2018

jiacrontab 1.4.5 allows remote attackers to execute arbitrary commands via the crontab/task/edit?addr=localhost%3a20001

The server in LiteSpeed OpenLiteSpeed before 1.5.0 RC6 allows local users to cause a denial of service (buffer overflow)

The server in LiteSpeed OpenLiteSpeed before 1.5.0 RC6 does not correctly handle requests for byte sequences, allowing a

A flaw was found in PolicyKit (aka polkit) 0.115 that allows a user with a uid greater than INT_MAX to successfully exec

An issue was discovered in lxml before 4.2.5. lxml/html/clean.py in the lxml.html.clean module does not remove javascrip

An exploitable uninitialized pointer vulnerability exists in the rich text format parser of Atlantis Word Processor, ver

An exploitable out-of-bounds write vulnerability exists in the PNG implementation of Atlantis Word Processor, version 3.

An exploitable arbitrary write vulnerability exists in the open document format parser of the Atlantis Word Processor, v

An exploitable remote code execution vulnerability exists in the HTTP header-parsing function of the TP-Link TL-R600VPN

An exploitable remote code execution vulnerability exists in the ping and tracert functionality of the TP-Link TL-R600VP

An exploitable information disclosure vulnerability exists in the HTTP server functionality of the TP-Link TL-R600VPN. A

PHP-Proxy through 5.1.0 has Cross-Site Scripting (XSS) via the URL field in index.php.

The str_rot_pass function in vendor/atholn1600/php-proxy/src/helpers.php in PHP-Proxy 5.1.0 uses weak cryptography, whic

NUUO NVRMini2 version 3.9.1 is vulnerable to authenticated remote command injection. An attacker can send crafted reques

Zoom clients on Windows (before version 4.1.34814.1119), Mac OS (before version 4.1.34801.1116), and Linux (2.4.129780.0

An Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability exists in the embedded we

Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') vulnerability exists in the embedd

An Unverified Password Change vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLC

An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists in the embe

An Unverified Password Change vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLC

Data Center Expert, versions 7.5.0 and earlier, allows for the upload of a zip file from its user interface to the serve

Data Center Operation allows for the upload of a zip file from its user interface to the server. A carefully crafted, ma

A bypass vulnerability in Active Storage >= 5.2.0 for Google Cloud Storage and Disk services allow an attacker to modify

A Broken Access Control vulnerability in Active Job versions >= 4.2.0 allows an attacker to craft user input which can c

In modules/HELPBOT_MODULE in Budabot 0.6 through 4.0, lax syntax validation allows remote attackers to perform a command

VT-Designer Version 2.1.7.31 is vulnerable by the program populating objects with user supplied input via a file without

VT-Designer Version 2.1.7.31 is vulnerable by the program reading the contents of a file (which is already in memory) in

A local privilege escalation vulnerability has been identified in the SwitchVPN client 2.1012.03 for macOS. Due to over-

Android 1.0 through 9.0 has Insecure Permissions. The Android bug ID is 77286983.

An exploitable denial-of-service vulnerability exists in the URI-parsing functionality of the TP-Link TL-R600VPN HTTP se

Dell OpenManage Network Manager versions prior to 6.5.0 enabled read/write access to the file system for MySQL users due

The Dell OpenManage Network Manager virtual appliance versions prior to 6.5.3 contain an improper authorization vulnerab

IBM StoredIQ 7.6.0 does not implement proper authorization of user roles due to which it was possible for a low privileg

IBM StoredIQ 7.6 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unau

IBM DB2 for Linux, UNIX and Windows 9.7, 10.1, 10.5., and 11.1 db2pdcfg is vulnerable to a stack based buffer overflow,

In versions prior to 5.5, LXCI for VMware allows an authenticated user to download any system file due to insufficient i

LXCI for VMware versions prior to 5.5 and LXCI for Microsoft System Center versions prior to 3.5, allow an authenticated

In versions prior to 5.5, LXCI for VMware allows an authenticated user to write to any system file due to insufficient s

Cross-site scripting vulnerability in QTS 4.2.6 build 20180711, QTS 4.3.3: Qsync Central 3.0.2, QTS 4.3.4: Qsync Central

The SAML broker consumer endpoint in Keycloak before version 4.6.0.Final ignores expiration conditions on SAML assertion

In Artifex MuPDF 1.14.0, there is an infinite loop in the function svg_dev_end_tile in fitz/svg-device.c, as demonstrate

There is a heap-based buffer over-read at writer.c (function: write_png_to_file) in libsixel 1.8.2 that will cause a den

There is a heap-based buffer overflow at fromsixel.c (function: image_buffer_resize) in libsixel 1.8.2 that will cause a

There is an illegal address access at fromsixel.c (function: sixel_decode_raw_impl) in libsixel 1.8.2 that will cause a

cfg_init in confuse.c in libConfuse 3.2.2 has a memory leak.

There is a heap-based buffer over-read at stb_image_write.h (function: stbi_write_png_to_mem) in libsixel 1.8.2 that wil

There is a heap-based buffer over-read at wav.c in wav_write_header in libsndfile 1.0.28 that will cause a denial of ser

There is a NULL pointer dereference at function sixel_helper_set_additional_message (status.c) in libsixel 1.8.2 that wi

There is a heap-based buffer over-read at stb_image.h (function: stbi__tga_load) in libsixel 1.8.2 that will cause a den

There is an illegal address access at asm/preproc.c (function: is_mmacro) in Netwide Assembler (NASM) 2.14rc16 that will