2018

Monitorix before 3.10.1 allows XSS via CGI variables.

PHP 7.x through 7.1.5 allows remote attackers to cause a denial of service (buffer overflow and application crash) or po

PHP 7.1.5 has an Out of bounds access in php_pcre_replace_impl via a crafted preg_replace call.

If an async request was completed by the application at the same time as the container triggered the async timeout, a ra

IBM Maximo Asset Management 7.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrar

An improper handing of overflow in the UTF-8 decoder with supplementary characters can lead to an infinite loop in the d

Apache Axis 1.x up to and including 1.4 is vulnerable to a cross-site scripting (XSS) attack in the default servlet/serv

Whale Browser before 1.3.48.4 displays no URL information but only a title of a web page on the browser's address bar wh

Improper input validation bug in DNS resolver component of Knot Resolver before 2.4.1 allows remote attacker to poison c

Vulnerability in the Oracle Fusion Middleware MapViewer component of Oracle Fusion Middleware (subcomponent: Map Builder

Vulnerability in the Oracle Fusion Middleware component of Oracle Fusion Middleware (subcomponent: Oracle Notification S

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Core Components). S

MikroTik RouterOS through 6.42 allows unauthenticated remote attackers to read arbitrary files and remote authenticated

uploads/.htaccess in Subrion CMS 4.2.1 allows XSS because it does not block .html file uploads (but does block, for exam

rejucms 2.1 has stored XSS via the admin/book.php content parameter.

Subrion 4.2.1 is vulnerable to Improper Access control because user groups not having access to the Admin panel are able

Subrion CMS v4.2.1 is vulnerable to Stored XSS because of no escaping added to the tooltip information being displayed i

_XcursorThemeInherits in library.c in libXcursor before 1.1.15 allows remote attackers to cause denial of service or pot

In Johnson Controls Metasys System Versions 8.0 and prior and BCPro (BCM) all versions prior to 3.0.2, this vulnerabilit

An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Software's PDF Reader, version 9.1.

An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Software's Foxit PDF Reader version

An exploitable unauthenticated XML external injection vulnerability was identified in FocalScope v2416. A unauthenticate

A vulnerability in the administration console of Micro Focus GroupWise prior to version 18.0.2 may allow a remote attack

A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an unauthentic

A vulnerability in the web-based management interface of Cisco Unified Communications Manager could allow an unauthentic

A vulnerability in the web-based management interface of Cisco Small Business 300 Series (Sx300) Managed Switches could

A vulnerability in the web-based management interface of Cisco Small Business 300 Series (Sx300) Managed Switches could

A vulnerability in the web-based management interface of Cisco Web Security Appliance (WSA) could allow an unauthenticat

A vulnerability in Cisco AMP for Endpoints Mac Connector Software installed on Apple macOS 10.12 could allow an unauthen

A vulnerability in the password change function of Cisco Prime Collaboration Provisioning could allow an authenticated,

Multiple exploitable buffer overflow vulnerabilities exist in image parsing functionality of the CFITSIO library version

An issue was discovered in DataLife Engine (DLE) through 13.0. An attacker can use XSS (related to the /addnews.html and

The host name verification when using TLS with the WebSocket client was missing. It is now enabled by default. Versions

Davolink DVW-3200N all version prior to Version 1.00.06. The device generates a weak password hash that is easily cracke

A SQL injection vulnerability in pycsw all versions before 2.0.2, 1.10.5 and 1.8.6 that leads to read and extract of any

IBM Spectrum Symphony and Platform Symphony 7.1.2 and 7.2.0.2 could allow an authenticated user to execute arbitrary com

A directory traversal issue was found in reposync, a part of yum-utils, where reposync fails to sanitize paths in remote

The default cloud-init configuration, in cloud-init 0.6.2 and newer, included "ssh_deletekeys: 0", disabling cloud-init'

It was found that SAML authentication in Keycloak 3.4.3.Final incorrectly authenticated expired certificates. A maliciou

An out-of-bounds heap read vulnerability was found in the jpc_pi_nextpcrl() function of jasper before 2.0.6 when process

It was found that the keycloak before 2.3.0 did not implement authentication flow correctly. An attacker could use this

An integer overflow vulnerability was found in tiftoimage function in openjpeg 2.1.2, resulting in heap buffer overflow.

A flaw was found in the way Ceph Object Gateway would process cross-origin HTTP requests if the CORS policy was set to a

A NULL pointer dereference flaw was found in the way openjpeg 2.1.2 decoded certain input images. Due to a logic error i

A heap-buffer overflow vulnerability was found in QMFB code in JPC codec caused by buffer being allocated with too small

An input validation flaw was found in the way OpenShift 3 handles requests for images. A user, with a copy of the manife

A memory corruption vulnerability exists in the PCX-parsing functionality of Computerinsel Photoline 20.54. A specially

A memory corruption vulnerability exists in the ANI-parsing functionality of Computerinsel Photoline 20.54. A specially

A memory corruption vulnerability exists in the PSD-parsing functionality of Computerinsel Photoline 20.54. A specially

Driver module in Intel Smart Sound Technology before version 9.21.00.3541 potentially allows a local attacker to execute