2017

A security-check flaw was found in the way the Heketi 5 server API handled user requests. An authenticated Heketi user c

CWEBNET/WOSummary/List in ZUUSE BEIMS ContractorWeb .NET 5.18.0.0 allows SQL injection via the tradestatus, assetno, ass

NetApp Clustered Data ONTAP versions 9.x prior to 9.1P10 and 9.2P2 are susceptible to a vulnerability which allows an at

In Apache Drill 1.11.0 and earlier when submitting form from Query page users are able to pass arbitrary script or HTML

Paid To Read Script 2.0.5 has SQL Injection via the admin/userview.php uid parameter, the admin/viewemcamp.php fnum para

Readymade Video Sharing Script 3.2 has HTML Injection via the single-video-detail.php comment parameter.

Bus Booking Script 1.0 has SQL Injection via the txtname parameter to admin/index.php.

FS Lynda Clone 1.0 has SQL Injection via the keywords parameter to tutorial/.

The KVM implementation in the Linux kernel through 4.14.7 allows attackers to obtain potentially sensitive information f

contrib/slapd-modules/nops/nops.c in OpenLDAP through 2.4.45, when both the nops module and the memberof overlay are ena

The BrightSign Digital Signage (4k242) device (Firmware 6.2.63 and below) has directory traversal via the /storage.html

The BrightSign Digital Signage (4k242) device (Firmware 6.2.63 and below) allows renaming and modifying files via /tools

The BrightSign Digital Signage (4k242) device (Firmware 6.2.63 and below) has XSS via the REF parameter to /network_diag

CMS Made Simple (CMSMS) before 2.2.5 does not properly cache login information in cookies.

CMS Made Simple (CMSMS) before 2.2.5 does not properly cache login information in sessions.

Maccms 8.x allows remote command execution via the wd parameter in an index.php?m=vod-search request.

DedeCMS through 5.7 has SQL Injection via the $_FILES superglobal to plus/recommend.php.

DedeCMS through 5.7 has SQL Injection via the logo parameter to plus/flink_add.php.

DedeCMS through 5.6 allows arbitrary file upload and PHP code execution by embedding the PHP code in a .jpg file, which

elf/dl-load.c in the GNU C Library (aka glibc or libc6) 2.19 through 2.26 mishandles RPATH and RUNPATH containing $ORIGI

The Net::LDAP (aka net-ldap) gem before 0.16.0 for Ruby has Missing SSL Certificate Validation.

Sonatype Nexus Repository Manager through 2.14.5 has weak password encryption with a hardcoded CMMDwoV value in the LDAP

GitLab 9.4.x before 9.4.2 does not support LDAP SSL certificate verification, but a verify_certificates LDAP option was

Cross - site scripting (XSS) vulnerability in UrBackup Server before 2.1.20 allows remote attackers to inject arbitrary

Trape before 2017-11-05 has XSS via the /nr red parameter, the /nr vId parameter, the /register User-Agent HTTP header,

Trape before 2017-11-05 has SQL injection via the /nr red parameter, the /nr vId parameter, the /register User-Agent HTT

The saveFile method in MediaController.java in the Telegram Messenger application before 2017-12-08 for Android allows d

A Reflected XSS Vulnerability affects the forgotten password page of Maplesoft Maple T.A. 2016.0.6 (Customer Hosted) via

PCAUSA Rawether framework does not properly validate BPF data, allowing a crafted malicious BPF program to perform opera

Commvault Edge Communication Service (cvd) prior to version 11 SP7 or version 11 SP6 with hotfix 590 is prone to a stack

Pandora iOS app prior to version 8.3.2 fails to properly validate SSL certificates provided by HTTPS connections, which

Multiple D-Link devices including the DIR-850L firmware versions 1.14B07 and 2.07.B05 contain a stack-based buffer overf

D-Link DIR-130 firmware version 1.23 and DIR-330 firmware version 1.12 do not sufficiently protect administrator credent

D-Link DIR-130 firmware version 1.23 and DIR-330 firmware version 1.12 are vulnerable to authentication bypass of the re

Flash Seats Mobile App for Android version 1.7.9 and earlier and for iOS version 1.9.51 and earlier fails to properly va

ACTi cameras including the D, B, I, and E series using firmware version A1D-500-V6.11.31-AC use non-random default crede

ACTi cameras including the D, B, I, and E series using firmware version A1D-500-V6.11.31-AC have a web application that

ACTi cameras including the D, B, I, and E series using firmware version A1D-500-V6.11.31-AC fail to properly restrict ac

The Log Query and Quarantine Query pages in Trend Micro ScanMail for Exchange 12.0 are vulnerable to cross site scriptin

The absence of Anti-CSRF tokens in Trend Micro ScanMail for Exchange 12.0 web interface forms could allow an attacker to

A vulnerability in Trend Micro ScanMail for Exchange 12.0 exists in which certain specific installations that utilize a

A vulnerability in Trend Micro ScanMail for Exchange 12.0 exists in which some communications to the update servers are

A service DLL preloading vulnerability in Trend Micro Encryption for Email versions 5.6 and below could allow an unauthe

A vulnerability in applications created using Qt for Android prior to 5.9.3 allows attackers to alter environment variab

Qt for Android prior to 5.9.0 allows remote attackers to execute arbitrary OS commands via unspecified vectors.

The raw_sendmsg() function in net/ipv4/raw.c in the Linux kernel through 4.14.6 has a race condition in inet->hdrincl th

An Information Disclosure vulnerability in Fortinet FortiClient for Windows 5.6.0 and below versions, FortiClient for Ma

K7Sentry.sys 15.1.0.59 in K7 Antivirus 15.1.0309 has a NULL pointer dereference via a 0x950025c8 DeviceIoControl request

K7Sentry.sys 15.1.0.59 in K7 Antivirus 15.1.0309 has a NULL pointer dereference via a 0x950025a4 DeviceIoControl request

K7Sentry.sys 15.1.0.59 in K7 Antivirus 15.1.0309 has a NULL pointer dereference via a 0x950025ac DeviceIoControl request