2018

An issue was discovered on Momentum Axel 720P 5.1.8 devices. There is Authenticated Custom Firmware Upgrade via DNS Hija

An issue was discovered in PvPGN Stats 2.4.6. SQL Injection exists in ladder/stats.php via the GET user parameter.

An issue was discovered in PvPGN Stats 2.4.6. SQL Injection exists in ladder/stats.php via the GET sort_direction parame

An issue was discovered in PvPGN Stats 2.4.6. SQL Injection exist in ladder/stats.php via the GET type parameter.

An issue was discovered in PvPGN Stats 2.4.6. SQL Injection exists in ladder/stats.php via the GET game parameter.

An issue was discovered in PvPGN Stats 2.4.6. SQL Injection exists in ladder/stats.php via the POST user_search paramete

router.php in the Harmis Ek rishta (aka ek-rishta) 2.10 component for Joomla! allows SQL Injection via the PATH_INFO to

The web server on Western Digital TV Media Player 1.03.07 and TV Live Hub 3.12.13 allow unauthenticated remote attackers

A vulnerability in Trend Micro OfficeScan 11.0 SP1 and XG could allow a attacker to exploit it via a Browser Refresh att

A vulnerability in Trend Micro OfficeScan 11.0 SP1 and XG could allow a attacker to use a specially crafted URL to eleva

A vulnerability in Trend Micro OfficeScan 11.0 SP1 and XG could allow a attacker to take a series of steps to bypass or

Little Snitch versions 4.0 to 4.0.6 use the SecStaticCodeCheckValidityWithErrors() function without the kSecCSCheckAllAr

In the Linux Kernel before version 4.16.11, 4.14.43, 4.9.102, and 4.4.133, multiple race condition errors when handling

In the Linux Kernel before version 4.15.8, 4.14.25, 4.9.87, 4.4.121, 4.1.51, and 3.2.102, an error in the "_sctp_make_ch

Improper restriction of write operations within the bounds of a memory buffer in snscore.sys in SoftControl/SafenSoft Sy

Under certain conditions SAP UI5 Handler allows an attacker to access information which would otherwise be restricted. S

Under certain conditions, SAP Business One, 9.2, 9.3, for SAP HANA backup service allows an attacker to access informati

SAP UI5 did not validate user input before adding it to the DOM structure. This may lead to malicious user-provided Java

Openshift Enterprise source-to-image before version 1.1.10 is vulnerable to an improper validation of user input. An att

Missing escaping of ESSID values in sysconfig of SUSE Linux Enterprise allows attackers controlling an access point to c

An issue was discovered in mruby 1.4.1. There is a NULL pointer dereference in mrb_class_real because "class BasicObject

An issue was discovered in mruby 1.4.1. There is a heap-based buffer over-read associated with OP_ENTER because mrbgems/

An issue was discovered in mruby 1.4.1. There is a NULL pointer dereference in mrb_class, related to certain .clone usag

Password recovery exploitation vulnerability in the non-certificate-based authentication mechanism in McAfee Network Sec

Exploitation of Authorization vulnerability in the web interface in McAfee Network Security Management (NSM) before 8.2.

ovirt-engine up to version 4.2.3 is vulnerable to an unfiltered password when choosing manual db provisioning. When engi

routing before version 3.10 is vulnerable to an improper input validation of the Openshift Routing configuration which c

During key agreement in a TLS handshake using a DH(E) based ciphersuite a malicious server can send a very large prime v

In the ea_get function in fs/jfs/xattr.c in the Linux kernel through 4.17.1, a memory corruption bug in JFS can be trigg

In net/socket.c in the Linux kernel through 4.17.1, there is a race condition between fchownat and close in cases where

Cross-site scripting (XSS) vulnerability in Public Knowledge Project (PKP) Open Journal System (OJS) 3.0.0 to 3.1.1-1 al

An issue was discovered in Asterisk Open Source 15.x before 15.4.1. When connected to Asterisk via TCP/TLS, if the clien

An issue was discovered in Asterisk Open Source 13.x before 13.21.1, 14.x before 14.7.7, and 15.x before 15.4.1 and Cert

The VMware AirWatch Agent for Android prior to 8.2 and AirWatch Agent for Windows Mobile prior to 6.5.2 contain a remote

VMware NSX SD-WAN Edge by VeloCloud prior to version 3.1.0 contains a command injection vulnerability in the local web U

Plaintext of decrypted emails can leak through by user submitting an embedded form. This vulnerability affects Thunderbi

Using remote content in encrypted messages can lead to the disclosure of plaintext. This vulnerability affects Thunderbi

Mozilla developers backported selected changes in the Skia library. These changes correct memory corruption issues inclu

If a text string that happens to be a filename in the operating system's native format is dragged and dropped onto the a

If a URL using the "file:" protocol is dragged and dropped onto an open tab that is running in a different child process

A use-after-free vulnerability can occur during WebGL operations. While this results in a potentially exploitable crash,

A buffer overflow was found during UTF8 to Unicode string conversion within JavaScript with extremely large amounts of d

A vulnerability exists in XSLT during number formatting where a negative buffer size may be allocated in some instances,

The JSON Viewer displays clickable hyperlinks for strings that are parseable as URLs, including "javascript:" links. If

A mechanism to bypass Content Security Policy (CSP) protections on sites that have a "script-src" policy of "'strict-dyn

In the Windows 10 April 2018 Update, Windows Defender SmartScreen honors the "SEE_MASK_FLAG_NO_UI" flag associated with

The filename appearing in the "Downloads" panel improperly renders some Unicode characters, allowing for the file name t

The Live Bookmarks page and the PDF viewer can run injected script content if a user pastes script from the clipboard in

It is possible to spoof the filename of an attachment and display an arbitrary attachment name. This could lead to a use

If manipulated hyperlinked text with "chrome:" URL contained in it is dragged and dropped on the "home" icon, the home p