2018

An elevation of privilege vulnerability exists when the Diagnostics Hub Standard Collector Service improperly impersonat

An information disclosure vulnerability exists when Microsoft Excel improperly discloses the contents of its memory, aka

A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle obje

An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its m

An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its m

A remote code execution vulnerability exists in Microsoft Outlook software when it fails to properly handle objects in m

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Mi

An information disclosure vulnerability exists where certain modes of the search function in Microsoft SharePoint Server

A remote code execution vulnerability exists when the Microsoft .NET Framework fails to validate input properly, aka ".N

A denial of service vulnerability exists when .NET Framework improperly handles special web requests, aka ".NET Framewor

An information disclosure vulnerability exists when Remote Procedure Call runtime improperly initializes objects in memo

An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka "Window

The Palo Alto Networks Expedition Migration tool 1.0.107 and earlier may allow an unauthenticated attacker with remote a

Use After Free in Remote logging (which is disabled by default) in McAfee McAfee Agent (MA) 5.x prior to 5.6.0 allows re

SAP Commerce does not sufficiently validate user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerabilit

SAP NetWeaver AS Java Web Container service does not validate against whitelist the HTTP host header which can result in

By default, the SAP NetWeaver AS Java keystore service does not sufficiently restrict the access to resources that shoul

TRACE method is enabled in SAP Business One Service Layer . Attacker can use XST (Cross Site Tracing) attack if frontend

Under certain conditions SAP Mobile Secure Android client (before version 6.60.19942.0 SP28 1711) allows an attacker to

The security audit log of SAP HANA, versions 1.0 and 2.0, does not log SELECT events if these events are part of a state

Necessary authorization checks for an authenticated user, resulting in escalation of privileges, have been fixed in SAP

SAML 2.0 functionality in SAP NetWeaver AS Java, does not sufficiently validate XML documents received from an untrusted

SAP Marketing (UICUAN (1.20, 1.30, 1.40), SAPSCORE (1.13, 1.14)) does not sufficiently encode user-controlled inputs, re

doorGets 7.0 allows remote attackers to write to arbitrary files via directory traversal, as demonstrated by a dg-user/?

The Administrator Service component of TIBCO Software Inc.'s TIBCO Managed File Transfer Command Center, and TIBCO Manag

An issue was discovered in NoneCms V1.3. thinkphp/library/think/App.php allows remote attackers to execute arbitrary PHP

A SQL injection issue was discovered in ERPNext 10.x and 11.x through 11.0.3-beta.29. This attack is only available to a

urllib3 before version 1.23 does not remove the Authorization HTTP header when following a cross-origin redirect (i.e.,

In phpMyAdmin before 4.8.4, an XSS vulnerability was found in the navigation tree, where an attacker can deliver a paylo

phpMyAdmin 4.7.x and 4.8.x versions prior to 4.8.4 are affected by a series of CSRF flaws. By deceiving a user into clic

An attacker can exploit phpMyAdmin before 4.8.4 to leak the contents of a local file because of an error in the transfor

IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow remote attackers to execute arbitrary Java code thro

IBM Curam Social Program Management 6.0.5, 6.1.1, 6.2.0, 7.0.1, and 7.0.3 is vulnerable to cross-site scripting. This vu

Incorrect handling of Reflect.construct in V8 in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to perfor

Lack of special casing of localhost in WPAD files in Google Chrome prior to 71.0.3578.80 allowed an attacker on the loca

Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 71.0.3578.80 allowed a remote att

An integer overflow in path handling lead to a use after free in Skia in Google Chrome prior to 71.0.3578.80 allowed a r

Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 71.0.3578.80 allowed a remote att

Insufficient validate of external protocols in Shell Integration in Google Chrome on Windows prior to 71.0.3578.80 allow

Failure to dismiss http auth dialogs on navigation in Network Authentication in Google Chrome on Android prior to 71.0.3

Service works could inappropriately gain access to cross origin audio in Media in Google Chrome prior to 71.0.3578.80 al

Lack of proper validation of ancestor frames site when sending lax cookies in Navigation in Google Chrome prior to 71.0.

Incorrect handling of CSP enforcement during navigations in Blink in Google Chrome prior to 71.0.3578.80 allowed a remot

Remote frame navigations was incorrectly permitted to local resources in Blink in Google Chrome prior to 71.0.3578.80 al

Incorrect handling of bidirectional domain names with RTL characters in Omnibox in Google Chrome prior to 71.0.3578.80 a

Incorrect handling of failed navigations with invalid URLs in Navigation in Google Chrome prior to 71.0.3578.80 allowed

Incorrect handling of alert box display in Blink in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to pre

Incorrect handling of blob URLS in Site Isolation in Google Chrome prior to 71.0.3578.80 allowed a remote attacker who h

Inappropriate allowance of the setDownloadBehavior devtools protocol feature in Extensions in Google Chrome prior to 71.

Incorrect handing of paths leading to a use after free in Skia in Google Chrome prior to 71.0.3578.80 allowed a remote a