CVE-2019-17314

SugarCRM before 8.0.4 and 9.x before 9.0.2 allows directory traversal in the Configurator module by an Admin user...

CVE-2019-17316

SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP object injection in the Import module by a Regular user...

Unspecified Vulnerability in GitLab (CNVD-2019-30487)

GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. A security vulnerability exists in GitLab Enterprise and...

Johnson Controls Metasys system Trust Management Issues Vulnerability

Johnson Controls Metasys system is the United States Johnson Controls Johnson Controls company's set of building automation system. A trust management issue vulnerability exists in the Johnson Controls Metasys system prior to version 9.0, which arises from the Metasys ADS/ADX server and NAE/NIE/N...

CVE-2019-2831

Vulnerability in the PeopleSoft Enterprise FIN Project Costing component of Oracle PeopleSoft Products subcomponent: Projects. The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft...

ArtCMS V9.2 suffers from arbitrary file download vulnerability

ArtCMS is a website management system. ArtCMS V9.2 suffers from an arbitrary file download vulnerability. An attacker can exploit the vulnerability to download arbitrary files...

CVE-2019-13472

PHPWind 9.1.0 has XSS vulnerabilities in the c and m parameters of the index.php file...

Pulse Secure Pulse Secure Desktop Information Disclosure Vulnerability

Pulse Secure Pulse Desktop Client is a suite of client software from Pulse Secure USA for accessing end devices on Juniper Pulse Secure gateways. An information disclosure vulnerability exists in Pulse Secure Pulse Secure Desktop 9.0R1 and prior versions. The vulnerability stems from an error in...

GLPI Cross-Site Scripting Vulnerability (CNVD-2019-21438)

Teclib GLPI is an open source IT asset management suite from the French company Teclib. The suite includes features such as device status management, asset inventory storage, management processes and work log management. A cross-site scripting vulnerability exists in the inc/user.class.php file i...

IBM License Metric Tool and IBM BigFix Inventory Information Disclosure Vulnerability

IBM License Metric Tool and IBM BigFix Inventory are both products of IBM Corporation of the U.S. IBM License Metric Tool is a set of free tools that help IBM Passport Advantage Software Upgrade and Support Services customers determine their Processor Value Unit PVU licensing requirements. IBM...

Quest Software Kace K1000 Appliance SQL Injection Vulnerability

Quest Software Kace K1000 Appliance is a system management appliance from Quest Software, USA. The product is used for software license management, patch and endpoint security management, software distribution and server monitoring functions. A SQL injection vulnerability exists in Quest Kace K10...

Artifex Software Ghostscript Information Disclosure Vulnerability

Artifex Software Ghostscript is an open source parser for Postscript a page description language and programming language used in the electronics industry and desktop publishing from Artifex Software, Inc. The product can display Postscript files as well as print Postscript files on non-PostScrip...

CVE-2019-8390

qdPM 9.1 suffers from Cross-site Scripting XSS in the searchkeywords parameter...

IBM Rational DOORS Web Access Cross-Site Scripting Vulnerability (CNVD-2019-15711)

IBM Rational DOORS Web Access is a requirements collaboration solution from IBM USA. The product supports creating, analyzing, editing, and discussing requirements and other A cross-site scripting vulnerability exists in IBM Rational DOORS Web Access versions 9.5.1 through 9.5.2.9 and 9.6 through...

CVE-2019-2707

Vulnerability in the PeopleSoft Enterprise ELM Enterprise Learning Management component of Oracle PeopleSoft Products subcomponent: Application Search. The supported version that is affected is 9.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to...

CVE-2019-2590

Vulnerability in the PeopleSoft Enterprise HCM Talent Acquisition Manager component of Oracle PeopleSoft Products subcomponent: Job Opening. The supported version that is affected is 9.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise...

CVE-2019-2039

In rwi93smdetectndef of rwi93.cc, there is a possible out-of-bound read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1...

PT-2019-3927 · Apache · Apache Tomcat

Name of the Vulnerable Software and Affected Versions: Apache Tomcat versions 9.0.0.M1 through 9.0.17 Apache Tomcat versions 8.5.0 through 8.5.39 Apache Tomcat versions 7.0.0 through 7.0.93 Description: The issue is related to the CGI Servlet in Apache Tomcat, which is vulnerable to Remote Code...

CVE-2019-3597

Authentication Bypass vulnerability in McAfee Network Security Manager NSM 9.1 9.1.7.75.2 and 9.2 9.2.7.31 9.2 Update 2 allows unauthenticated users to gain administrator rights via incorrect handling of expired GUI sessions...

ALPINE-CVE-2019-3838

It was found that the forceput operator could be extracted from the DefineResource method in ghostscript before 9.27. A specially crafted PostScript file could use this flaw in order to, for example, have access to the file system outside of the constrains imposed by -dSAFER...