2018

Buffer overflow in installer for Intel Extreme Tuning Utility before 6.4.1.21 may allow an authenticated user to potenti

Escalation of privilege in Installer for Intel Extreme Tuning Utility before 6.4.1.21 may allow an authenticated user to

Buffer overflow in input handling in Intel Extreme Tuning Utility before 6.4.1.21 may allow an authenticated user to pot

Pulse Secure Client 9.0R1 and 5.3RX before 5.3R5, when configured to authenticate VPN users during Windows Logon, can al

Pluck 4.7.7 allows XSS via an SVG file that contains Javascript in a SCRIPT element, and is uploaded via pages->manage u

feindura 2.0.7 allows XSS via the tags field of a new page created at index.php?category=0&page=new.

razorCMS 3.4.7 allows Stored XSS via the keywords of the homepage within the settings component.

razorCMS 3.4.7 allows HTML injection via the description of the homepage within the settings component.

D-Link DIR-600M devices allow XSS via the Hostname and Username fields in the Dynamic DNS Configuration page.

e107_admin/banlist.php in e107 2.1.8 allows SQL injection via the old_ip parameter.

In radare2 before 2.9.0, a heap overflow vulnerability exists in the read_module_referenced_functions function in libr/a

Huawei smart phones G9 Lite, Honor 5A, Honor 6X, Honor 8 with the versions before VNS-L53C605B120CUSTC605D103, the versi

Huawei B315s-22 products with software of 21.318.01.00.26 have an information leak vulnerability. Unauthenticated adjace

Some Huawei smart phones with software of Leland-AL00 8.0.0.114(C636), Leland-AL00A 8.0.0.171(C00) have a denial of serv

Incorrect access control in RDP Level 1 on STMicroelectronics STM32F0 series devices allows physically present attackers

IBM Datacap Fastdoc Capture 9.1.1, 9.1.3, and 9.1.4 could allow an authenticated user to bypass future authentication me

Inteno DG400 WU7U_ELION3.11.6-170614_1328 devices allow remote attackers to cause a denial of service (connectivity loss

The Subsonic Music Streamer application 4.4 for Android has Improper Certificate Validation of the Subsonic server certi

Dell EMC VPlex GeoSynchrony, versions prior to 6.1, contains an Insecure File Permissions vulnerability. A remote authen

RSA BSAFE Crypto-J versions prior to 6.2.4 and RSA BSAFE SSL-J versions prior to 6.2.4 contain a Covert Timing Channel v

RSA BSAFE SSL-J versions prior to 6.2.4 contain a Covert Timing Channel vulnerability during RSA decryption, also known

RSA BSAFE SSL-J versions prior to 6.2.4 contain a Heap Inspection vulnerability that could allow an attacker with physic

Pivotal Cloud Foundry Elastic Runtime version 1.4.0 through 1.4.5, 1.5.0 through 1.5.11 and 1.6.0 through 1.6.11 is vuln

A cross site scripting flaw exists in the tetonic-console component of Openshift Container Platform 3.11. An attacker wi

SAP WebDynpro Java, versions 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user-controlled inputs, resultin

SAP Business One Android application, version 1.2, does not verify the certificate properly for HTTPS connection. This a

Under certain conditions SAP Adaptive Server Enterprise, version 16.0, allows some privileged users to access informatio

The logon application of SAP NetWeaver AS Java 7.10 to 7.11, 7.20, 7.30, 7.31, 7.40, 7.50 does not sufficiently encode u

Tendrl API in Red Hat Gluster Storage before 3.4.0 does not immediately remove session tokens after a user logs out. Ses

It was found that URLResource.getLastModified() in Undertow closes the file descriptors only when they are finalized whi

A flaw was found in the 389 Directory Server that allows users to cause a crash in the LDAP server using ldapsearch with

The VMware Content Locker for iOS prior to 4.14 contains a data protection vulnerability in the SQLite database. This vu

The AirWatch Agent for iOS prior to 5.8.1 contains a data protection vulnerability whereby the files and keychain entrie

CSRF in the anti-csrf decorator in xunfeng 0.2.0 allows an attacker to modify the configuration via a Flash file because

Smarty before 3.1.33-dev-4 allows attackers to bypass the trusted_dir protection mechanism via a file:./../ substring in

An issue has been found in PowerDNS before 3.4.11 and 4.0.2, and PowerDNS recursor before 4.0.4, allowing an attacker in

An issue has been found in PowerDNS before 3.4.11 and 4.0.2, and PowerDNS recursor before 4.0.4, allowing an attacker in

An issue has been found in dnsdist before 1.2.0 in the way EDNS0 OPT records are handled when parsing responses from a b

An issue has been found in PowerDNS before 3.4.11 and 4.0.2, and PowerDNS recursor before 3.7.4 and 4.0.4, allowing a re

A flaw was found in the CloudForms API before 5.6.3.0, 5.7.3.1 and 5.8.1.2. A user with permissions to use the MiqReport

The hotrod java client in infinispan before 9.1.0.Final automatically deserializes bytearray message contents in certain

A Pektron Passive Keyless Entry and Start (PKES) system, as used on the Tesla Model S and possibly other vehicles, relie

In b3log Solo 2.9.3, XSS in the Input page under the Publish Articles menu, with an ID of linkAddress stored in the link

Live-migrated instances are briefly able to inspect traffic for other instances on the same hypervisor. This brief windo

When using the Linux bridge ml2 driver, non-privileged tenants are able to create and attach ports without specifying an

The OpenStack RabbitMQ container image insecurely retrieves the rabbitmq_clusterer component over HTTP during the build

An issue has been found in PowerDNS Authoritative Server before 3.4.11 and 4.0.2 allowing a remote, unauthenticated atta

A timing attack flaw was found in OpenSSL 1.0.1u and before that could allow a malicious user with local access to recov

Drools Workbench contains a path traversal vulnerability. The vulnerability allows a remote, authenticated attacker to b

foreman before version 1.15.0 is vulnerable to an information leak through organizations and locations feature. When a u