2018

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Security: Encryption). Supported vers

Vulnerability in the MySQL Workbench component of Oracle MySQL (subcomponent: Workbench: Security: Encryption). Supporte

389-ds-base before versions 1.3.8.5, 1.4.0.12 is vulnerable to a Cleartext Storage of Sensitive Information. By default,

ClamAV before 0.100.1 lacks a PDF object length check, resulting in an unreasonably long time to parse a relatively smal

The iTrack device tracking ID number, also called "LosserID" in the web API, can be obtained by being in the range of an

IBM Security Identity Governance and Intelligence Virtual Appliance 5.2 through 5.2.3.2 stores sensitive information in

Fixed issues with NetIQ eDirectory prior to 9.1.1 when checking certificate revocation.

The Trackr device ID is constructed of a manufacturer identifier of four zeroes followed by the BLE MAC address in rever

Multiple IBM Rational products could disclose sensitive information by an attacker that intercepts vulnerable requests.

An undisclosed vulnerability in Jazz common products exists with potential for information disclosure. IBM X-Force ID: 1

Common Open Policy Service Protocol (COPS) module in Huawei USG6300 V100R001C10; V100R001C20; V100R001C30; V500R001C00;

The alarm_timer_nsleep function in kernel/time/alarmtimer.c in the Linux kernel through 4.17.3 has an integer overflow v

The UNIX pipe which sudo uses to contact SSSD and read the available sudo rules from SSSD has too wide permissions, whic

Dovecot before version 2.2.29 is vulnerable to a denial of service. When 'dict' passdb and userdb were used for user aut

A flaw was found affecting the Linux kernel before version 4.17. By mmap()ing a FUSE-backed file onto a process's memory

An issue was discovered in the com.dropbox.android application 98.2.2 for Android. The Passcode feature allows authentic

An issue was discovered in the com.dropbox.android application 98.2.2 for Android. The FingerprintManager class for Biom

IBM WebSphere MQ 8.0 and 9.0, when configured to use a PAM module for authentication, could allow a user to cause a dead

procps-ng, procps is vulnerable to a process hiding through race condition. Since the kernel's proc_pid_readdir() return

private_address_check ruby gem before 0.5.0 is vulnerable to a time-of-check time-of-use (TOCTOU) race condition due to

IBM Financial Transaction Manager for ACH Services for Multi-Platform 3.0.6 could allow an authenticated user to execute

The existence of a specifically requested local file can be found due to the double firing of the "onerror" when the "so

Private browsing mode leaves metadata information, such as URLs, for sites visited in "browser.db" and "browser.db-wal"

An issue was discovered in certain Apple products. iOS before 11.4 is affected. The issue involves the "Siri" component.

The install-chef-suse.sh script shipped with crowbar before 2012-10-02 is creating files containing confidential data wi

In the Bouncy Castle JCE Provider version 1.55 and earlier the other party DH public key is not fully validated. This ca

An exploitable file write vulnerability exists in the memory module functionality of Allen Bradley Micrologix 1400 Serie

The package `node-cli` before 1.0.0 insecurely uses the lock_file and log_file. Both of these are temporary, but it allo

Prior to 2018-04-27, the reprompt feature in Amazon Echo devices could be misused by a custom Alexa skill. The reprompt

IBM Security Guardium Big Data Intelligence (SonarG) 3.1 stores sensitive information in URL parameters. This may lead t

In ATI Systems Emergency Mass Notification Systems (HPSS16, HPSS32, MHPSS, and ALERT4000) devices, a missing encryption

In ATI Systems Emergency Mass Notification Systems (HPSS16, HPSS32, MHPSS, and ALERT4000) devices, an improper authentic

Cross-Site Scripting (XSS) vulnerability in the web interface in McAfee Network Security Management (NSM) before 8.2.7.4

procps-ng before version 3.3.15 is vulnerable to a denial of service in ps via mmap buffer overflow. Inbuilt protection

Schneider Electric Ampla MES 6.4 provides capability to configure users and their privileges. When Ampla MES users are c

Jenkins before versions 2.44, 2.32.2 is vulnerable to a user data leak in disconnected agents' config.xml API. This coul

jenkins before versions 2.44, 2.32.2 is vulnerable to an improper blacklisting of the Pipeline metadata files in the age

Linux kernel vhost since version 4.8 does not properly initialize memory in messages passed between virtual guests and t

In Android before the 2018-05-05 security patch level, NVIDIA Media Server contains an out-of-bounds read (due to improp

SAP Enterprise Financial Services (SAPSCORE 1.11, 1.12; S4CORE 1.01, 1.02; EA-FINSERV 6.04, 6.05, 6.06, 6.16, 6.17, 6.18

Automatic Bug Reporting Tool (ABRT) before 2.1.6 allows local users to obtain sensitive information about arbitrary file

Huawei DP300 V500R002C00, RP200 V600R006C00, TE30 V100R001C10, V500R002C00, V600R006C00, TE40 V500R002C00, V600R006C00,

389-ds-base before version 1.3.6 is vulnerable to an improperly NULL terminated array in the uniqueness_entry_to_config(

In CMS Made Simple (CMSMS) through 2.2.7, the "file move" operation in the admin dashboard contains an arbitrary file mo

NetIQ Identity Reporting, in versions prior to 5.5 Service Pack 1, is susceptible to an XSS attack.

mc-admin/post-edit.php in MiniCMS 1.10 allows full path disclosure via a modified id field.

mc-admin/post.php in MiniCMS 1.10 allows remote attackers to obtain a directory listing of the top-level directory of th

Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions th

Vulnerability in the Hardware Management Pack component of Oracle Sun Systems Products Suite (subcomponent: Ipmitool). T

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Security). Supported versions