2018

Memory safety bugs were reported in Firefox 49. Some of these bugs showed evidence of memory corruption and we presume t

Web content could access information in the HTTP cache if e10s is disabled. This can reveal some visited URLs and the co

A potentially exploitable use-after-free crash during actor destruction with service workers. This issue does not affect

Puppet Agent 1.10.x prior to 1.10.13, Puppet Agent 5.3.x prior to 5.3.7, and Puppet Agent 5.5.x prior to 5.5.2 on Window

In Puppet Agent 1.10.x prior to 1.10.13, Puppet Agent 5.3.x prior to 5.3.7, Puppet Agent 5.5.x prior to 5.5.2, Facter on

Puppet Enterprise 2016.4.x prior to 2016.4.12, Puppet Enterprise 2017.3.x prior to 2017.3.7, Puppet Enterprise 2018.1.x

The previous version of Puppet Enterprise 2018.1 is vulnerable to unsafe code execution when upgrading pe-razor-server.

The Java implementation of AMF3 deserializers used by WebORB for Java by Midnight Coders, version 5.1.1.0, allows extern

The Java implementations of AMF3 deserializers in WebORB for Java by Midnight Coders, version 5.1.1.0, derive class inst

The Java implementation of AMF3 deserializers used by Flamingo amf-serializer by Exadel, version 2.2.0, allows external

The Java implementations of AMF3 deserializers in Pivotal/Spring Spring-flex derive class instances from java.io.Externa

The Java implementation of AMF3 deserializers used in Flamingo amf-serializer by Exadel, version 2.2.0, may allow instan

The Java implementation of AMF3 deserializers used in Flamingo amf-serializer by Exadel, version 2.2.0 derives class ins

The Java implementation of AMF3 deserializers used in GraniteDS, version 3.1.1.G, may allow instantiation of arbitrary c

The Java implementation of GraniteDS, version 3.1.1.GA, AMF3 deserializers derives class instances from java.io.External

A vulnerability in open build service allows remote attackers to gain access to source files even though source access i

md_build_attribute in md4c.c in md4c 0.2.6 allows remote attackers to cause a denial of service (Segmentation fault and

Cross-site scripting (XSS) vulnerability in the Canon PrintMe EFI webinterface allows remote attackers to inject arbitra

portfolioCMS 1.0.5 has SQL Injection via the admin/portfolio.php preview parameter.

An issue was discovered in Free Lossless Image Format (FLIF) 0.3. The TransformPaletteC<FileIO>::process function in tra

An issue was discovered in Dropbox Lepton 1.2.1. The validateAndCompress function in validation.cc allows remote attacke

md4c 0.2.6 has a NULL pointer dereference in the function md_process_line in md4c.c, related to ctx->current_block.

Sonatype Nexus Repository Manager versions 3.x before 3.12.0 has XSS in multiple areas in the Administration UI.

Grafana before 5.2.0-beta1 has XSS vulnerabilities in dashboard links.

A Reflected Cross-Site Scripting web vulnerability has been discovered in the OEcms v3.1 web-application. The vulnerabil

Cross-site scripting (XSS) vulnerability in news.php in Dimofinf CMS Version 3.0.0 allows remote attackers to inject arb

tinyexr 0.9.5 has a memory leak in ParseEXRHeaderFromMemory in tinyexr.h.

tinyexr 0.9.5 has a heap-based buffer over-read in tinyexr::DecodePixelData in tinyexr.h, related to OpenEXR code.

There is unauthenticated reflected cross-site scripting (XSS) in LAMS before 3.1 that allows a remote attacker to introd

In Octopus Deploy version 2018.5.1 to 2018.5.7, a user with Task View is able to view a password for a Service Fabric Cl

The transferFrom function of a smart contract implementation for FuturXE (FXE), an Ethereum ERC20 token, allows attacker

The do_core_note function in readelf.c in libmagic.a in file 5.33 allows remote attackers to cause a denial of service (

S3QL before 2.27 mishandles checksumming, and consequently allows replay attacks in which an attacker who controls the b

Liblouis 3.6.0 has a stack-based Buffer Overflow in the function parseChars in compileTranslationTable.c, a different vu

mainproc.c in GnuPG before 2.2.8 mishandles the original filename during decryption and verification actions, which allo

The Enterprise Console in Cisco AppDynamics App iQ Platform before 4.4.3.10598 (HF4) allows SQL injection, aka the Secur

The clustered setup of Apache MXNet allows users to specify which IP address and port the scheduler will listen on via t

An issue was discovered in certain Apple products. macOS before 10.13.5 is affected. The issue involves the "AMD" compon

An issue was discovered in certain Apple products. iOS before 11.4 is affected. The issue involves the "Siri" component.

An issue was discovered in certain Apple products. macOS before 10.13.5 is affected. The issue involves the "Firmware" c

An issue was discovered in certain Apple products. iOS before 11.4 is affected. The issue involves the "Messages" compon

An issue was discovered in certain Apple products. iOS before 11.4 is affected. macOS before 10.13.5 is affected. tvOS b

An issue was discovered in certain Apple products. iOS before 11.4 is affected. Safari before 11.1.1 is affected. The is

An issue was discovered in certain Apple products. iOS before 11.4 is affected. Safari before 11.1.1 is affected. iCloud

An issue was discovered in certain Apple products. iOS before 11.4 is affected. The issue involves the "Siri Contacts" c

An issue was discovered in certain Apple products. iOS before 11.4 is affected. macOS before 10.13.5 is affected. tvOS b

An issue was discovered in certain Apple products. macOS before 10.13.5 is affected. The issue involves the "Hypervisor"

An issue was discovered in certain Apple products. iOS before 11.4 is affected. macOS before 10.13.5 is affected. tvOS b

An issue was discovered in certain Apple products. iOS before 11.4 is affected. macOS before 10.13.5 is affected. tvOS b

An issue was discovered in certain Apple products. iOS before 11.4 is affected. The issue involves the "Magnifier" compo