2018

The VBWinExec function in Node\AspVBObj.dll in Advantech WebAccess 8.3.0 allows remote attackers to execute arbitrary OS

Arbitrary File Read in Saperion Web Client version 7.5.2 83166.

Remote Code Execution in Saperion Web Client version 7.5.2 83166.

When using Distributed Test only (RMI based), Apache JMeter 2.x and 3.x uses an unsecured RMI connection. This could all

An issue was discovered in FreeType 2 through 2.9. A NULL pointer dereference in the Ins_GETVARIATION() function within

A stack-based buffer over-read in the ComputeResizeImage function in the MagickCore/accelerate.c file of ImageMagick 7.0

A remote code execution vulnerability exists in Schneider Electric's StruxureOn Gateway versions 1.1.3 and prior. Upload

An information disclosure vulnerability exists in Schneider Electric's IGSS Mobile application version 3.01 and prior. P

A security misconfiguration vulnerability exists in Schneider Electric's IGSS Mobile application versions 3.01 and prior

A security misconfiguration vulnerability exists in Schneider Electric's IGSS SCADA Software versions 12 and prior. Secu

A cross-site request forgery vulnerability exists on the Secure Gateway component of Schneider Electric's PowerSCADA Any

In Exiv2 0.26, there is an integer overflow leading to a heap-based buffer over-read in the Exiv2::getULong function in

In Exiv2 0.26, there is a heap-based buffer over-read in the Exiv2::IptcData::printStructure function in iptc.cpp, relat

In Exiv2 0.26, there is a heap-based buffer over-read in the Exiv2::Image::byteSwap4 function in image.cpp. Remote attac

In Exiv2 0.26, there is a reachable assertion in the readHeader function in bigtiffimage.cpp, which will lead to a remot

Dell EMC SupportAssist Enterprise version 1.1 creates a local Windows user account named "OMEAdapterUser" with a default

The futex_requeue function in kernel/futex.c in the Linux kernel before 4.14.15 might allow attackers to cause a denial

In the Pixel 2 bootloader, there is a missing permission check which bypasses carrier bootloader lock. This could lead t

A information disclosure vulnerability in the Upstream kernel network driver. Product: Android. Versions: Android kernel

A elevation of privilege vulnerability in the Upstream kernel audio driver. Product: Android. Versions: Android kernel.

A elevation of privilege vulnerability in the Upstream kernel easel. Product: Android. Versions: Android kernel. ID: A-6

A information disclosure vulnerability in the Android system (ui). Product: Android. Versions: 5.1.1, 6.0, 6.0.1, 7.0, 7

A information disclosure vulnerability in the Android system (bluetooth). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7

A information disclosure vulnerability in the Android media framework (libstagefright_soft_avcenc). Product: Android. Ve

A information disclosure vulnerability in the Android framework (crypto framework). Product: Android. Versions: 8.0, 8.1

A information disclosure vulnerability in the Android framework (ui framework). Product: Android. Versions: 8.0. ID: A-6

In XBLRamDump mode, there is a debug feature that can be used to dump memory contents, if an attacker has physical acces

In the KeyStore service, there is a permissions bypass that allows access to protected resources. This could lead to loc

A other vulnerability in the Android media framework (n/a). Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1. ID:

In DLSParser of the sonivox library, there is possible resource exhaustion due to a memory leak. This could lead to remo

In ihevcd_ctb_boundary_strength_pbslice of libhevc, there is possible resource exhaustion. This could lead to a remote t

In audioserver, there is an out-of-bounds write due to a log statement using %s with an array that may not be NULL termi

In libmediadrm, there is an out-of-bounds write due to improper input validation. This could lead to local elevation of

In hevc codec, there is an out-of-bounds write due to an incorrect bounds check with the i2_pic_width_in_luma_samples va

A remote code execution vulnerability in the Android media framework (n/a). Product: Android. Versions: 7.0, 7.1.1, 7.1.

In function ih264d_ref_idx_reordering of libavc, there is an out-of-bounds write due to modCount being defined as an uns

cb.exe in Carbon Black 5.1.1.60603 allows attackers to cause a denial of service (out-of-bounds read, invalid pointer de

The cbstream.sys driver in Carbon Black 5.1.1.60603 allows local users with admin privileges to cause a denial of servic

In app/Controller/ServersController.php in MISP 2.4.87, a server setting permitted the override of a path variable on ce

The Windows installer that the Apache CouchDB team provides was vulnerable to local privilege escalation. All files in t

The Apache Thrift Go client library exposed the potential during code generation for command injection due to using an e

controllers/member/Api.php in dayrui FineCms 5.2.0 has SQL Injection: a request with s=member,c=api,m=checktitle, and th

Progress Sitefinity 9.1 uses wrap_access_token as a non-expiring authentication token that remains valid after a passwor

Authenticate/SWT in Progress Sitefinity 9.1 has an open redirect issue in which an authentication token is sent to the r

Progress Sitefinity 9.1 has XSS via the Last name, First name, and About fields on the New User Creation Page. This is f

Progress Sitefinity 9.1 has XSS via file upload, because JavaScript code in an HTML file has the same origin as the appl

Progress Sitefinity 9.1 has XSS via the Content Management Template Configuration (aka Templateconfiguration), as demons

Cross-Site Scripting (XSS) exists in the Add Forum feature in the Administrative Panel in miniBB 3.2.2 via crafted use o

An issue was discovered in Typesetter 5.1. It suffers from a Host header injection vulnerability, Using this attack, a m

An issue was discovered in Typesetter 5.1. The User Permissions page (aka Admin/Users) suffers from critical flaw of Cro