2018

An issue was discovered in CImg v.220. A heap-based buffer over-read in load_bmp in CImg.h occurs when loading a crafted

An issue was discovered in CImg v.220. A heap-based buffer over-read in load_bmp in CImg.h occurs when loading a crafted

An issue was discovered in CImg v.220. A heap-based buffer over-read in load_bmp in CImg.h occurs when loading a crafted

An issue was discovered in CImg v.220. A heap-based buffer over-read in load_bmp in CImg.h occurs when loading a crafted

The Linux kernel before version 4.11 is vulnerable to a NULL pointer dereference in fs/cifs/cifsencrypt.c:setup_ntlmv2_r

The netfilter subsystem in the Linux kernel through 4.15.7 mishandles the case of a rule blob that contains a jump but l

Denial of Service vulnerability in Micro Focus Operations Orchestration Software, version 10.x. This vulnerability could

This vulnerability allows adjacent attackers to inject arbitrary Controller Area Network messages on vulnerable installa

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Amazon Music Player

An issue was discovered in Enalean Tuleap 9.17. Lack of CSRF attack mitigation while changing an e-mail address makes it

Drupal core 7.x versions before 7.57 has an external link injection vulnerability when the language switcher block is us

In Drupal versions 8.4.x versions before 8.4.5 the Settings Tray module has a vulnerability that allows users to update

In Drupal versions 8.4.x versions before 8.4.5 when using node access controls with a multilingual site, Drupal marks th

A jQuery cross site scripting vulnerability is present when making Ajax requests to untrusted domains. This vulnerabilit

Drupal core 7.x versions before 7.57 when using Drupal's private file system, Drupal will check to make sure a user has

Drupal 8.4.x versions before 8.4.5 and Drupal 7.x versions before 7.57 has a Drupal.checkPlain() JavaScript function whi

In Drupal versions 8.4.x versions before 8.4.5 users with permission to post comments are able to view content and comme

CSRF exists in Hoosk 1.7.0 via /admin/users/new/add, resulting in account creation.

An issue was discovered in CImg v.220. A double free in load_bmp in CImg.h occurs when loading a crafted bmp image.

An issue was discovered in CImg v.220. A heap-based buffer over-read in load_bmp in CImg.h occurs when loading a crafted

An issue was discovered in CImg v.220. DoS occurs when loading a crafted bmp image that triggers an allocation failure i

In the nextgen-gallery plugin before 2.2.50 for WordPress, gallery paths are not secured.

An issue was discovered in JerryScript 1.0. There is a heap-based buffer over-read in the lit_read_code_unit_from_hex fu

A stack buffer overflow flaw was found in the way 389-ds-base 1.3.6.x before 1.3.6.13, 1.3.7.x before 1.3.7.9, 1.4.x bef

An issue was discovered in Wowza Streaming Engine before 4.7.1. There is an XSS vulnerability in the HTTP providers (com

An issue was discovered in Wowza Streaming Engine before 4.7.1. There is a denial of service (memory consumption) via a

An issue was discovered in the MBeans Server in Wowza Streaming Engine before 4.7.1. The file system may be read and wri

In ImageMagick 7.0.7, a NULL pointer dereference vulnerability was found in the function saveBinaryCLProgram in magick/o

In ImageMagick 7.0.7, a NULL pointer dereference vulnerability was found in the function BenchmarkOpenCLDevices in Magic

In the GetOpenCLCachedFilesDirectory function in magick/opencl.c in ImageMagick 7.0.7, a NULL pointer dereference vulner

The packaging of NextCloud in openSUSE used /srv/www/htdocs in an unsafe manner, which could have allowed scripts runnin

A shell command injection in the obs-service-source_validator before 0.7 could be used to execute code as the packager w

The commandline package update tool zypper writes HTTP proxy credentials into its logfile, allowing local attackers to g

In cryptctl before version 2.0 a malicious server could send RPC requests that could overwrite files outside of the cryp

In libzypp before August 2018 GPG keys attached to YUM repositories were not correctly pinned, allowing malicious reposi

In the open build service before 201707022 the wipetrigger and rebuild actions checked the wrong project for permissions

In libzypp before 20170803 it was possible to retrieve unsigned packages without a warning to the user which could lead

In libzypp before 20170803 it was possible to add unsigned YUM repositories without warning to the user that could lead

The NetIQ Identity Manager Plugins before 4.6.1 contained various XML External XML Entity (XXE) handling flaws that coul

The bs_worker code in open build service before 20170320 followed relative symlinks, allowing reading of files outside o

The build package before 20171128 did not check directory names during extraction of build results that allowed untruste

A reflected cross site scripting attack in the NetIQ Access Manager before 4.3.3 using the "typecontainerid" parameter o

A cross site scripting attack in handling the ESP login parameter handling in NetIQ Access Manager before 4.3.3 could be

A race condition in the postgresql init script could be used by attackers able to access the postgresql account to escal

In PHP through 5.6.33, 7.0.x before 7.0.28, 7.1.x through 7.1.14, and 7.2.x through 7.2.2, there is a stack-based buffer

\application\admin\controller\update_urls.class.php in YzmCMS 3.6 has SQL Injection via the catids array parameter to ad

An issue was discovered in FTPShell Client 6.7. A remote FTP server can send 400 characters of 'F' in conjunction with t

The load_multiboot function in hw/i386/multiboot.c in Quick Emulator (aka QEMU) allows local guest OS users to execute a

Command injection vulnerability in Citrix NetScaler ADC and NetScaler Gateway 11.0 before build 70.16, 11.1 before build

SAP CRM, 7.01, 7.02,7.30, 7.31, 7.33, 7.54, allows an attacker to exploit insufficient validation of path information pr