2017

A vulnerability in the TLS protocol implementation of legacy Cisco ASA 5500 Series (ASA 5505, 5510, 5520, 5540, and 5550

Zoho ManageEngine Password Manager Pro 9 before 9.4 (9400) has reflected XSS in SearchResult.ec and BulkAccessControlVie

A debug tool in Synaptics TouchPad drivers allows local users with administrative access to obtain sensitive information

Directory traversal vulnerability in the "Upload Groupkey" functionality in the Web Configuration Utility in Meinberg LA

The Web Configuration Utility in Meinberg LANTIME devices with firmware before 6.24.004 allows remote attackers to read

Security researchers discovered an authentication bypass vulnerability in version 2.0.2 of the Conserus Workflow Intelli

A security researcher found an XML External Entity (XXE) vulnerability on the Conserus Image Repository archive solution

Cross-site scripting (XSS) vulnerability in Disclaimer in Synology MailPlus Server before 1.4.0-0415 allows remote authe

The Ping() function in ui/api/target.go in Harbor through 1.3.0-rc4 has SSRF via the endpoint parameter to /api/targets/

Techno - Portfolio Management Panel through 2017-11-16 allows full path disclosure via an invalid s parameter to panel/s

Techno - Portfolio Management Panel through 2017-11-16 allows SQL Injection via the panel/search.php s parameter.

Techno - Portfolio Management Panel through 2017-11-16 allows XSS via the panel/search.php s parameter.

Techno - Portfolio Management Panel through 2017-11-16 does not check authorization for panel/portfolio.php?action=delet

In VideoLAN VLC media player through 2.2.8, there is a type conversion vulnerability in modules/demux/mp4/libmp4.c in th

Ruby before 2.4.3 allows Net::FTP command injection. Net::FTP#get, getbinaryfile, gettextfile, put, putbinaryfile, and p

In agent/Core/SpawningKit/Spawner.h in Phusion Passenger 5.1.10 (fixed in Passenger Open Source 5.1.11 and Passenger Ent

Versions of Nexpose prior to 6.4.66 fail to adequately validate the source of HTTP requests intended for the Automated A

A regular expression Denial of Service (DoS) vulnerability in the file lib/ecstatic.js of the ecstatic npm package, befo

A privilege escalation in Fortinet FortiClient Windows 5.4.3 and earlier as well as 5.6.0 allows attacker to gain privil

lib/gui.py in Bob Hepple gjots2 2.4.1 does not validate strings before launching the program specified by the BROWSER en

uiutil.c in Mensis 0.0.080507 does not validate strings before launching the program specified by the BROWSER environmen

default.tcl in Tkabber 1.1 does not validate strings before launching the program specified by the BROWSER environment v

examples/framework/news/news3.py in Kiwi 1.9.22 does not validate strings before launching the program specified by the

gozilla.c in GNU GLOBAL 4.8.6 does not validate strings before launching the program specified by the BROWSER environmen

common/help.c in Geomview 1.9.5 does not validate strings before launching the program specified by the BROWSER environm

af/util/xp/ut_go_file.cpp in AbiWord 3.0.2-2 does not validate strings before launching the program specified by the BRO

backends/platform/sdl/posix/posix.cpp in ScummVM 1.9.0 does not validate strings before launching the program specified

delphi_gui/WWWBrowserRunnerDM.pas in PasDoc 0.14 does not validate strings before launching the program specified by the

Input.cc in Bernard Parisse Giac 1.2.3.57 does not validate strings before launching the program specified by the BROWSE

guiclient/guiclient.cpp in xTuple PostBooks 4.7.0 does not validate strings before launching the program specified by th

library/www_browser.pl in SWI-Prolog 7.2.3 does not validate strings before launching the program specified by the BROWS

Lib/webbrowser.py in Python through 3.6.3 does not validate strings before launching the program specified by the BROWSE

uiutil.c in FontForge through 20170731 does not validate strings before launching the program specified by the BROWSER e

tools/url_handler.pl in TIN 2.4.1 does not validate strings before launching the program specified by the BROWSER enviro

batteriesConfig.mlp in OCaml Batteries Included (aka ocaml-batteries) 2.6 does not validate strings before launching the

swt/motif/browser.c in White_dune (aka whitedune) 0.30.10 does not validate strings before launching the program specifi

libsylph/utils.c in Sylpheed through 3.6 does not validate strings before launching the program specified by the BROWSER

scripts/inspect_webbrowser.py in Reddit Terminal Viewer (RTV) 1.19.0 does not validate strings before launching the prog

etc/ObjectList in Metview 4.7.3 does not validate strings before launching the program specified by the BROWSER environm

boxes.c in nip2 8.4.0 does not validate strings before launching the program specified by the BROWSER environment variab

TeX Live through 20170524 does not validate strings before launching the program specified by the BROWSER environment va

KildClient 3.1.0 does not validate strings before launching the program specified by the BROWSER environment variable, w

In Apache Fineract 0.4.0-incubating, 0.5.0-incubating, and 0.6.0-incubating, an authenticated user with client/loan/cent

Panda Global Protection 17.0.1 allows a system crash via a 0xb3702c04 \\.\PSMEMDriver DeviceIoControl request.

Panda Global Protection 17.0.1 allows a system crash via a 0xb3702c44 \\.\PSMEMDriver DeviceIoControl request.

In ImageMagick 7.0.7-12 Q16, a large loop vulnerability was found in the function ExtractPostscript in coders/wpg.c, whi

In ImageMagick 7.0.7-12 Q16, an infinite loop vulnerability was found in the function ReadPSDChannelZip in coders/psd.c,

In ImageMagick 7.0.7-12 Q16, a memory leak vulnerability was found in the function ReadXPMImage in coders/xpm.c, which a

In vBulletin through 5.3.x, there is an unauthenticated deserialization vulnerability that leads to arbitrary file delet

vBulletin through 5.3.x on Windows allows remote PHP code execution because a require_once call is reachable with an una