1.6.3 and GnuPG before 1.4.19 allows attackers to obtain sensitive information

The Audible application through 2.34.0 for Android has Missing SSL Certificate Validation for Adobe SDKs, allowing MITM

A Security Bypass vulnerability exists in Ubuntu Cobbler before 2,2,2 in the cobbler-ubuntu-import script due to an erro

An issue was discovered in Intesync Solismed 3.3sp1. An flaw in the encryption implementation exists, allowing for all e

A vulnerability has been identified in SPPA-T3000 Application Server (All versions < Service Pack R8.2 SP2). The RMI com

Some Huawei products have an insufficient verification of data authenticity vulnerability. A remote, unauthenticated att

The miekg Go DNS package before 1.1.25, as used in CoreDNS before 1.6.6 and other products, improperly generates random

E5572-855 with versions earlier than 8.0.1.3(H335SP1C233) has an improper authentication vulnerability. The device does

On Barco ClickShare Button R9861500D01 devices (before firmware version 1.9.0) JTAG access is disabled after ROM code ex

Barco ClickShare Button R9861500D01 devices before 1.9.0 allow Information exposure (issue 2 of 2).. The encryption key

Due to the use of non-time-constant comparison functions there is issue in timing side channels which can be used as a p

Cryptographic timing conditions in the subsystem for Intel(R) PTT before versions 11.8.70, 11.11.70, 11.22.70, 12.0.45,

GnuTLS incorrectly validates the first byte of padding in CBC modes

Forcepoint NGFW Security Management Center (SMC) versions lower than 6.5.12 or 6.7.1 have a rare issue that in specific

The malware scan function in BullGuard Premium Protection 20.0.371.8 has a TOCTOU issue that enables a symbolic link att

A vulnerability in Cisco 900 Series Aggregation Services Router (ASR) software could allow an unauthenticated, remote at

The FTP service on D-Link Central WiFiManager CWM-100 1.03 r0098 devices allows remote attackers to conduct a PORT comma

A vulnerability in the Decryption Policy Default Action functionality of the Cisco Web Security Appliance (WSA) could al

A vulnerability in the detection engine of Cisco Firepower Threat Defense Software could allow an unauthenticated, remot

RSA Authentication Manager versions prior to 8.4 P1 contain an Insecure Credential Management Vulnerability. A malicious

A NULL pointer dereference flaw was discovered in libvirt before version 5.0.0 in the way it gets interface information

A vulnerability was found in mod_auth_mellon before v0.14.2. An open redirect in the logout URL allows requests with bac

A vulnerability in the Protocol Independent Multicast (PIM) feature of Cisco IOS XR Software could allow an unauthentica

A vulnerability in the email message scanning of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could a

Server side request forgery (SSRF) in phpBB before 3.2.6 allows checking for the existence of files and services on the

An issue was discovered in WSO2 Dashboard Server 2.0.0. It is possible to force the application to perform requests to t

A vulnerability in the detection engine of Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated,

A vulnerability in the Secure Sockets Layer (SSL)/Transport Layer Security (TLS) protocol parser of Cisco Firepower Thre

A vulnerability in the GZIP decompression engine of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) coul

A vulnerability in the attachment scanning of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allo

A vulnerability in the email message scanning of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could a

On EX4300 Series switches with TCAM optimization enabled, incoming multicast traffic matches an implicit loopback filter

Vulnerability in the Oracle Payments component of Oracle E-Business Suite (subcomponent: File Transmission). Supported v