2018

Hapi versions less than 11.0.0 implement CORS incorrectly and allowed for configurations that at best returned inconsist

Versions less than 0.1.4 of the static file server module fancy-server are vulnerable to directory traversal. An attacke

Certain input when passed into remarkable before 1.4.1 will bypass the bad protocol check that disallows the javascript:

The qs module before 1.0.0 does not have an option or default for specifying object depth and when parsing a string repr

Sinatra before 2.0.2 has XSS via the 400 Bad Request page that occurs upon a params parser exception.

SELA (aka SimplE Lossless Audio) v0.1.2-alpha has a stack-based buffer overflow in the core/apev2.c init_apev2_keys func

The 'systemui/settings_network.php' and 'systemui/settings_patching.php' scripts in the Quest KACE System Management App

The 'IMAGES_JSON' and 'attachments_to_remove[]' parameters of the '/adminui/advisory.php' script in the Quest KACE Syste

The 'reportID' parameter received by the '/common/run_report.php' script in the Quest KACE System Management Appliance 8

The '/common/ajax_email_connection_test.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible

The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by

The 'checksum' parameter of the '/common/download_attachment.php' script in the Quest KACE System Management Appliance 8

The 'orgID' parameter received by the '/common/download_agent_installer.php' script in the Quest KACE System Management

The script '/adminui/error_details.php' in the Quest KACE System Management Appliance 8.0.318 allows authenticated users

In order to perform actions that requires higher privileges, the Quest KACE System Management Appliance 8.0.318 relies o

The 'fmt' parameter of the '/common/run_cross_report.php' script in the the Quest KACE System Management Appliance 8.0.3

In order to perform actions that require higher privileges, the Quest KACE System Management Appliance 8.0.318 relies on

In ImageMagick 7.0.7-37 Q16, SetGrayscaleImage in the quantize.c file allows attackers to cause a heap-based buffer over

In ImageMagick 7.0.7-36 Q16, the ReadMATImage function in coders/mat.c allows attackers to cause a use after free via a

Espruino before 1.99 allows attackers to cause a denial of service (application crash) and a potential Information Discl

Espruino before 1.99 allows attackers to cause a denial of service (application crash) with a user crafted input file vi

Espruino before 1.99 allows attackers to cause a denial of service (application crash) with a user crafted input file vi

Espruino before 1.99 allows attackers to cause a denial of service (application crash) and a potential Escalation of Pri

Espruino before 1.99 allows attackers to cause a denial of service (application crash) with a user crafted input file vi

Espruino before 1.99 allows attackers to cause a denial of service (application crash) and potential Information Disclos

Espruino before 1.98 allows attackers to cause a denial of service (application crash) with a user crafted input file vi

Espruino before 1.98 allows attackers to cause a denial of service (application crash) with a user crafted input file vi

Espruino before 1.99 allows attackers to cause a denial of service (application crash) with a user crafted input file vi

Bitmain Antminer D3, L3+, and S9 devices allow Remote Command Execution via the system restore function.

In stroke_socket.c in strongSwan before 5.6.3, a missing packet length check could allow a buffer underflow, which may l

The Head Unit HU_NBT (aka Infotainment) component on BMW i Series, BMW X Series, BMW 3 Series, BMW 5 Series, and BMW 7 S

The Head Unit HU_NBT (aka Infotainment) component on BMW i Series, BMW X Series, BMW 3 Series, BMW 5 Series, and BMW 7 S

The Telematics Control Unit (aka Telematic Communication Box or TCB), when present on BMW vehicles produced in 2012 thro

The Head Unit HU_NBT (aka Infotainment) component on BMW i Series, BMW X Series, BMW 3 Series, BMW 5 Series, and BMW 7 S

The Head Unit HU_NBT (aka Infotainment) component on BMW i Series, BMW X Series, BMW 3 Series, BMW 5 Series, and BMW 7 S

The Head Unit HU_NBT (aka Infotainment) component on BMW i Series, BMW X Series, BMW 3 Series, BMW 5 Series, and BMW 7 S

The Telematics Control Unit (aka Telematic Communication Box or TCB), when present on BMW vehicles produced in 2012 thro

Ruckus SmartZone (formerly Virtual SmartCell Gateway or vSCG) 3.5.0, 3.5.1, 3.6.0, and 3.6.1 (Essentials and High Scale)

SeaCMS 6.61 has stored XSS in admin_collect.php via the siteurl parameter.

An issue was discovered in mass-pages-posts-creator.php in the MULTIDOTS Mass Pages/Posts Creator plugin 1.2.2 for WordP

class-woo-banner-management.php in the MULTIDOTS WooCommerce Category Banner Management plugin 1.1.0 for WordPress has a

GifIndexToTrueColor in ngiflib.c in MiniUPnP ngiflib 0.4 has a Segmentation fault.

Liblouis 3.5.0 has a Segmentation fault in lou_logPrint in logging.c.

ngiflib.c in MiniUPnP ngiflib 0.4 has a heap-based buffer over-read in GifIndexToTrueColor.

ngiflib.c in MiniUPnP ngiflib 0.4 has a stack-based buffer overflow in DecodeGifImg.

ClipperCMS 1.3.3 has XSS in the "Module name" field in a "Modules -> Manage modules -> edit" action to the manager/ URI.

ClipperCMS 1.3.3 allows Session Fixation.

Reflected XSS is possible in the GamePlan theme through 1.5.13.2 for WordPress because of insufficient input sanitizatio

Prior to 2018-04-27, the reprompt feature in Amazon Echo devices could be misused by a custom Alexa skill. The reprompt

In Stealth Authorization Server before 3.3.017.0 in Unisys Stealth Solution, an encryption key may be left in memory.