2018

Vulnerability in the MICROS Retail-J component of Oracle Retail Applications (subcomponent: Database). Supported version

An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. imap/util.c mishandles ".." directory trave

IBM QRadar Incident Forensics (IBM QRadar SIEM 7.2, and 7.3) could allow a remote attacker to bypass authentication and

GNU Libextractor before 1.7 contains an infinite loop vulnerability in EXTRACTOR_mpeg_extract_method (mpeg_extractor.c).

Abuse of Functionality vulnerability in the web interface in McAfee Network Security Management (NSM) 9.1.7.11 and earli

In HTSlib 1.8, a race condition in cram/cram_io.c might allow local users to overwrite arbitrary files via a symlink att

Multiple Persistent cross-site scripting (XSS) issues in the Techotronic all-in-one-favicon (aka All In One Favicon) plu

git-annex is vulnerable to a private data exposure and exfiltration attack. It could expose the content of files located

Linux kernel is vulnerable to a heap-based buffer overflow in the fs/ext4/xattr.c:ext4_xattr_set_entry() function. An at

A Cross-site Scripting (XSS) vulnerability in Fortinet FortiManager 6.0.0, 5.6.4 and below versions, FortiAnalyzer 6.0.0

The OpenShift image import whitelist failed to enforce restrictions correctly when running commands such as "oc tag", fo

git-annex is vulnerable to an Information Exposure when decrypting files. A malicious server for a special remote could

Norton App Lock prior to v1.3.0.332 can be susceptible to a bypass exploit. In this type of circumstance, the exploit ca

A vulnerability in the detection engine of Cisco FireSIGHT System Software could allow an unauthenticated, remote attack

A vulnerability in the web-based management interface of Cisco Web Security Appliance (WSA) could allow an unauthenticat

ClamAV before 0.100.1 has an HWP integer overflow with a resultant infinite loop via a crafted Hangul Word Processor fil

The websites that were built from Zeta Producer Desktop CMS before 14.2.1 are vulnerable to unauthenticated file disclos

X File Explorer (aka xfe) might allow local users to bypass intended access restrictions and gain access to arbitrary fi

The NotificationRepresentationFactoryImpl class in Atlassian Universal Plugin Manager before version 2.22.9 allows remot

The IncomingMailServers resource in Atlassian JIRA Server before version 7.6.7, from version 7.7.0 before version 7.7.5,

In curl and libcurl 7.52.0 to and including 7.53.1, libcurl would attempt to resume a TLS session even if the client cer

It was found that the REST API in Infinispan before version 9.0.0 did not properly enforce auth constraints. An attacker

ZNC before 1.7.1-rc1 is prone to a path traversal flaw via ../ in a web skin name to access files outside of the intende

ZNC before 1.7.1-rc1 does not properly validate untrusted lines coming from the network, allowing a non-admin user to es

The Fibre Channel over Ethernet (FCoE) feature in IBM System Networking and Blade Network Technology (BNT) switches runn

Accellion FTP server prior to version FTA_9_12_220 uses the Accusoft Prizm Content flash component, which contains multi

Accellion FTP server prior to version FTA_9_12_220 only returns the username in the server response if the username is i

Hughes high-performance broadband satellite modems, models HN7740S DW7000 HN7000S/SM, lacks authentication. An unauthent

Hughes high-performance broadband satellite modems, models HN7740S DW7000 HN7000S/SM, are potentially vulnerable to impr

The code generated by PHP FormMail Generator prior to 17 December 2016 is vulnerable to stored cross-site scripting. In

ManageEngine Applications Manager 12 and 13 before build 13690 allows an authenticated user, who is able to access /regi

The Zizai Tech Nut device allows unauthenticated Bluetooth pairing, which enables unauthenticated connected applications

A captured MAC/device ID of an iTrack Easy can be registered under multiple user accounts allowing access to getgps GPS

The 8840 Clinician Programmer executes the application program from the 8870 Application Card. An attacker with physical

RSA Identity Lifecycle and Governance versions 7.0.1, 7.0.2 and 7.1.0 contains a reflected cross-site scripting vulnerab

In MicroWorld eScan Internet Security Suite (ISS) for Business 14.0.1400.2029, the driver econceal.sys allows a non-priv

For the Lenovo Smart Assistant Android app versions earlier than 12.1.82, an attacker with physical access to the smart

An issue has been found in libwav through 2017-04-20. It is a SEGV in the function apply_gain in wav_gain/wav_gain.c.

An issue has been found in libwav through 2017-04-20. It is a SEGV in the function wav_free in libwav.c.

An issue has been found in libwav through 2017-04-20. It is a SEGV in the function print_info in wav_info/wav_info.c.

An issue has been found in libpng 1.6.34. It is a SEGV in the function png_free_data in png.c, related to the recommende

An issue has been found in PNGwriter 0.7.0. It is a SEGV in pngwriter::readfromfile in pngwriter.cc. NOTE: there is a "W

IBM Security Identity Governance and Intelligence Virtual Appliance 5.2 through 5.2.3.2 could allow a remote attacker to

In Bootstrap before 4.1.2, XSS is possible in the data-container property of tooltip.

In Bootstrap before 4.1.2, XSS is possible in the data-target property of scrollspy.

In Bootstrap before 4.1.2, XSS is possible in the collapse data-parent attribute.

Directory Traversal with ../ sequences occurs in AccountsService before 0.6.50 because of an insufficient path check in

The r_bin_java_annotation_new function in shlr/java/class.c in radare2 2.7.0 allows remote attackers to cause a denial o

The r_bin_mdmp_init_directory_entry function in mdmp.c in radare2 2.7.0 allows remote attackers to cause a denial of ser

The sdb_set_internal function in sdb.c in radare2 2.7.0 allows remote attackers to cause a denial of service (invalid re