2019

SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the ModuleBuilder module by a Developer user.

SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the MergeRecords module by a Developer user.

SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the MergeRecords module by a Regular user.

SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the Emails module by a Regular user.

SugarCRM before 8.0.4 and 9.x before 9.0.2 allows directory traversal in the attachment function by a Regular user.

SugarCRM before 8.0.4 and 9.x before 9.0.2 allows directory traversal in the file function by a Regular user.

SugarCRM before 8.0.4 and 9.x before 9.0.2 allows directory traversal in the Studio module by a Developer user.

An issue was discovered in Xen through 4.11.x allowing x86 guest OS users to cause a denial of service or gain privilege

An issue was discovered in Xen through 4.11.x allowing x86 PV guest OS users to cause a denial of service or gain privil

img_gantt.php in Centreon Web before 2.8.27 allows attackers to perform SQL injections via the host_id parameter.

makeXML_ListServices.php in Centreon Web before 2.8.28 allows attackers to perform SQL injections via the host_id parame

getStats.php in Centreon Web before 2.8.28 allows authenticated attackers to execute arbitrary code via the ns_id parame

Yealink phones through 2019-08-04 do not properly check user roles in POST requests. Consequently, the default User acco

Yealink phones through 2019-08-04 have an issue with OpenVPN file upload. They execute tar as root to extract files, but

minPlayCommand.php in Centreon Web before 2.8.27 allows authenticated attackers to execute arbitrary code via the comman

/var/WEB-GUI/cgi-bin/telnet.cgi on FiberHome HG2201T 1.00.M5007_JS_201804 devices allows pre-authentication remote code

Pi-Hole 4.3 allows Command Injection.

An attacker could send a malicious link to an authenticated operator, which may allow remote attackers to perform action

cPanel before 82.0.15 allows API token credentials to persist after an account has been renamed or terminated (SEC-517).

A persistent Cross-Site Scripting (XSS) vulnerability in Junos OS J-Web interface may allow remote unauthenticated attac

An Improper Input Validation weakness allows a malicious local attacker to elevate their permissions to take control of

A command injection vulnerability exists in the Zingbox Inspector versions 1.286 and earlier, that allows for an authent

An SQL injection vulnerability exists in the management interface of Zingbox Inspector versions 1.288 and earlier, that

Citrix Application Delivery Management (ADM) 12.1 before build 54.13 has Incorrect Access Control.

An issue was discovered in fastadmin 1.0.0.20190705_beta. There is a public/index.php/admin/auth/admin/add CSRF vulnerab

A remote code execution vulnerability exists when the Microsoft XML Core Services MSXML parser processes user input, aka

A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle obje

A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle obje

A remote code execution vulnerability exists in the Windows Remote Desktop Client when a user connects to a malicious se

The booking-system plugin before 2.1 for WordPress has DOPBSPBackEndTranslation::display SQL injection via the language

The yet-another-stars-rating plugin before 0.9.1 for WordPress has yasr_get_multi_set_values_and_field SQL injection via

The Simpolio theme 1.3.2 for WordPress has insufficient restrictions on option updates.

The Pont theme 1.5 for WordPress has insufficient restrictions on option updates.

The Teardrop theme 1.8.1 for WordPress has insufficient restrictions on option updates.

The Vernissage theme 1.2.8 for WordPress has insufficient restrictions on option updates.

ESXi, Workstation, Fusion, VMRC and Horizon Client contain a use-after-free vulnerability in the virtual sound device. V

An issue was discovered in Softing uaGate SI 1.60.01. A CGI script is vulnerable to command injection with a maliciously

An issue was discovered in Softing uaGate (SI, MB, 840D) firmware through 1.71.00.1225. A CGI script is vulnerable to co

The animate-it plugin before 2.3.6 for WordPress has CSRF in edsanimate.php.

app\modules\polygon\controllers\ProblemController in Jiangnan Online Judge (aka jnoj) 0.8.0 allows arbitrary file upload

The setter.xml component of the Common Gateway Interface on Compal CH7465LG 6.12.18.25-2p4 devices does not properly val

In PV_DecodePredictedIntraDC of dec_pred_intra_dc.cpp, there is a possible out of bounds write due to a missing bounds c

In VlcDequantH263IntraBlock_SH of vlc_dequant.cpp, there is a possible out of bounds write due to a missing bounds check

In GetMBheader of combined_decode.cpp, there is a possible out of bounds write due to a missing bounds check. This could

The GREE+ (aka com.gree.greeplus) application 1.4.0.8 for Android suffers from Cross Site Request Forgery.

vips_foreign_load_gif_scan_image in foreign/gifload.c in libvips before 8.8.2 tries to access a color map before a DGifG

Centreon 19.04 allows attackers to execute arbitrary OS commands via the Command Line field of main.php?p=60807&type=4 (

ImageMagick before 7.0.8-54 has a heap-based buffer overflow in ReadPSInfo in coders/ps.c.

ImageMagick before 7.0.8-55 has a use-after-free in DestroyStringInfo in MagickCore/string.c because the error manager i

tif_getimage.c in LibTIFF through 4.0.10, as used in GDAL through 3.0.1 and other products, has an integer overflow that