2017

jwt-scala 1.2.2 and earlier fails to verify token signatures correctly which may lead to an attacker being able to pass

Cybozu Office 10.0.0 to 10.6.1 allows authenticated attackers to bypass access restriction to perform arbitrary actions

Cross-Site Scripting exists in OctoberCMS 1.0.425 (aka Build 425), allowing a least privileged user to upload an SVG fil

XML external entity (XXE) vulnerability in Umbraco CMS before 7.7.3 allows attackers to obtain sensitive information by

Cross-site scripting (XSS) vulnerability in Umbraco CMS before 7.7.3 allows remote attackers to inject arbitrary web scr

Cross-Site Scripting (XSS) was discovered in TeamPass before 2.1.27.9. The vulnerability exists due to insufficient filt

ReadGIFImage in coders/gif.c in ImageMagick 7.0.6-1 and GraphicsMagick 1.3.26 leaves the palette uninitialized when proc

security/keys/keyctl.c in the Linux kernel before 4.11.5 does not consider the case of a NULL payload in conjunction wit

The keyctl_read_key function in security/keys/keyctl.c in the Key Management subcomponent in the Linux kernel before 4.1

EMC Network Configuration Manager (NCM) 9.3.x, 9.4.0.x, 9.4.1.x, and 9.4.2.x is affected by a reflected cross-site scrip

RSA Archer GRC Platform prior to 6.2.0.5 is affected by stored cross-site scripting via the Questionnaire ID field. An a

RSA Archer GRC Platform prior to 6.2.0.5 is affected by reflected cross-site scripting vulnerabilities via certain RSA A

RSA Archer GRC Platform prior to 6.2.0.5 is affected by reflected cross-site scripting via the request URL. Attackers co

RSA Archer GRC Platform prior to 6.2.0.5 is affected by stored cross-site scripting via the Source Asset ID field. An au

RSA Archer GRC Platform prior to 6.2.0.5 is affected by a privilege escalation vulnerability. A low privileged RSA Arche

Various resources in Atlassian Fisheye and Crucible before version 4.4.2 allow remote attackers to inject arbitrary HTML

The administration user deletion resource in Atlassian Fisheye and Crucible before version 4.4.2 allows remote attackers

In GNU Libextractor 1.4, there is a Divide-By-Zero in EXTRACTOR_wav_extract_method in wav_extractor.c via a zero sample

Stored Cross-site scripting (XSS) vulnerability in Pure Storage Purity 4.7.5 allows remote authenticated users to inject

libjpeg-turbo 1.5.2 has a NULL Pointer Dereference in jdpostct.c and jquant1.c via a crafted JPEG file.

Reflected XSS vulnerability in Shaarli v0.9.1 allows an unauthenticated attacker to inject JavaScript via the searchtags

Stored XSS vulnerability in Flyspray 1.0-rc4 before 1.0-rc6 allows an authenticated user to inject JavaScript to gain ad

Stored XSS vulnerability in Flyspray before 1.0-rc6 allows an authenticated user to inject JavaScript to gain administra

In Kanboard before 1.0.47, by altering form data, an authenticated user can at least see the names of tags of a private

In Kanboard before 1.0.47, by altering form data, an authenticated user can add an external link to a private project of

In Kanboard before 1.0.47, by altering form data, an authenticated user can see thumbnails of pictures from a private pr

In Kanboard before 1.0.47, by altering form data, an authenticated user can remove attachments from a private project of

In Kanboard before 1.0.47, by altering form data, an authenticated user can remove automatic actions from a private proj

In Kanboard before 1.0.47, by altering form data, an authenticated user can edit tasks of a private project of another u

In Kanboard before 1.0.47, by altering form data, an authenticated user can add an internal link to a private project of

In Kanboard before 1.0.47, by altering form data, an authenticated user can download attachments from a private project

In Kanboard before 1.0.47, by altering form data, an authenticated user can add automatic actions to a private project o

In Kanboard before 1.0.47, by altering form data, an authenticated user can remove categories from a private project of

In Kanboard before 1.0.47, by altering form data, an authenticated user can edit columns of a private project of another

In Kanboard before 1.0.47, by altering form data, an authenticated user can edit tags of a private project of another us

In Kanboard before 1.0.47, by altering form data, an authenticated user can add a new task to a private project of anoth

In Kanboard before 1.0.47, by altering form data, an authenticated user can edit metadata of a private project of anothe

In Kanboard before 1.0.47, by altering form data, an authenticated user can edit a category of a private project of anot

In Kanboard before 1.0.47, by altering form data, an authenticated user can add a new category to a private project of a

In Kanboard before 1.0.47, by altering form data, an authenticated user can remove columns from a private project of ano

In Kanboard before 1.0.47, by altering form data, an authenticated user can edit swimlanes of a private project of anoth

include/global_session.php in Cacti 1.1.25 has XSS related to (1) the URI or (2) the refresh page.

A persistent (stored) XSS vulnerability in the EyesOfNetwork web interface (aka eonweb) 5.1-0 allows remote authenticate

_bfd_dwarf2_cleanup_debug_info in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in G

IBM Financial Transaction Manager for ACH Services for Multi-Platform 3.0.2 could allow an authenticated user to obtain

The dotCMS 4.1.1 application is vulnerable to Stored Cross-Site Scripting (XSS) affecting a vanity-urls Title field, a c

IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to HTTP response splitting attacks. A remote attac

ImageMagick 7.0.7-2 has a memory leak in ReadOneJNGImage in coders/png.c.

ImageMagick 7.0.7-2 has a memory leak in ReadSGIImage in coders/sgi.c.

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, as a res