2018

Addresses partial fix in CVE-2018-1261. Pivotal spring-integration-zip, versions prior to 1.0.2, exposes an arbitrary fi

Cloud Foundry Foundation UAA, versions 4.12.X and 4.13.X, introduced a feature which could allow privilege escalation ac

In Jenkins before versions 2.44, 2.32.2 low privilege users were able to override JDK download credentials (SECURITY-392

Jenkins before versions 2.44, 2.32.2 is vulnerable to a remote code execution vulnerability involving the deserializatio

In jenkins before versions 2.44, 2.32.2 node monitor data could be viewed by low privilege users via the remote API. The

An issue was discovered on Intelbras NCLOUD 300 1.0 devices. /cgi-bin/ExportSettings.sh, /goform/updateWPS, /goform/Rebo

e107 2.1.7 has CSRF resulting in arbitrary user deletion.

dg-user/?controller=users&action=add in doorGets 7.0 has CSRF that results in adding an administrator account.

An exploitable XML entity injection vulnerability exists in OpenFire User Import Export Plugin 2.6.0. A specially crafte

kernel KVM before versions kernel 4.16, kernel 4.16-rc7, kernel 4.17-rc1, kernel 4.17-rc2 and kernel 4.17-rc3 is vulnera

There is stored cross site scripting in the wp-live-chat-support plugin before 8.0.08 for WordPress via the "name" (aka

Buffer overflow in Intel system Configuration utilities selview.exe and syscfg.exe before version 14 build 11 allows a l

Parameter corruption in NDIS filter driver in Intel Online Connect Access 1.9.22.0 allows an attacker to cause a denial

Bounds check vulnerability in User Mode Driver in Intel Graphics Driver 15.40.x.4 and 21.20.x.x allows unprivileged user

Infinispan permits improper deserialization of trusted data via XML and JSON transcoders under certain server configurat

Mimo Baby 2 devices do not use authentication or encryption for the Bluetooth Low Energy (BLE) communication from a Turt

An issue was discovered in Libav 12.3. A read access violation in the mov_probe function in libavformat/mov.c allows rem

The decompileSETTARGET function in decompile.c in libming through 0.4.8 mishandles cases where the header indicates a fi

An issue was discovered in Frog CMS 0.9.5. There is a file upload vulnerability via the admin/?/plugin/file_manager/uplo

An issue was discovered in cloudwu/cstring through 2016-11-09. There is a memory leak vulnerability that could lead to a

The decompileJUMP function in decompile.c in libming through 0.4.8 mishandles cases where the header indicates a file si

An issue was discovered in MyBiz MyProcureNet 5.0.0. A malicious file can be uploaded to the webserver by an attacker. I

An XSS issue was discovered in MyBiz MyProcureNet 5.0.0. This vulnerability within "ProxyPage.aspx" allows an attacker t

js/views/message_view.js in Open Whisper Signal (aka Signal-Desktop) before 1.10.1 allows XSS via a URL.

Exploitable denial of service vulnerabilities exists in the Service Agent functionality of Moxa EDR-810 V4.1 build 17030

Exploitable denial of service vulnerabilities exists in the Service Agent functionality of Moxa EDR-810 V4.1 build 17030

An exploitable denial of service vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 1703031

An exploitable denial of service vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 1703031

An exploitable denial of service vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 1703031

An exploitable command injection vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 1703031

An exploitable command injection vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 1703031

An exploitable command injection vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 1703031

An exploitable Weak Cryptography for Passwords vulnerability exists in the web server functionality of Moxa EDR-810 V4.1

An exploitable information disclosure vulnerability exists in the Server Agent functionality of Moxa EDR-810 V4.1 build

A password storage vulnerability exists in the operating system functionality of Moxa EDR-810 V4.1 build 17030317. An at

An exploitable cross-site request forgery vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 buil

An exploitable command injection vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 1703031

An exploitable denial of service vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 1703031

An exploitable clear text transmission of password vulnerability exists in the web server and telnet functionality of Mo

An exploitable command injection vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 1703031

An exploitable command injection vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 1703031

Rockwell Automation Arena versions 15.10.00 and prior contains a use after free vulnerability caused by processing speci

On Arris Touchstone Telephony Gateway TG1682G 9.1.103J6 devices, a logout action does not immediately destroy all state

Arris Touchstone Telephony Gateway TG1682G 9.1.103J6 devices are distributed by some ISPs with a default password of "pa

An issue was discovered on Actiontec WCB6200Q before 1.1.10.20a devices. The admin login session cookie is insecurely ge

In Schneider Electric ClearSCADA 2014 R1 (build 75.5210) and prior, 2014 R1.1 (build 75.5387) and prior, 2015 R1 (build

The issue collector in Atlassian Jira before version 7.6.6, from version 7.7.0 before version 7.7.4, from version 7.8.0

The KINEPASS App for Android Ver 3.1.1 and earlier, and for iOS Ver 3.1.2 and earlier do not verify X.509 certificates f

Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote authenticated attackers to bypass access restr

Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote authenticated attackers to bypass access restr