2018

It was found that the AJP connector in undertow, as shipped in Jboss EAP 7.1.0.GA, does not use the ALLOW_ENCODED_SLASH

GitHub Electron versions 1.8.2-beta.3 and earlier, 1.7.10 and earlier, 1.6.15 and earlier has a vulnerability in the pro

A race condition during Jenkins 2.94 and earlier; 2.89.1 and earlier startup could result in the wrong order of executio

A race condition during Jenkins 2.81 through 2.94 (inclusive); 2.89.1 startup could result in the wrong order of executi

Users with permission to create or configure agents in Jenkins 1.37 and earlier could configure an EC2 agent to run arbi

RAVPower FileHub 2.000.056 allows remote users to steal sensitive information via a crafted HTTP request.

It was found that 389-ds-base since 1.3.6.1 up to and including 1.4.0.3 did not always handle internal hash comparison o

An information disclosure in ovirt-hosted-engine-setup prior to 2.2.7 reveals the root user's password in the log file.

IBM Business Process Manager 8.6 is vulnerable to cross-site request forgery which could allow an attacker to execute ma

FreeSSHd 1.3.1 version is vulnerable to an Unquoted Path Service allowing local users to launch processes with elevated

ZEIT Next.js 4 before 4.2.3 has Directory Traversal under the /_next request namespace.

Cross Site Request Forgery (CSRF) exists in RSVP Invitation Online 1.0 via function/account.php, as demonstrated by modi

Cross Site Request Forgery (CSRF) exists in Photography CMS 1.0 via clients/resources/ajax/ajax_new_admin.php, as demons

crypto/pcrypt.c in the Linux kernel before 4.14.13 mishandles freeing instances, allowing a local user able to access th

A malicious host header in an incoming HTTP request could cause NiFi to load resources from an external server. The fix

The server in Flexense SysGauge 3.6.18 operating on port 9221 can be exploited remotely with the attacker gaining system

HP has identified a potential security vulnerability before IG_11_00_00.10 for DesignJet T790, T795, T1300, T2300, befor

A potential security vulnerability has been identified with HP Web Jetadmin before 10.4 SR2. This vulnerability could po

A potential security vulnerability has been identified with the command line shell of the HP ThinPro operating system 6.

A vulnerability was found in the implementation of DNSSEC in Dnsmasq up to and including 2.78. Wildcard synthesized NSEC

An issue has been found in the API component of PowerDNS Authoritative 4.x up to and including 4.0.4 and 3.x up to and i

Jenkins Translation Assistance Plugin 1.15 and earlier did not require form submissions to be submitted via POST, result

Jenkins Release Plugin 2.9 and earlier did not require form submissions to be submitted via POST, resulting in a CSRF vu

Jenkins Warnings Plugin 4.64 and earlier processes XML external entities in files it parses as part of the build process

Jenkins FindBugs Plugin 4.71 and earlier processes XML external entities in files it parses as part of the build process

Jenkins DRY Plugin 2.49 and earlier processes XML external entities in files it parses as part of the build process, all

Jenkins Checkstyle Plugin 3.49 and earlier processes XML external entities in files it parses as part of the build proce

Jenkins PMD Plugin 3.49 and earlier processes XML external entities in files it parses as part of the build process, all

On multiple SR-IOV cars it is possible for VF's assigned to guests to send ethernet flow control pause frames via the PF

The copy function in application/admin/controller/Article.php in NoneCms 1.3.0 allows remote attackers to access the con

Monstra CMS 3.0.4 allows users to upload arbitrary files, which leads to remote command execution on the server, for exa

This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Netgain Ente

This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Netgain Ente

This vulnerability allows remote attackers to execute code by creating arbitrary files on vulnerable installations of Ne

This vulnerability allows remote attackers to execute code by creating arbitrary files on vulnerable installations of Ne

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of NetGain Systems Ente

This vulnerability allows remote attackers to execute code by overwriting arbitrary files on vulnerable installations of

This vulnerability allows remote attackers to bypass authentication on vulnerable installations of NetGain Systems Enter

Buffer overflow in the Qualcomm radio driver in Android before 2017-01-05 on Android One devices allows local users to g

Equation Editor in Microsoft Office 2003, Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Micro

Equation Editor in Microsoft Office 2003, Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Micro

Equation Editor in Microsoft Office 2003, Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Micro

Equation Editor in Microsoft Office 2003, Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Micro

In Yii Framework 2.x before 2.0.14, remote attackers could obtain potentially sensitive information from exception messa

In Yii Framework 2.x before 2.0.14, the switchIdentity function in web/User.php did not regenerate the CSRF token upon a

An issue was discovered in the _asn1_decode_simple_ber function in decoding.c in GNU Libtasn1 before 4.13. Unlimited rec

A man-in-the-middle vulnerability related to vCenter access was found in Rubrik CDM 3.x and 4.x before 4.0.4-p2. This vu

Heap-based buffer overflow in the ensure_solid_xref function in pdf/pdf-xref.c in Artifex MuPDF 1.12.0 allows a remote a

FasterXML jackson-databind through 2.8.11 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because o

pfSense before 2.3 allows remote authenticated users to execute arbitrary OS commands via a '|' character in the status_