2017

server/bin/pulp-gen-ca-certificate in Pulp before 2.8.2 allows local users to read the generated private key.

ManageIQ in CloudForms before 4.1 allows remote authenticated users to execute arbitrary code.

CloudForms Management Engine before 5.8 includes a default SSL/TLS certificate.

The PooledInvokerServlet in JBoss EAP 4.x and 5.x allows remote attackers to execute arbitrary code via a crafted serial

client/consumer/cli.py in Pulp before 2.8.3 writes consumer private keys to etc/pki/pulp/consumer/consumer-cert.pem as w

pulp.spec in the installation process for Pulp 2.8.3 generates the RSA key pairs used to validate messages between the p

The pulp-gen-nodes-certificate script in Pulp before 2.8.3 allows local users to leak the keys or write to arbitrary fil

The Node certificate in Pulp before 2.8.3 contains the private key, and is stored in a world-readable file in the "/etc/

Cloud Foundry Diego 0.1468.0 through 0.1470.0 allows remote attackers to cause a denial of service.

SQL injection vulnerability in ClearPass Policy Manager 6.5.x through 6.5.6 and 6.6.0.

The user module in ansible before 1.6.6 allows remote authenticated users to execute arbitrary commands.

QEMU (aka Quick Emulator) before 2.9.0, when built with the USB OHCI Emulation support, allows local guest OS users to c

QEMU (aka Quick Emulator), when built with the e1000e NIC emulation support, allows local guest OS privileged users to c

The ASN.1 parser in strongSwan before 5.5.3 improperly handles CHOICE types when the x509 plugin is enabled, which allow

The gmp plugin in strongSwan before 5.5.3 does not properly validate RSA public keys before calling mpz_powm_sec, which

Unspecified tests in Lynis before 2.5.0 allow local users to write to arbitrary files or possibly gain privileges via a

The AMF unmarshallers in Red5 Media Server before 1.0.8 do not restrict the classes for which it performs deserializatio

The user authentication module in Huawei Campus switches S5700, S5300, S6300, and S6700 with software before V200R001SPH

Huawei AR1220 routers with software before V200R005SPH006 allow remote attackers to cause a denial of service (board res

The XML interface in Huawei OceanStor UDS devices with software before V100R002C01SPC102 allows remote authenticated use

Huawei OceanStor UDS devices with software before V100R002C01SPC102 might allow remote attackers to execute arbitrary co

The DeviceManager in Huawei OceanStor UDS devices with software before V100R002C01SPC102 might allow remote attackers to

Seagate Business NAS devices with firmware before 2015.00322 allow remote attackers to execute arbitrary code with root

Buffer overflow in the mcpq daemon in F5 BIG-IP systems 10.x before 10.2.4 HF12, 11.x before 11.2.1 HF15, 11.3.x, 11.4.x

Curam Universal Access in IBM Curam Social Program Management (SPM) 6.0 SP2 before EP26, 6.0.4 before 6.0.4.6, and 6.0.5

The r_config_set function in libr/config/config.c in radare2 1.5.0 allows remote attackers to cause a denial of service

atmail before 7.8.0.2 has CSRF, allowing an attacker to create a user account.

atmail before 7.8.0.2 has CSRF, allowing an attacker to change the SMTP hostname and hijack all emails.

atmail before 7.8.0.2 has CSRF, allowing an attacker to upload and import users via CSV.

Craft CMS before 2.6.2982 allows for a potential XSS attack vector by uploading a malicious SVG file.

A vulnerability in the Session Initiation Protocol (SIP) of the Cisco TelePresence Codec (TC) and Collaboration Endpoint

A vulnerability in Cisco Prime Data Center Network Manager (DCNM) Software could allow an unauthenticated, remote attack

A vulnerability in the role-based access control (RBAC) functionality of Cisco Prime Data Center Network Manager (DCNM)

A vulnerability in how DLL files are loaded with Cisco AnyConnect Secure Mobility Client for Windows could allow an auth

VMware Workstation (12.x prior to 12.5.3) and Horizon View Client (4.x prior to 4.4.0) contain an integer-overflow vulne

VMware Workstation (12.x prior to 12.5.3) and Horizon View Client (4.x prior to 4.4.0) contain multiple out-of-bounds re

VMware Workstation (12.x prior to 12.5.3) and Horizon View Client (4.x prior to 4.4.0) contain multiple out-of-bounds wr

VMware Workstation (12.x prior to 12.5.3) and Horizon View Client (4.x prior to 4.4.0) contain multiple out-of-bounds re

VMware Workstation (12.x prior to 12.5.3) and Horizon View Client (4.x prior to 4.4.0) contain a heap buffer-overflow vu

VMware Workstation (12.x prior to 12.5.3) and Horizon View Client (4.x prior to 4.4.0) contain multiple heap buffer-over

VMware Unified Access Gateway (2.5.x, 2.7.x, 2.8.x prior to 2.8.1) and Horizon View (7.x prior to 7.1.0, 6.x prior to 6.

The drag-and-drop (DnD) function in VMware Workstation 12.x before version 12.5.4 and Fusion 8.x before version 8.5.5 ha

Net Monitor for Employees Pro through 5.3.4 has an unquoted service path, which allows a Security Feature Bypass of its

SQL injection vulnerability in ZCMS 1.1.

markdown-it before 4.1.0 does not block data: URLs.

Cross-site scripting (XSS) vulnerability in the WordPress Backup to Dropbox plugin before 4.1 for WordPress.

Binaries compiled against targets that use the libssp library in GCC for stack smashing protection (SSP) might allow loc

dwarf_leb.c in libdwarf allows attackers to cause a denial of service (SIGSEGV).

Directory traversal vulnerability in Spiffy before 5.4.

Cross-site scripting (XSS) vulnerability in Vindula 1.9.