2018

A information disclosure vulnerability in the Android media framework (libstagefright_soft_avcenc). Product: Android. Ve

A information disclosure vulnerability in the Android framework (crypto framework). Product: Android. Versions: 8.0, 8.1

A information disclosure vulnerability in the Android framework (ui framework). Product: Android. Versions: 8.0. ID: A-6

In the KeyStore service, there is a permissions bypass that allows access to protected resources. This could lead to loc

In audioserver, there is an out-of-bounds write due to a log statement using %s with an array that may not be NULL termi

In libmediadrm, there is an out-of-bounds write due to improper input validation. This could lead to local elevation of

In hevc codec, there is an out-of-bounds write due to an incorrect bounds check with the i2_pic_width_in_luma_samples va

In function ih264d_ref_idx_reordering of libavc, there is an out-of-bounds write due to modCount being defined as an uns

cb.exe in Carbon Black 5.1.1.60603 allows attackers to cause a denial of service (out-of-bounds read, invalid pointer de

In app/Controller/ServersController.php in MISP 2.4.87, a server setting permitted the override of a path variable on ce

The Windows installer that the Apache CouchDB team provides was vulnerable to local privilege escalation. All files in t

The Apache Thrift Go client library exposed the potential during code generation for command injection due to using an e

Progress Sitefinity 9.1 uses wrap_access_token as a non-expiring authentication token that remains valid after a passwor

An issue was discovered in Typesetter 5.1. It suffers from a Host header injection vulnerability, Using this attack, a m

An issue was discovered in Typesetter 5.1. The User Permissions page (aka Admin/Users) suffers from critical flaw of Cro

Arbitrary File Upload and Remote Code Execution exist in PHP Scripts Mall Schools Alert Management Script 2.0.2 via a pr

Jenkins Pipeline: Supporting APIs Plugin 2.17 and earlier have an arbitrary code execution due to incomplete sandbox pro

Jenkins JUnit Plugin 1.23 and earlier processes XML external entities in files it parses as part of the build process, a

Jenkins Android Lint Plugin 2.5 and earlier processes XML external entities in files it parses as part of the build proc

Jenkins CCM Plugin 3.1 and earlier processes XML external entities in files it parses as part of the build process, allo

LimeSurvey version 3.0.0-beta.3+17110 contains a Cross ite Request Forgery (CSRF) vulnerability in Theme Uninstallation

fmtlib version prior to version 4.1.0 (before commit 0555cea5fc0bf890afe0071a558e44625a34ba85) contains a Memory corrupt

Artifex Mupdf version 1.12.0 contains a Use After Free vulnerability in fz_keep_key_storable that can result in DOS / Po

Sean Barrett stb_vorbis version 1.12 and earlier contains a Buffer Overflow vulnerability in All vorbis decoding paths.

Nanopool Claymore Dual Miner version 7.3 and earlier contains a remote code execution vulnerability by abusing the miner

NASA RtRetrievalFramework version v1.0 contains a CWE-502 vulnerability in Data retrieval functionality of RtRetrieval f

NASA Kodiak version v1.0 contains a CWE-502 vulnerability in Kodiak library's data processing function that can result i

NASA Pyblock version v1.0 - v1.3 contains a CWE-502 vulnerability in Radar data parsing library that can result in remot

NASA Singledop version v1.0 contains a CWE-502 vulnerability in NASA Singledop library (Weather data) that can result in

GNOME librsvg version before commit c6ddf2ed4d768fd88adbea2b63f575cd523022ea contains a Improper input validation vulner

A heap-based buffer overflow exists in Info-Zip UnZip version <= 6.00 in the processing of password-protected archives t

A heap-based buffer overflow exists in Info-Zip UnZip version 6.10c22 that allows an attacker to perform a denial of ser

A heap-based buffer overflow exists in Info-Zip UnZip version 6.10c22 that allows an attacker to perform a denial of ser

Linux kernel version after commit bdcf0a423ea1 - 4.15-rc4+, 4.14.8+, 4.9.76+, 4.4.111+ contains a Incorrect Access Contr

The Squid Software Foundation Squid HTTP Caching Proxy version prior to version 4.0.23 contains a NULL Pointer Dereferen

Linux Linux kernel version at least v4.8 onwards, probably well before contains a Insufficient input validation vulnerab

Jerome Gamez Firebase Admin SDK for PHP version from 3.2.0 to 3.8.0 contains a Incorrect Access Control vulnerability in

The Squid Software Foundation Squid HTTP Caching Proxy version 3.0 to 3.5.27, 4.0 to 4.0.22 contains a Incorrect Pointer

OpenEMR version 5.0.0 contains a OS Command Injection vulnerability in fax_dispatch.php that can result in OS command in

XXXTreeNode method SQL injection remote code execution (RCE) vulnerabilities in Trend Micro Control Manager 6.0 could al

XXXStatusXXX, XXXSummary, TemplateXXX and XXXCompliance method SQL injection remote code execution (RCE) vulnerabilities

TopXXX, ViolationXXX, and IncidentXXX method SQL injection remote code execution (RCE) vulnerabilities in Trend Micro Co

GetXXX method SQL injection remote code execution (RCE) vulnerabilities in Trend Micro Control Manager 6.0 could allow a

A CGGIServlet SQL injection remote code execution (RCE) vulnerability in Trend Micro Control Manager 6.0 could allow a r

An AdHocQuery_Processor SQL injection remote code execution (RCE) vulnerability in Trend Micro Control Manager 6.0 could

The crash reporting feature in Abrt allows local users to gain privileges by leveraging an execve by root after a chroot

fish before 2.1.1 allows local users to write to arbitrary files via a symlink attack on (1) /tmp/fishd.log.%s, (2) /tmp

Puppet Enterprise 2017.3.x prior to 2017.3.3 are vulnerable to a remote execution bug when a specially crafted string wa

In Apache jUDDI 3.2 through 3.3.4, if using the WADL2Java or WSDL2Java classes, which parse a local or remote XML docume

VOBOT CLOCK before 0.99.30 devices do not verify X.509 certificates from SSL servers, which allows man-in-the-middle att