2018

IBM Security Identity Governance and Intelligence 5.2.3.2 and 5.2.4 is vulnerable to SQL injection. A remote attacker co

Multiple I-O DATA network camera products (TS-WRLP firmware Ver.1.09.04 and earlier, TS-WRLA firmware Ver.1.09.04 and ea

Multiple I-O DATA network camera products (TS-WRLP firmware Ver.1.09.04 and earlier, TS-WRLA firmware Ver.1.09.04 and ea

Input validation issue in EC-CUBE Payment Module (2.12) version 3.5.23 and earlier, EC-CUBE Payment Module (2.11) versio

The LINE MUSIC for Android version 3.1.0 to versions prior to 3.6.5 does not verify X.509 certificates from SSL servers,

Untrusted search path vulnerability in the installers of multiple Canon IT Solutions Inc. software programs (ESET Smart

Untrusted search path vulnerability in installer of ChatWork Desktop App for Windows 2.3.0 and earlier allows an attacke

Cross-site request forgery (CSRF) vulnerability in WL-330NUL Firmware version prior to 3.0.0.46 allows remote attackers

Untrusted search path vulnerability in Multiple Yayoi 17 Series products (Yayoi Kaikei 17 Series Ver.23.1.1 and earlier,

Untrusted search path vulnerability in Multiple Yayoi 17 Series products (Yayoi Kaikei 17 Series Ver.23.1.1 and earlier,

The admin backend in phpMyFAQ before 2.9.11 allows CSV injection in reports.

phpMyFAQ before 2.9.11 allows CSRF.

The Pulse Secure Desktop (macOS) has a Privilege Escalation Vulnerability.

The Linux kernel, versions 3.9+, is vulnerable to a denial of service attack with low rates of specially modified packet

KOHA Library System version 16.11.x (up until 16.11.13) and 17.05.x (up until 17.05.05) contains a Cross Site Request Fo

In Ice Qube Thermal Management Center versions prior to version 4.13, the web application does not properly authenticate

TOCK version prior to commit 42f7f36e74088036068d62253e1d8fb26605feed. For example dfde28196cd12071fcf6669f7654be7df482b

LimeSurvey version 3.14.4 and earlier contains a directory traversal in file upload that allows upload of webshell vulne

LimeSurvey version prior to 3.14.4 contains a file upload vulnerability in upload functionality that can result in an at

An issue was discovered in Nibbleblog v4.0.5. With an admin's username and password, an attacker can execute arbitrary P

WordPress version 4.9.8 and earlier contains a CWE-20 Input Validation vulnerability in thumbnail processing that can re

IBM WebSphere Application Server 7.0, 8.0, and 8.5.5 installations using Form Login could allow a remote attacker to con

An issue was discovered in Artifex Ghostscript before 9.24. The .setdistillerkeys PostScript command is accepted even th

An out of bound write can occur when patching an Openshift object using the 'oc patch' functionality in OpenShift Contai

A vulnerability was discovered in 389-ds-base through versions 1.3.7.10, 1.3.8.8 and 1.4.0.16. The lock controlling the

In all Android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the Linux kernel, radio_id is

WordPress version <4.9 contains a CWE-20 Input Validation vulnerability in thumbnail processing that can result in remot

MicroPyramid Django-CRM 0.2 allows CSRF for /users/create/, /users/##/edit/, and /accounts/##/delete/ URIs.

An "Out-of-band resource load" issue was discovered on Xiaomi MIWiFi Xiaomi_55DD Version 2.8.50 devices. It is possible

The web management console of Opsview Monitor 5.4.x before 5.4.2 provides functionality accessible by an authenticated a

The /etc/init.d/opsview-reporting-module script that runs at boot time in Opsview Monitor before 5.3.1 and 5.4.x before

An issue was discovered in BTITeam XBTIT. Due to a lack of cross-site request forgery protection, it is possible to auto

VIVOTEK FD8177 devices before XXXXXX-VVTK-xx06a allow remote attackers to execute arbitrary code (issue 2 of 2) via even

VIVOTEK FD8177 devices before XXXXXX-VVTK-xx06a allow remote attackers to execute arbitrary code (issue 1 of 2) via the

VIVOTEK FD8177 devices before XXXXXX-VVTK-xx06a allow CSRF.

Gxlcms 2.0 before bug fix 20180915 has SQL Injection exploitable by an administrator.

Kaizen Asset Manager (Enterprise Edition) and Training Manager (Enterprise Edition) allow a remote attacker to achieve a

curl before version 7.61.1 is vulnerable to a buffer overrun in the NTLM authentication code. The internal function Curl

In Artifex Ghostscript before 9.24, gssetresolution and gsgetresolution allow attackers to have an unspecified impact.

In Artifex Ghostscript before 9.24, attackers able to supply crafted PostScript files to the builtin PDF14 converter cou

In Artifex Ghostscript before 9.24, attackers able to supply crafted PostScript files could use a type confusion in the

An issue was discovered in Artifex Ghostscript before 9.24. A type confusion in "ztype" could be used by remote attacker

An issue was discovered in Artifex Ghostscript before 9.24. Incorrect exec stack handling in the "CS" and "SC" PDF primi

An issue was discovered in Artifex Ghostscript before 9.24. Incorrect "restoration of privilege" checking during handlin

In FreeBSD before 11.1-STABLE, 11.2-RELEASE-p2, 11.1-RELEASE-p13, ip fragment reassembly code is vulnerable to a denial

The irda_setsockopt function in net/irda/af_irda.c and later in drivers/staging/irda/net/af_irda.c in the Linux kernel b

In Huawei HiRouter-CD20-10 with the versions before 1.9.6 and WS5200-10 with the versions before 1.9.6, there is a plug-

In Android for MSM, Firefox OS for MSM, and QRD Android with all Android releases from CAF using the Linux kernel while

A flaw was found in RPC request using gfs2_create_req in glusterfs server. An authenticated attacker could use this flaw

A flaw was found in RPC request using gfs3_symlink_req in glusterfs server which allows symlink destinations to point to