2018

In Apache Allura before 1.8.0, unauthenticated attackers may retrieve arbitrary files through the Allura web application

The uwsgi_expand_path function in core/utils.c in Unbit uWSGI through 2.0.15 has a stack-based buffer overflow via a lar

The secure_load function in gluon/utils.py in web2py before 2.14.2 uses pickle.loads to deserialize session information

web2py before 2.14.2 allows remote attackers to obtain the session_cookie_key value via a direct request to examples/sim

The sample web application in web2py before 2.14.2 might allow remote attackers to execute arbitrary code via vectors in

web2py before 2.14.1, when using the standalone version, allows remote attackers to obtain environment variable values v

In WordPress through 4.9.2, unauthenticated attackers can cause a denial of service (resource consumption) by using the

The htpasswd implementation of mini_httpd before v1.28 and of thttpd before v2.28 is affected by a buffer overflow that

A Server Side Request Forgery vulnerability exists in the install app process in Sandstorm before build 0.203. A remote

Sandstorm before build 0.203 allows remote attackers to read any specified file under /etc or /run via the sandbox backu

A remote attacker could bypass the Sandstorm organization restriction before build 0.203 via a comma in an email-address

The Supervisor in Sandstorm doesn't set and enforce the resource limits of a process. This allows remote attackers to ca

A buffer overflow vulnerability in "Add command" functionality exists in Flexense SyncBreeze Enterprise <= 10.3.14. The

tiki wiki cms groupware <=15.2 has a xss vulnerability, allow attackers steal user's cookie.

Ring (formerly DoorBot) video doorbells allow remote attackers to obtain sensitive information about the wireless networ

Cross-site scripting (XSS) vulnerability in assets/js/vm2admin.js in the VirtueMart component before 3.0.8 for Joomla! a

Cross-site scripting (XSS) vulnerability in Nagios Business Process Intelligence (BPI) before 2.3.4 allows remote attack

Docker before 1.3 does not properly validate image IDs, which allows remote attackers to redirect to another image throu

boot2docker 1.2 and earlier allows attackers to conduct cross-site request forgery (CSRF) attacks by leveraging Docker d

The Docker daemon managed by boot2docker 1.2 and earlier improperly enables unauthenticated TCP connections by default,

WebConsole Cross-Site Scripting in Kaspersky Secure Mail Gateway version 1.1.

Local Privilege Escalation in Kaspersky Secure Mail Gateway version 1.1.

Configuration file injection leading to Code Execution as Root in Kaspersky Secure Mail Gateway version 1.1.

Cross-site Request Forgery leading to Administrative account takeover in Kaspersky Secure Mail Gateway version 1.1.

A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could a

A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an

Z-BlogPHP 1.5.1 has CSRF via zb_users/plugin/AppCentre/app_del.php, as demonstrated by deleting files and directories.

A cross-site scripting (XSS) vulnerability in flickrRSS.php in the flickrRSS plugin 5.3.1 for WordPress allows remote at

A cross-site scripting (XSS) vulnerability in flickrRSS.php in the flickrRSS plugin 5.3.1 for WordPress allows remote at

The flickrRSS plugin 5.3.1 for WordPress has CSRF via wp-admin/options-general.php.

A cross-site scripting (XSS) vulnerability in flickrRSS.php in the flickrRSS plugin 5.3.1 for WordPress allows remote at

Apache CloudStack 4.1 to 4.8.1.0 and 4.9.0.0 contain an API call designed to allow a user to register for the developer

In Apache CloudStack 4.1.0 and 4.1.1, when calling the CloudStack API call listProjectAccounts as a regular, non-adminis

NVIDIA libnvmmlite_audio.so contains an elevation of privilege vulnerability when running in media server which may caus

NVIDIA libnvmmlite_audio.so contains an elevation of privilege vulnerability when running in media server which may caus

In versions 13.0.0, 12.0.0-12.1.3, or 11.6.0-11.6.2, an F5 BIG-IP virtual server using the URL categorization feature ma

The Grammarly extension before 2018-02-02 for Chrome allows remote attackers to discover authentication tokens via an 'a

West Wind Web Server 6.x does not require authentication for /ADMIN.ASP.

In the uncurl_ws_accept function in uncurl.c in uncurl before 0.07, as used in Parsec before 140-3, insufficient Origin

Information Leakage exists in the jLike 1.0 component for Joomla! via a task=getUserByCommentId request.

SQL Injection exists in the JSP Tickets 1.1 component for Joomla! via the ticketcode parameter in a ticketlist edit acti

SQL Injection exists in the Zh BaiduMap 3.0.0.1 component for Joomla! via the id parameter in a getPlacemarkDetails, get

SQL Injection exists in the Zh YandexMap 6.2.1.0 component for Joomla! via the id parameter in a task=getPlacemarkDetail

SQL Injection exists in the Zh GoogleMap 8.4.0.0 component for Joomla! via the id parameter in a getPlacemarkDetails, ge

System Manager in Avaya Aura before 7.1.2 does not properly use SSL in conjunction with authentication, which allows rem

In Micropoint proactive defense software 2.0.20266.0146, the driver file (mp110005.sys) allows local users to cause a de

In Micropoint proactive defense software 2.0.20266.0146, the driver file (mp110005.sys) allows local users to cause a de

In Micropoint proactive defense software 2.0.20266.0146, the driver file (mp110009.sys) allows local users to cause a de

In Micropoint proactive defense software 2.0.20266.0146, the driver file (mp110005.sys) allows local users to cause a de

In Micropoint proactive defense software 2.0.20266.0146, the driver file (mp110005.sys) allows local users to cause a de