2017

Zoho ManageEngine Desktop Central before build 100092 allows remote attackers to execute arbitrary code via vectors invo

GLPI before 9.1.5 allows SQL injection via an ajax/getDropdownValue.php request with an entity_restrict parameter that i

A specific device configuration can result in a commit failure condition. When this occurs, a user is logged in without

The re-key admin monitor was introduced in Jenkins 1.498 and re-encrypted all secrets in JENKINS_HOME with a new key. It

Linux foundation ONOS 1.9.0 is vulnerable to unauthenticated upload of applications (.oar) resulting in remote code exec

Creolabs Gravity version 1.0 is vulnerable to a stack overflow in the memcmp function

Creolabs Gravity version 1.0 is vulnerable to a stack overflow in the string_repeat() function.

Creolabs Gravity version 1.0 is vulnerable to a heap overflow in an undisclosed component that can result in arbitrary c

Creolabs Gravity version 1.0 is vulnerable to a Double Free in gravity_value resulting potentially leading to modificati

EyesOfNetwork (EON) 5.1 Unauthenticated SQL Injection in eonweb leading to remote root

Kubernetes version 1.5.0-1.5.4 is vulnerable to a privilege escalation in the PodSecurityPolicy admission plugin resulti

rbenv (all current versions) is vulnerable to Directory Traversal in the specification of Ruby version resulting in arbi

gtk-vnc 0.4.2 and older doesn't check framebuffer boundaries correctly when updating framebuffer which may lead to memor

Framadate version 1.0 is vulnerable to Formula Injection in the CSV Export resulting possible Information Disclosure and

RVM automatically loads environment variables from files in $PWD resulting in command execution RVM vulnerable to comman

Oracle, GlassFish Server Open Source Edition 3.0.1 (build 22) is vulnerable to Java Key Store Password Disclosure vulner

SYN Flood or FIN Flood attack in ECos 1 and other versions embedded devices results in web Authentication Bypass. "eCos

Akeneo PIM CE and EE <1.6.6, <1.5.15, <1.4.28 are vulnerable to shell injection in the mass edition, resulting in remote

ATutor version 2.2.1 and earlier are vulnerable to a SQL injection in the Assignment Dropbox, BasicLTI, Blog Post, Blog,

ATutor versions 2.2.1 and earlier are vulnerable to an incorrect access control check vulnerability in the Social Applic

ATutor versions 2.2.1 and earlier are vulnerable to a directory traversal and file extension check bypass in the Course

A remote code execution vulnerability exists when Microsoft scripting engine improperly accesses objects in memory. The

The DiskFileItem class in Apache Wicket 6.x before 6.25.0 and 1.5.x before 1.5.17 allows remote attackers to cause a den

In Apache httpd before 2.2.34 and 2.4.x before 2.4.27, the value placeholder in [Proxy-]Authorization headers of type 'D

IBM BigFix Inventory v9 9.2 uses an inadequate account lockout setting that could allow a remote attacker to brute force

In install/page_dbsettings.php in the Core distribution of XOOPS 2.5.8.1, unfiltered data passed to CREATE and ALTER SQL

Command Injection vulnerability in the web interface in McAfee Advanced Threat Defense (ATD) 3.10, 3.8, 3.6, 3.4 allows

Authentication Bypass vulnerability in the web interface in McAfee Advanced Threat Defense (ATD) 3.10, 3.8, 3.6, 3.4 all

phpMyFAQ before 2.9.8 does not properly mitigate brute-force attacks that try many passwords in attempted logins quickly

FineCMS 2.1.0 allows remote attackers to execute arbitrary PHP code by using a URL Manager "Add Site" action to enter th

A vulnerability in ipsilon 2.0 before 2.0.2, 1.2 before 1.2.1, 1.1 before 1.1.2, and 1.0 before 1.0.3 was found that all

dataTaker DT80 dEX 1.50.012 allows remote attackers to obtain sensitive credential and configuration information via a d

Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2,

On iSmartAlarm cube devices, there is authentication bypass leading to remote execution of commands (e.g., setting the a

It was noticed that a malicious process impersonating an Impala daemon in Apache Impala (incubating) 2.7.0 to 2.8.0 coul

NfSen before 1.3.8 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the customfmt pa

The Struts 1 plugin in Apache Struts 2.1.x and 2.3.x might allow remote code execution via a malicious field value passe

In PHP before 5.6.30 and 7.x before 7.0.15, the PHAR archive handler could be used by attackers supplying malicious arch

GraphicsMagick 1.3.26 has double free vulnerabilities in the ReadOneJNGImage() function in coders/png.c.

libxar.so in xar 1.6.1 has a NULL pointer dereference in the xar_get_path function in util.c.

libxar.so in xar 1.6.1 has a NULL pointer dereference in the xar_unserialize function in archive.c.

EMC ESRS Policy Manager prior to 6.8 contains an undocumented account (OpenDS admin) with a default password. A remote a

Red Hat 3scale (aka RH-3scale) API Management Platform (AMP) before 2.0.0 would permit creation of an access token witho

A Stack-Based Buffer Overflow issue was discovered in Schneider Electric Wonderware ArchestrA Logger, versions 2017.426.

systemd v233 and earlier fails to safely parse usernames starting with a numeric digit (e.g. "0day"), running the servic

An issue was discovered in Irssi before 1.0.4. While updating the internal nick list, Irssi could incorrectly use the GH

An issue was discovered in Irssi before 1.0.4. When receiving messages with invalid time stamps, Irssi would try to dere

Toshiba Home gateway HEM-GW16A firmware HEM-GW16A-FW-V1.2.0 and earlier. Toshiba Home gateway HEM-GW26A firmware HEM-GW2

Toshiba Home gateway HEM-GW16A firmware HEM-GW16A-FW-V1.2.0 and earlier, Toshiba Home gateway HEM-GW26A firmware HEM-GW2

Toshiba Home gateway HEM-GW16A firmware HEM-GW16A-FW-V1.2.0 and earlier. Toshiba Home gateway HEM-GW26A firmware HEM-GW2