2018

In Moodle 3.x, there is XSS via a calendar event name.

In Moodle 3.x, quiz web services allow students to see quiz results when it is prohibited in the settings.

In Moodle 3.x, the setting for blocked hosts list can be bypassed with multiple A record hostnames.

Moodle 3.x has Server Side Request Forgery in the filepicker.

index.php in CentOS-WebPanel.com (aka CWP) CentOS Web Panel through v0.9.8.12 has XSS via the id parameter to the phpini

CentOS-WebPanel.com (aka CWP) CentOS Web Panel through v0.9.8.12 has XSS via the `module` value of the `index.php` file.

keycloak-httpd-client-install versions before 0.8 insecurely creates temporary file allowing local attackers to overwrit

An exploitable improper authorization vulnerability exists in admin_peers API of cpp-ethereum's JSON-RPC (commit 4e10157

An exploitable cross site scripting (XSS) vulnerability exists in the filter functionality of the delayed_job_web rails

A stored cross site scripting (XSS) vulnerability in Trend Micro Smart Protection Server (Standalone) versions 3.2 and b

An exploitable cross site scripting (XSS) vulnerability exists in the add filter functionality of the rails_admin rails

Vulnerability in Apache Hadoop 0.23.x, 2.x before 2.7.5, 2.8.x before 2.8.3, and 3.0.0-alpha through 3.0.0-beta1 allows

OXID eShop Professional Edition before 4.7.13 and 4.8.x before 4.8.7, Enterprise Edition before 5.0.13 and 5.1.x before

IBM Curam Social Program Management 6.0.5, 6.1.1, 6.2.0, and 7.0.1 within Citizen Portal could allow an authenticated us

X509 certificate verification was not correctly implemented in the early access "user id" feature in the F5 BIG-IP Advan

IBM Integration Bus 9.0 and 10.0 could allow an attacker that has captured a valid session id to hijack another users se

In Long Range Zip (aka lrzip) 0.631, there is an infinite loop and application hang in the get_fileinfo function (lrzip.

In OpenJPEG 2.3.0, there is an integer overflow caused by an out-of-bounds left shift in the opj_j2k_setup_encoder funct

In LibTIFF 4.0.9, there is an uncontrolled resource consumption in the TIFFSetDirectory function of tif_dir.c. Remote at

In PoDoFo 0.9.5, there is an uncontrolled memory allocation in the PoDoFo::PdfVecObjects::Reserve function (base/PdfVecO

jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed wi

jQuery before 1.9.0 is vulnerable to Cross-site Scripting (XSS) attacks. The jQuery(strInput) function does not differen

WordPress before 4.9.2 has XSS in the Flash fallback files in MediaElement (under wp-includes/js/mediaelement).

In Samsung Gear products, Bluetooth link key is updated to the different key which is same with attacker's link key. It

An issue was discovered in markdown2 (aka python-markdown2) through 2.3.5. The safe_mode feature, which is supposed to s

It was found that libpam4j up to and including 1.8 did not properly validate user accounts when authenticating. A user w

The PieChart gadget in Atlassian Jira before version 7.5.3 allows remote attackers to inject arbitrary HTML or JavaScrip

The Jira-importers-plugin in Atlassian Jira before version 7.6.1 allows remote attackers to create new projects and abor

Cross-site scripting (XSS) vulnerability in knowledgebase.php in LiveZilla before 7.0.8.9 allows remote attackers to inj

CRLF injection vulnerability in OXID eShop Professional Edition before 4.7.11 and 4.8.x before 4.8.4, Enterprise Edition

In Exiv2 0.26, there is a segmentation fault caused by uncontrolled recursion in the Exiv2::Image::printIFDStructure fun

A vulnerability in the CLI of the Cisco StarOS operating system for Cisco ASR 5000 Series routers could allow an authent

A vulnerability in Cisco WebEx Meetings Server could allow an unauthenticated, remote attacker to access sensitive data

A vulnerability in Cisco WebEx Meetings Server could allow an unauthenticated, remote attacker to collect customer files

A vulnerability in the web framework of Cisco Unified Communications Manager could allow an unauthenticated, remote atta

A vulnerability in the Profile Editor of the Cisco AnyConnect Secure Mobility Client could allow an unauthenticated, loc

A vulnerability in the web-based management interface of Cisco WAP150 Wireless-AC/N Dual Radio Access Point with Power o

A vulnerability in the web interface of Cisco Prime Infrastructure could allow an unauthenticated, remote attacker to re

A vulnerability in the role-based access control (RBAC) functionality of Cisco Prime Infrastructure could allow an authe

A vulnerability in the web-based management interface of Cisco Web Security Appliance (WSA) could allow an unauthenticat

A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an unauthentic

A vulnerability in one of the diagnostic test CLI commands on Cisco Industrial Ethernet 4010 Series Switches running Cis

A vulnerability in the web framework of Cisco Small Business Managed Switches software could allow an unauthenticated, r

A vulnerability in the web framework of Cisco Small Business Managed Switches software could allow an unauthenticated, r

Vulnerability in the Oracle Financial Services Analytical Applications Reconciliation Framework component of Oracle Fina

Vulnerability in the PeopleSoft Enterprise SCM eProcurement component of Oracle PeopleSoft Products (subcomponent: Manag

Vulnerability in the Oracle Retail Merchandising System component of Oracle Retail Applications (subcomponent: Cross Pil

Vulnerability in the Oracle Financial Services Funds Transfer Pricing component of Oracle Financial Services Application

Vulnerability in the Oracle Financial Services Price Creation and Discovery component of Oracle Financial Services Appli

Vulnerability in the Oracle Financial Services Hedge Management and IFRS Valuations component of Oracle Financial Servic