2018

IBM Security Identity Governance Virtual Appliance 5.2 through 5.2.3.2 discloses sensitive information to unauthorized u

IBM Security Identity Governance Virtual Appliance 5.2 through 5.2.3.2 specifies permissions for a security-critical res

IBM Security Identity Governance Virtual Appliance 5.2 through 5.2.3.2 does not set the secure attribute on authorizatio

IBM Security Identity Governance Virtual Appliance 5.2 through 5.2.3.2 uses weaker than expected cryptographic algorithm

It was noticed an XSS in certain 404 pages that could be exploited to perform an XSS attack. Chrome will detect this as

An issue was discovered in WeaselCMS v0.3.5. CSRF can create new pages via an index.php?b=pages&a=new URI.

An issue was discovered in WeaselCMS v0.3.5. CSRF can update the website settings (such as the theme, title, and descrip

The mail message display page in SquirrelMail through 1.4.22 has XSS via SVG animations (animate to attribute).

The mail message display page in SquirrelMail through 1.4.22 has XSS via the formaction attribute.

The mail message display page in SquirrelMail through 1.4.22 has XSS via a "<math xlink:href=" attack.

The mail message display page in SquirrelMail through 1.4.22 has XSS via a "<math><maction xlink:href=" attack.

The mail message display page in SquirrelMail through 1.4.22 has XSS via a "<form action='data:text" attack.

The mail message display page in SquirrelMail through 1.4.22 has XSS via a "<svg><a xlink:href=" attack.

An issue has been found in dilawar sound through 2017-11-27. The end of openWavFile in wav-file.cc has Mismatched Memory

An issue has been found in PDF2JSON 0.69. XmlFontAccu::CSStyle in XmlFonts.cc has Mismatched Memory Management Routines

An issue has been found in PDF2JSON 0.69. The HtmlString class in ImgOutputDev.cc has Mismatched Memory Management Routi

An issue has been found in jpeg_encoder through 2015-11-27. It is a heap-based buffer overflow in the function readFromB

An issue has been found in jpeg_encoder through 2015-11-27. It is a SEGV in the function readFromBMP in jpeg_encoder.cpp

Harmonic NSG 9000 devices have a default password of nsgadmin for the admin account, a default password of nsgguest for

Harmonic NSG 9000 devices allow remote authenticated users to conduct directory traversal attacks, as demonstrated by "P

Harmonic NSG 9000 devices allow remote authenticated users to read the webapp.py source code via a direct request for th

PHPCMS 9 allows remote attackers to cause a denial of service (resource consumption) via large font_size, height, and wi

The get_app_path function in desktop/unx/source/start.c in LibreOffice through 6.0.5 mishandles the realpath function in

An issue was discovered in wifipcap/wifipcap.cpp in TCPFLOW through 1.5.0-alpha. There is an integer overflow in the fun

The Add page option in my little forum 2.4.12 allows XSS via the Menu Link field.

The Add page option in my little forum 2.4.12 allows XSS via the Title field.

upgrade_handle.php on NUUO NVRmini devices allows Remote Command Execution via shell metacharacters in the uploaddir par

An issue was discovered in Open Ticket Request System (OTRS) 6.0.x through 6.0.9, 5.0.x through 5.0.28, and 4.0.x throug

PHP Scripts Mall Basic B2B Script 2.0.0 has Reflected and Stored XSS via the First name, Last name, Address 1, City, Sta

Tenda D152 ADSL routers allow XSS via a crafted SSID.

OCS Inventory 2.4.1 lacks a proper XML parsing configuration, allowing the use of external entities. This issue can be e

A command injection vulnerability was found in the web administration console in SoftNAS Cloud before 4.0.3. In particul

OCS Inventory 2.4.1 is prone to a remote command-execution vulnerability. Specifically, this issue occurs because the co

OCS Inventory 2.4.1 contains multiple SQL injections in the search engine. Authentication is needed in order to exploit

Matera Banco 1.0.0 is vulnerable to multiple reflected XSS, as demonstrated by the /contingency/web/index.jsp (aka home

/contingency/servlet/ServletFileDownload executes as root and provides unauthenticated access to files via the file para

Matera Banco 1.0.0 is vulnerable to path traversal (allowing access to system files outside the default application fold

Matera Banco 1.0.0 allows CSRF, as demonstrated by a /contingency/web/messageSend/messageSendHandler.jsp request.

Matera Banco 1.0.0 mishandles Java errors in the backend, as demonstrated by a stack trace revealing use of net.sf.acegi

Matera Banco 1.0.0 is vulnerable to multiple stored XSS, as demonstrated by the sca/privilegio/consultarUsuario.jsf "Nom

A vulnerability in lack of validation of user-supplied parameters pass to XML-RPC calls on SonicWall Global Management S

Insufficient URI encoding in restforce before 3.0.0 allows attacker to inject arbitrary parameters into Salesforce API r

A vulnerability in uniview EZPlayer 1.0.6 could allow an attacker to execute arbitrary code on a targeted system via vid

Read-Only export policy rules are not correctly enforced in Clustered Data ONTAP 8.3 Release Candidate versions and ther

cgit_clone_objects in CGit before 1.2.1 has a directory traversal vulnerability when `enable-http-clone=1` is not turned

A file upload vulnerability exists in ukcms v1.1.7 and earlier. The vulnerability is due to the system not strictly filt

SeaCMS v6.61 allows Remote Code execution by placing PHP code in an allowed IP address (aka ip) to /admin/admin_ip.php (

report_viewer.do in ServiceNow Release Jakarta Patch 8 and earlier allows remote attackers to execute arbitrary code via

Samsung Syncthru Web Service V4.05.61 is vulnerable to CSRF on every request, as demonstrated by sws.application/printin

The Web server in 3CX version 15.5.8801.3 is vulnerable to Information Leakage, because of improper error handling in St