2018

Some Huawei products RSE6500 V500R002C00; SoftCo V200R003C20SPCb00; VP9660 V600R006C10; eSpace U1981 V100R001C20; V200R0

IBM Sterling B2B Integrator Standard Edition 5.2.0.1 - 5.2.6.3 is vulnerable to cross-site scripting. This vulnerability

IBM API Connect 5.0.0.0-5.0.8.3 Developer Portal does not enforce Two Factor Authentication (TFA) while resetting a user

There is a stored Cross-Site Scripting vulnerability in Open Graph meta properties read by the `metascrape` npm module <

prosody before versions 0.10.2, 0.9.14 is vulnerable to an Authentication Bypass. Prosody did not verify that the virtua

A flaw was found in the Linux kernel's ext4 filesystem. A local user can cause an out-of-bounds write in jbd2_journal_di

A flaw was found in the Linux kernel before version 4.12 in the way the KVM module processed the trap flag(TF) bit in EF

A cross-site scripting (XSS) flaw was found in how the failed action entry is processed in Red Hat Satellite before vers

system/edit_book.php in XYCMS 1.7 has stored XSS via a crafted add_do.php request, related to add_book.php.

An issue was discovered in mspack/chmd.c in libmspack before 0.7alpha. It does not reject blank CHM filenames.

An issue was discovered in mspack/chmd.c in libmspack before 0.7alpha. There is an off-by-one error in the CHM PMGI/PMGL

ARM mbed TLS before 2.12.0, before 2.7.5, and before 2.1.14 allows local users to achieve partial plaintext recovery (fo

ARM mbed TLS before 2.12.0, before 2.7.5, and before 2.1.14 allows remote attackers to achieve partial plaintext recover

A heap buffer overflow flaw was found in QEMU's Cirrus CLGD 54xx VGA emulator's VNC display driver support before 2.9; t

It was found that jenkins-ssh-slaves-plugin before version 1.15 did not perform host key verification, thereby enabling

Privilege escalation flaws were found in the Red Hat initialization scripts of PostgreSQL. An attacker with access to th

An out-of-bounds memory access issue was found in Quick Emulator (QEMU) before 1.7.2 in the VNC display driver. This fla

A logic error in valid_role() in CloudForms role validation before 5.7.1.3 could allow a tenant administrator to create

curl before 7.53.0 has an incorrect TLS Certificate Status Request extension feature that asks for a fresh proof of the

It was discovered that libICE before 1.0.9-8 used a weak entropy to generate keys. A local attacker could potentially us

Quick emulator (QEMU) before 2.8 built with the Cirrus CLGD 54xx VGA Emulator support is vulnerable to an out-of-bounds

A flaw was found in the Linux kernel's handling of clearing SELinux attributes on /proc/pid/attr files before 4.9.10. An

A race condition was found in util-linux before 2.32.1 in the way su handled the management of child processes. A local

A flaw was found in the Linux kernel's ext4 filesystem. A local user can cause an out-of-bound write in in fs/jbd2/trans

JBoss BRMS 6 and BPM Suite 6 before 6.4.3 are vulnerable to a reflected XSS via artifact upload. A malformed XML file, i

JBoss BRMS 6 and BPM Suite 6 before 6.4.3 are vulnerable to a stored XSS via several lists in Business Central. The flaw

A number of unused delete routes are present in CloudForms before 5.7.2.1 which can be accessed via GET requests instead

A stack buffer overflow flaw was found in the Quick Emulator (QEMU) before 2.9 built with the Network Block Device (NBD)

It was discovered that libXdmcp before 1.1.2 including used weak entropy to generate session keys. On a multi-user syste

It was found that xorg-x11-server before 1.19.0 including uses memcmp() to check the received MIT cookie against a serie

It was discovered that rpm-ostree and rpm-ostree-client before 2017.3 fail to properly check GPG signatures on packages

An access-control flaw was found in the OpenStack Orchestration (heat) service before 8.0.0, 6.1.0 and 7.0.2 where a ser

When updating a password in the rhvm database the ovirt-aaa-jdbc-tool tools before 1.1.3 fail to correctly check for the

An out-of-bounds write vulnerability was found in netpbm before 10.61. A maliciously crafted file could cause the applic

An out-of-bounds write vulnerability was found in netpbm before 10.61. A maliciously crafted file could cause the applic

The Network Block Device (NBD) server in Quick Emulator (QEMU) before 2.11 is vulnerable to a denial of service issue. I

It was found that sssd's sysdb_search_user_by_upn_res() function before 1.16.0 did not sanitize requests when querying i

The dialog for creating cloud volumes (cinder provider) in CloudForms does not filter cloud tenants by user. An attacker

A flaw was found in CloudForms before 5.9.0.22 in the self-service UI snapshot feature where the name field is not prope

A flaw was found in all Openshift Enterprise versions using the openshift elasticsearch plugin. An attacker with knowled

WildFly Core before version 6.0.0.Alpha3 does not properly validate file paths in .war archives, allowing for the extrac

It was discovered in Undertow that the code that parsed the HTTP request line permitted invalid characters. This could b

Authentication Bypass vulnerability in TPM autoboot in McAfee Drive Encryption (MDE) 7.1.0 and above allows physically p

It was found that spacewalk-channel can be used by a non-admin user or disabled users to perform administrative tasks du

It was found that CloudForms does not verify that the server hostname matches the domain name in the certificate when us

An accessibility flaw was found in the OpenStack Workflow (mistral) service where a service log directory was improperly

An issue was discovered in the Linux kernel through 4.17.10. There is a NULL pointer dereference and panic in hfsplus_lo

An issue was discovered in the Linux kernel through 4.17.10. There is a NULL pointer dereference in fscrypt_do_page_cryp

An issue was discovered in the Linux kernel through 4.17.10. There is a buffer overflow in truncate_inline_inode() in fs

An issue was discovered in the Linux kernel through 4.17.10. There is an out-of-bounds access in __remove_dirty_segment(