2018

On Windows endpoints, the SecureConnector agent must run under the local SYSTEM account or another administrator account

The generated PHP form code does not properly validate user input folder directories, allowing a remote unauthenticated

The PHP form code generated by PHP FormMail Generator deserializes untrusted input as part of the phpfmg_filman_download

Code generated by PHP FormMail Generator may allow a remote unauthenticated user to bypass authentication in the to acce

CodeLathe FileCloud, version 13.0.0.32841 and earlier, contains a global cross-site request forgery (CSRF) vulnerability

SHDesigns' Resident Download Manager provides firmware update capabilities for Rabbit 2000/3000 CPU boards, which accord

The valueAsString parameter inside the JSON payload contained by the ucLogin_txtLoginId_ClientStat POST parameter of the

The Imagely NextGen Gallery plugin for Wordpress prior to version 2.1.57 does not properly validate user input in the cs

Android devices with code from Ragentek contain a privileged binary that performs over-the-air (OTA) update checks. Addi

Processing malformed SOAP messages when performing the HNAP Login action causes a buffer overflow in the stack in some D

On iOS and Android devices, the ShoreTel Mobility Client app version 9.1.3.109 fails to properly validate SSL certificat

Improper bounds checking of the obuf variable in the link_ntoa() function in linkaddr.c of the BSD libc library may allo

A command injection vulnerability exists in apply.cgi on the ASUS RP-AC52 access point, firmware version 1.0.1.1s and po

In ASUS RP-AC52 access points with firmware version 1.0.1.1s and possibly earlier, the web interface, the web interface

Synology NAS servers DS107, firmware version 3.1-1639 and prior, and DS116, DS213, firmware versions prior to 5.2-5644-1

Nuuo NT-4040 Titan, firmware NT-4040_01.07.0000.0015_1120, uses non-random default credentials of: admin:admin and local

Green Packet DX-350 uses non-random default credentials of: root:wimax. A remote network attacker can gain privileged ac

Intellian Satellite TV antennas t-Series and v-Series, firmware version 1.07, uses non-random default credentials of: ft

The Zizai Tech Nut device allows unauthenticated Bluetooth pairing, which enables unauthenticated connected applications

The Zizai Tech Nut mobile app makes requests via HTTP instead of HTTPS. These requests contain the user's authenticated

The Zizai Tech Nut mobile app stores the account password used to authenticate to the cloud API in cleartext in the cach

The iTrack Easy mobile application stores the account password used to authenticate to the cloud API in base64-encoding

Session cookies are not used for maintaining valid sessions in iTrack Easy. The user's password is passed as a POST para

getgps data in iTrack Easy can be modified without authentication by setting the data using the parametercmd:setothergps

A captured MAC/device ID of an iTrack Easy can be registered under multiple user accounts allowing access to getgps GPS

The iTrack device tracking ID number, also called "LosserID" in the web API, can be obtained by being in the range of an

Eaton 9000X DriveA versions 2.0.29 and prior has a stack-based buffer overflow vulnerability, which may allow remote cod

The 8840 Clinician Programmer executes the application program from the 8870 Application Card. An attacker with physical

Doorkeeper version 4.2.0 and later contains a Incorrect Access Control vulnerability in Token revocation API's authorize

YamlDotNet version 4.3.2 and earlier contains a Insecure Direct Object Reference vulnerability in The default behavior o

Sensu, Inc. Sensu Core version Before version 1.4.2-3 contains a Insecure Permissions vulnerability in Sensu Core on Win

MODX Revolution version <=2.6.4 contains a Directory Traversal vulnerability in /core/model/modx/modmanagerrequest.class

MODX Revolution version <=2.6.4 contains a Incorrect Access Control vulnerability in Filtering user parameters before pa

JFrog Artifactory version since 5.11 contains a Cross ite Request Forgery (CSRF) vulnerability in UI rest endpoints that

An issue was discovered in TotalAV v4.1.7. An unprivileged user could modify or overwrite all of the product's files bec

A double free exists in the MP4StringProperty class in mp4property.cpp in MP4v2 2.0.0. A dangling pointer is freed again

RSA Identity Lifecycle and Governance versions 7.0.1, 7.0.2 and 7.1.0 contains a reflected cross-site scripting vulnerab

RSA Identity Lifecycle and Governance versions 7.0.1, 7.0.2 and 7.1.0 contains an authorization bypass vulnerability wit

In MicroWorld eScan Internet Security Suite (ISS) for Business 14.0.1400.2029, the driver econceal.sys allows a non-priv

The GDASPAMLib.AntiSpam ActiveX control ASK\GDASpam.dll in G DATA Total Security 25.4.0.3 has a buffer overflow via a lo

For the Lenovo Smart Assistant Android app versions earlier than 12.1.82, an attacker with physical access to the smart

The Lenovo Help Android app versions earlier than 6.1.2.0327 had insufficient access control for some functions which, i

An issue has been found in libwav through 2017-04-20. It is a SEGV in the function apply_gain in wav_gain/wav_gain.c.

The function wav_read in libwav.c in libwav through 2017-04-20 has an infinite loop.

An issue has been found in libwav through 2017-04-20. It is a SEGV in the function wav_free in libwav.c.

An issue has been found in libwav through 2017-04-20. It is a SEGV in the function print_info in wav_info/wav_info.c.

An issue has been found in libpng 1.6.34. It is a SEGV in the function png_free_data in png.c, related to the recommende

An issue has been found in PNGwriter 0.7.0. It is a SEGV in pngwriter::readfromfile in pngwriter.cc. NOTE: there is a "W

IBM Security Identity Governance and Intelligence Virtual Appliance 5.2 through 5.2.3.2 could allow a remote attacker to

IBM Security Identity Governance and Intelligence Virtual Appliance 5.2 through 5.2.3.2 stores sensitive information in