2018

Jboss jbossas before versions 5.2.0-23, 6.4.13, 7.0.5 is vulnerable to an unsafe file handling in the jboss init script

SkyCaiji 1.2 allows CSRF to add an Administrator user.

In Joomla! Core before 3.8.8, inadequate filtering of file and folder names leads to various XSS attack vectors in the m

An issue was discovered in PbootCMS v1.0.9. There is a SQL Injection that can get important information from the databas

An issue was discovered in Joomla! Core before 3.8.8. Under specific circumstances (a redirect issued with a URI contain

An issue was discovered in Joomla! Core before 3.8.8. Inadequate checks allowed users to see the names of tags that were

An issue was discovered in Joomla! Core before 3.8.8. Inadequate input filtering leads to a multiple XSS vulnerabilities

An issue was discovered in Joomla! Core before 3.8.8. The web install application would autofill password fields after e

An issue was discovered in Joomla! Core before 3.8.8. A long running background process, such as remote checks for core

An issue was discovered in Joomla! Core before 3.8.8. Inadequate checks allowed users to modify the access levels of use

An issue was discovered in Joomla! Core before 3.8.8. Depending on the server configuration, PHAR files might be handled

An issue was discovered in com_fields in Joomla! Core before 3.8.8. Inadequate filtering allows users authorised to crea

VMware Workstation (14.x before 14.1.2) and Fusion (10.x before 10.1.2) contain multiple denial-of-service vulnerabiliti

VMware Fusion (10.x before 10.1.2) contains a signature bypass vulnerability which may lead to a local privilege escalat

IBM StoredIQ 7.6 could allow an authenticated attacker to bypass certain security restrictions. By sending a specially-c

An issue was discovered in CppCMS before 1.2.1. There is a denial of service in the JSON parser module.

init.php in the Loginizer plugin 1.3.8 through 1.3.9 for WordPress has Unauthenticated Stored Cross-Site Scripting (XSS)

Systems with microprocessors utilizing speculative execution and that perform speculative reads of system registers may

Systems with microprocessors utilizing speculative execution and speculative execution of memory reads before the addres

The DrugDealer function of a smart contract implementation for Ether Cartel, an Ethereum game, allows attackers to take

sas/readstat_sas7bcat_read.c in libreadstat.a in ReadStat 0.1.1 has an infinite loop.

sav_parse_machine_integer_info_record in spss/readstat_sav_read.c in libreadstat.a in ReadStat 0.1.1 has a memory leak r

jpeg_size in pdfgen.c in PDFGen before 2018-04-09 has a heap-based buffer over-read.

An insecure direct object reference vulnerability in download.cgi in ASUSTOR AS6202T ADM 3.1.0.RFQ3 allows the ability t

An unrestricted file upload vulnerability in upload.cgi in ASUSTOR AS6202T ADM 3.1.0.RFQ3 allows attackers to upload sup

A path traversal vulnerability in download.cgi in ASUSTOR AS6202T ADM 3.1.0.RFQ3 allows attackers to arbitrarily specify

A persistent cross site scripting vulnerability in playlistmanger.cgi in the ASUSTOR SoundsGood application allows attac

A path traversal vulnerability in fileExplorer.cgi in ASUSTOR AS6202T ADM 3.1.0.RFQ3 allows attackers to arbitrarily spe

Directory traversal in importuser.cgi in ASUSTOR AS6202T ADM 3.1.0.RFQ3 allows attackers to navigate the file system via

An unrestricted file upload vulnerability in importuser.cgi in ASUSTOR AS6202T ADM 3.1.0.RFQ3 allows attackers to upload

An XSS issue was discovered in Frappe ERPNext v11.x.x-develop b1036e5 via a comment.

jenkins before versions 2.44, 2.32.2 is vulnerable to a persisted cross-site scripting vulnerability in console notes (S

An issue was discovered in Pluck before 4.7.6. Remote PHP code execution is possible because the set of disallowed filet

An issue was discovered in Pluck before 4.7.6. There is authenticated stored XSS because the character set for filenames

kernel drivers before version 4.17-rc1 are vulnerable to a weakness in the Linux kernel's implementation of random seed

The Micro Focus Client for OES before version 2 SP4 IR8a has a vulnerability that could allow a local attacker to elevat

No authentication/authorization is enforced when a server attempts to join a quorum in Apache ZooKeeper before 3.4.10, a

This vulnerability in Apache Solr 6.0.0 to 6.6.3, 7.0.0 to 7.3.0 relates to an XML external entity expansion (XXE) in So

In Undertow before versions 7.1.2.CR1, 7.1.2.GA it was found that the fix for CVE-2016-4993 was incomplete and Undertow

MagniComp SysInfo before 10-H81, as shipped with BMC BladeLogic Automation and other products, contains an information e

In Octopus Deploy 2018.4.4 through 2018.5.1, Octopus variables that are sourced from the target do not have sensitive va

Horse Market Sell & Rent Portal Script 1.5.7 has a CSRF vulnerability through which an attacker can change all of the ta

An issue was discovered in the Admin Notes plugin 1.1 for MyBB. CSRF allows an attacker to remotely delete all admin not

A security feature bypass exists when Windows incorrectly validates kernel driver signatures, aka "Windows Security Feat

A hardcoded FTP username of myscada and password of Vikuk63 in 'myscadagate.exe' in mySCADA myPRO 7 allows remote attack

Syntastic (aka vim-syntastic) through 3.9.0 does not properly handle searches for configuration files (it searches the c

An issue was discovered in the MakeMyTrip application 7.2.4 for Android. The databases (locally stored) are not encrypte

The Local HTTP API in Radio Thermostat CT50 and CT80 1.04.84 and below products allows unauthorized access via a DNS reb

An integer overflow in the _transfer function of a smart contract implementation for Hexagon (HXG), an Ethereum ERC20 to

Adobe Connect versions 9.7.5 and earlier have an exploitable Authentication Bypass vulnerability. Successful exploitatio