2018

A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka "Microsoft E

An information disclosure vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objec

A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, aka "Internet

An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in

An elevation of privilege vulnerability exists when Microsoft Exchange Outlook Web Access (OWA) fails to properly handle

A remote code execution vulnerability exists in the way that Microsoft Graphics Components handle objects in memory, aka

An information disclosure vulnerability exists in the way that Microsoft Graphics Components handle objects in memory, a

A remote code execution vulnerability exists in the Microsoft JET Database Engine, aka "Microsoft JET Database Engine Re

A remote code execution vulnerability exists when "Windows Theme API" does not properly decompress files, aka "Windows T

An elevation of privilege vulnerability exists when NTFS improperly checks access, aka "NTFS Elevation of Privilege Vuln

An Elevation of Privilege vulnerability exists in Filter Manager when it improperly handles objects in memory, aka "Micr

An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka "Window

An Elevation of Privilege vulnerability exists in Windows Subsystem for Linux when it fails to properly handle objects i

A security feature bypass vulnerability exists in DNS Global Blocklist feature, aka "Windows DNS Security Feature Bypass

An information disclosure vulnerability exists in .NET Core when authentication information is inadvertently exposed in

A remote code execution vulnerability exists in the way Microsoft Exchange software parses specially crafted email messa

In the client in Bytom before 1.0.6, checkTopicRegister in p2p/discover/net.go does not prevent negative idx values, lea

The QLogic 4Gb Fibre Channel 5.5.2.6.0 and 4/8Gb SAN 7.10.1.20.0 modules for IBM BladeCenter have an undocumented suppor

qibosoft V7.0 allows CSRF via admin/index.php?lfj=member&action=addmember to add a user account.

Code injection in the /ui/login form Language parameter in Epicentro E_7.3.2+ allows attackers to execute JavaScript cod

Buffer Overflow in httpd in EpiCentro E_7.3.2+ allows attackers to cause a denial of service attack remotely via a speci

Buffer Overflow in httpd in EpiCentro E_7.3.2+ allows attackers to execute code remotely via a specially crafted GET req

There is a SQL injection in Benutzerverwaltung in REDAXO before 5.6.4.

Mediamanager in REDAXO before 5.6.4 has XSS.

The $opener_input_field variable in addons/mediapool/pages/index.php in REDAXO 5.6.3 is not effectively filtered and is

qemu_deliver_packet_iov in net/net.c in Qemu accepts packet sizes greater than INT_MAX, which allows attackers to cause

Qemu has a Buffer Overflow in pcnet_receive in hw/net/pcnet.c because an incorrect integer data type is used.

Qemu has a Buffer Overflow in rtl8139_do_receive in hw/net/rtl8139.c because an incorrect integer data type is used.

Multiple cross-site scripting (XSS) vulnerabilities in includes/core/um-actions-login.php in the "Ultimate Member - User

In Apache Tika 1.19 (CVE-2018-11761), we added an entity expansion limit for XML parsing. However, Tika reuses SAXParser

An issue was discovered in Joomla! before 3.8.13. Inadequate checks in com_contact could allow mail submission in disabl

An issue was discovered in Joomla! before 3.8.13. com_installer actions do not have sufficient CSRF hardening in the bac

An issue was discovered in Joomla! before 3.8.13. Inadequate checks on the tags search fields can lead to an access leve

An issue was discovered in Joomla! before 3.8.13. com_joomlaupdate allows the execution of arbitrary code. The default A

An issue was discovered in Joomla! before 3.8.13. If an attacker gets access to the mail account of an user who can appr

An XXE vulnerability in LeviStudioU, Versions 1.8.29 and 1.8.44 can be exploited when the application processes speciall

An out-of-bounds vulnerability in LeviStudioU, Versions 1.8.29 and 1.8.44 can be exploited when the application processe

VMware ESXi (6.7, 6.5, 6.0), Workstation (15.x and 14.x) and Fusion (11.x and 10.x) contain a denial-of-service vulnerab

An issue was discovered in libgig 4.1.0. There is an operator new[] failure (due to a big pSampleLoops heap request) in

An issue was discovered in libgig 4.1.0. There is a heap-based buffer over-read in RIFF::List::GetListTypeString in RIFF

An issue was discovered in libgig 4.1.0. There is an FPE (divide-by-zero error) in DLS::Sample::Sample in DLS.cpp.

An issue was discovered in libgig 4.1.0. There is a heap-based buffer over-read in DLS::Region::GetSample() in DLS.cpp.

An issue was discovered in libgig 4.1.0. There is operator new[] failure (due to a big pWavePoolTable heap request) in D

An issue was discovered in libgig 4.1.0. There is a NULL pointer dereference in the function DLS::File::GetFirstSample()

Cross-site request forgery (CSRF) vulnerability in /admin.php?c=member&m=edit&uid=1 in dayrui FineCms 5.4 allows remote

An issue was discovered in GoPro gpmf-parser before 1.2.1. There is a divide-by-zero error in GPMF_ScaledData in GPMF_pa

OpenJPEG 2.3.0 has a NULL pointer dereference for "red" in the imagetopnm function of jp2/convert.c

The Bixie Portfolio plugin 1.2.0 for Pagekit has XSS: a logged-in user who has the "Manage portfolio" privilege can inje

EmpireCMS v7.5 has an arbitrary file upload vulnerability in the LoadInMod function in e/class/moddofun.php, exploitable

An issue was discovered in DuomiCMS 3.0. SQL injection exists in the ajax.php file, as demonstrated by the uid parameter