2018

Authorized users of the openbuildservice before 2.9.4 could delete packages by using a malicious request against project

openSUSE openbuildservice before 9.2.4 allowed authenticated users to delete packages on specific projects with project

Out-of-bounds read condition in older versions of some Intel Graphics Driver for Windows code branches allows local user

It has been discovered that lftp up to and including version 4.8.3 does not properly sanitize remote file names, leading

It was found that the JMX endpoint of Red Hat JBoss Fuse 6, and Red Hat A-MQ 6 deserializes the credentials passed to it

A privilege escalation vulnerability was found in nagios 4.2.x that occurs in daemon-init.in when creating necessary fil

JBoss BRMS 6 and BPM Suite 6 are vulnerable to a stored XSS via business process editor. The flaw is due to an incomplet

An exposure of sensitive information vulnerability exists in Jenkins Tinfoil Security Plugin 1.6.1 and earlier in Tinfoi

A server-side request forgery vulnerability exists in Jenkins Confluence Publisher Plugin 2.0.1 and earlier in Confluenc

A confused deputy vulnerability exists in Jenkins Publisher Over CIFS Plugin 0.10 and earlier in CifsPublisherPluginDesc

A data modification vulnerability exists in Jenkins Resource Disposer Plugin 0.11 and earlier in AsyncResourceDisposer.j

An exposure of sensitive information vulnerability exists in Jenkins SSH Agent Plugin 1.15 and earlier in SSHAgentStepEx

An exposure of sensitive information vulnerability exists in Jenkins Anchore Container Image Scanner Plugin 10.16 and ea

A data modification vulnerability exists in Jenkins Agiletestware Pangolin Connector for TestRail Plugin 2.1 and earlier

An exposure of sensitive information vulnerability exists in Jenkins meliora-testlab Plugin 1.14 and earlier in TestlabN

An exposure of sensitive information vulnerability exists in Jenkins Maven Artifact ChoiceListProvider (Nexus) Plugin 1.

A cross-site scripting vulnerability exists in Jenkins Shelve Project Plugin 1.5 and earlier in ShelveProjectAction/inde

A server-side request forgery vulnerability exists in Jenkins TraceTronic ECU-TEST Plugin 2.3 and earlier in ATXPublishe

It was found that foreman before 1.13.0 is vulnerable to a stored XSS via an organization or location name. This could a

A local information disclosure issue was found in dracut before 045 when generating initramfs images with world-readable

It was found that Diffie Hellman Client key exchange handling in NSS 3.21.x was vulnerable to small subgroup confinement

A vulnerability was found in foreman 1.14.0. When creating an organization or location in Foreman, if the name contains

Click Studios Passwordstate before 8.3 Build 8397 allows XSS by authenticated users via an uploaded HTML document.

tss_alloc in sys/arch/i386/i386/gdt.c in OpenBSD 6.2 and 6.3 has a Local Denial of Service (system crash) due to incorre

An out-of-bounds read vulnerability was found in OpenJPEG 2.1.2, in the j2k_to_image tool. Converting a specially crafte

curl before version 7.51.0 uses outdated IDNA 2003 standard to handle International Domain Names and this may lead users

The 'globbing' feature in curl before version 7.51.0 has a flaw that leads to integer overflow and out-of-bounds read vi

The function `read_data()` in security.c in curl before version 7.51.0 is vulnerable to memory double free.

A flaw was found in curl before version 7.51. If cookie state is written into a cookie jar file that is later read back

The `curl_getdate` function in curl before version 7.51.0 is vulnerable to an out of bounds read if it receives an input

curl before version 7.51.0 doesn't parse the authority component of the URL correctly when the host name part ends with

The libcurl API function called `curl_maprintf()` before version 7.51.0 can be tricked into doing a double-free due to a

A flaw was found in Ansible before version 2.2.0. The apt_key module does not properly verify key fingerprints, allowing

This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader

This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader

This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader

This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader

The OpenShift Enterprise 3 router does not properly sort routes when processing newly added routes. An attacker with acc

A flaw was found in foreman 1.5.1. The remote execution plugin runs commands on hosts over SSH from the Foreman web UI.

A vulnerability was found in Openstack Glance. No limits are enforced within the Glance image service for both v1 and v2

A flaw was found in Red Hat Ceph before 0.94.9-8. The way Ceph Object Gateway handles POST object requests permits an au

Martem TELEM GW6 and GWM devices with firmware 2018.04.18-linux_4-01-601cb47 and prior allow improper sanitization of da

NetApp OnCommand Insight version 7.3.0 and versions prior to 7.2.0 are susceptible to clickjacking attacks which could c

Mdapt Driver of Huawei MediaPad M3 BTV-W09C128B353CUSTC128D001; Mate 9 Pro versions earlier than 8.0.0.356(C00); P10 Plu

Some Huawei mobile phone with the versions before BLA-L29 8.0.0.145(C432) have a denial of service (DoS) vulnerability b

In the Federation component of OpenStack Keystone before 11.0.4, 12.0.0, and 13.0.0, an authenticated "GET /v3/OS-FEDERA

Persistent Cross-Site Scripting (XSS) vulnerability in the "Categories" feature in SeedDMS (formerly LetoDMS and MyDMS)

Cross-Site Scripting (XSS) vulnerability in every page that includes the "action" URL parameter in SeedDMS (formerly Let

A directory traversal flaw in SeedDMS (formerly LetoDMS and MyDMS) before 5.1.8 allows an authenticated attacker to writ

Because of insufficient authorization checks it is possible for any authenticated user to change profile data of other u