2018

Flash Player versions 31.0.0.122 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lea

FreeRDP prior to version 2.0.0-rc4 contains several Out-Of-Bounds Reads in the NTLM Authentication module that results i

Symantec Endpoint Protection prior to 14.2 MP1 may be susceptible to a DLL Preloading vulnerability, which in this case

Norton prior to 22.15; Symantec Endpoint Protection (SEP) prior to 12.1.7454.7000 & 14.2; Symantec Endpoint Protection S

The agent in OSSEC through 3.1.0 on Windows allows local users to gain NT AUTHORITY\SYSTEM access via Directory Traversa

An issue was discovered in libsndfile 1.0.28. There is a buffer over-read in the function i2alaw_array in alaw.c that wi

A stack-based buffer overflow in the find_green() function of dcraw through 9.28, as used in ufraw-batch and many other

An issue was discovered in Sales & Company Management System (SCMS) through 2018-06-06. There is a discrepancy in userna

In Wireshark 2.6.0 to 2.6.4, the ZigBee ZCL dissector could crash. This was addressed in epan/dissectors/packet-zbee-zcl

In Wireshark 2.6.0 to 2.6.4 and 2.4.0 to 2.4.10, the IxVeriWave file parser could crash. This was addressed in wiretap/v

In Wireshark 2.6.0 to 2.6.4 and 2.4.0 to 2.4.10, the LBMPDM dissector could crash. In addition, a remote attacker could

In Wireshark 2.6.0 to 2.6.4 and 2.4.0 to 2.4.10, the MMSE dissector could go into an infinite loop. This was addressed i

Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Slowloris HTTP Denial of Service: An attacker

Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Denial of Service with large HTTP headers: By

Node.js: All versions prior to Node.js 6.15.0: Debugger port 5858 listens on any interface by default: When the debugger

Node.js: All versions prior to Node.js 6.15.0 and 8.14.0: HTTP request splitting: If Node.js can be convinced to use uns

Improper Authorization vulnerability in QTS 4.3.5 build 20181013, QTS 4.3.4 build 20181008, QTS 4.3.3 build 20180829, QT

NULL Pointer Dereference vulnerability in QTS 4.3.5 build 20181013, QTS 4.3.4 build 20181008, QTS 4.3.3 build 20180829,

Possible buffer overflow in DRM Trusted application due to lack of check function return values in Snapdragon Automobile

Possible buffer overflow in OEM crypto function due to improper input validation in Snapdragon Automobile, Snapdragon Mo

Potential buffer overflow in Video due to lack of input validation in input and output values in Snapdragon Automobile,

In the device programmer target-side code for firehose, a string may not be properly NULL terminated can lead to a incor

While loading a service image, an untrusted pointer dereference can occur in Snapdragon Mobile in versions SD 835, SDA66

When a malformed command is sent to the device programmer, an out-of-bounds access can occur in Snapdragon Automobile, S

SMMU secure camera logic allows secure camera controllers to access HLOS memory during session in Snapdragon Automobile,

Failure condition is not handled properly and the correct error code is not returned. It could cause unintended SUI beha

Possible buffer overflow in Ontario fingerprint code due to lack of input validation for the parameters coming into TZ f

Restrictions related to the modem (sim lock, sim kill) can be bypassed by manipulating the system to issue a deactivatio

Secure application can access QSEE kernel memory through Ontario kernel driver in Snapdragon Automobile, Snapdragon Mobi

Buffer over-read vulnerabilities in an older version of ASN.1 parser in Snapdragon Mobile in versions SD 600.

Samba from version 4.9.0 and before version 4.9.3 that have AD DC configurations watching for bad passwords (to restrict

Samba from version 4.7.0 has a vulnerability that allows a user in a Samba AD domain to crash the KDC when Samba is buil

Buffer Overflow vulnerability in NAS devices. QTS allows attackers to run arbitrary code. This issue affects: QNAP Syste

There is an information leakage vulnerability on several Huawei products. Due to insufficient communication protection f

There is a SRTP icon display vulnerability in Huawei eSpace product. An unauthenticated, remote attacker launches man-in

There is an anonymous TLS cipher suites supported vulnerability in Huawei eSpace product. An unauthenticated, remote att

System command injection in ajaxdata.php in TerraMaster TOS 3.1.03 allows attackers to execute system commands via the "

Cross-site scripting in usertable.php in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript via the "

System command injection in ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to execute system commands v

Incorrect access control on ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to elevate user permissions.

System command injection in ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to execute commands via the

Session Exposure in the web application for TerraMaster TOS version 3.1.03 allows attackers to view active session token

Directory Traversal in the explorer application in TerraMaster TOS version 3.1.03 allows attackers to upload files to ar

System command injection in ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to execute system commands d

NUUO CMS All versions 3.3 and prior the web server application allows injection of arbitrary SQL characters, which can b

System command injection in request_mitv in Xiaomi Mi Router 3 version 2.22.15 allows attackers to execute arbitrary sys

A system command injection vulnerability in zyshclient in ZyXEL NSA325 V2 version 4.81 allows attackers to execute syste

Missing protections against Cross-Site Request Forgery in the web application in ZyXEL NSA325 V2 version 4.81 allow atta

System command injection vulnerability in wifi_access in Xiaomi Mi Router 3 version 2.22.15 allows attackers to execute

The Expedition Migration tool 1.0.106 and earlier may allow an unauthenticated attacker to enumerate files on the operat