2018

An issue was discovered in GitLab Community Edition (CE) and Enterprise Edition (EE) before 10.5.8, 10.6.x before 10.6.5

An issue was discovered in the MULTIDOTS Woo Checkout for Digital Goods plugin 2.1 for WordPress. If an admin user can b

An issue was discovered in the MULTIDOTS Add Social Share Messenger Buttons Whatsapp and Viber plugin 1.0.8 for WordPres

Rondaful M1 Wristband Smart Band 1 devices allow remote attackers to send an arbitrary number of call or SMS notificatio

Bitty is a development web server tool that functions similar to `python -m SimpleHTTPServer`. Version 0.2.10 has a dire

Since "algorithm" isn't enforced in jwt.decode()in jwt-simple 0.3.0 and earlier, a malicious user could choose what algo

Sails is an MVC style framework for building realtime web applications. Version 0.12.7 and lower have an issue with the

Arbitrary code execution is possible in reduce-css-calc node module <=1.2.4 through crafted css. This makes cross sites

Nunjucks is a full featured templating engine for JavaScript. Versions 2.4.2 and lower have a cross site scripting (XSS)

uws is a WebSocket server library. By sending a 256mb websocket message to a uws server instance with permessage-deflate

call is an HTTP router that is primarily used by the hapi framework. There exists a bug in call versions 2.0.1-3.0.1 tha

backbone is a module that adds in structure to a JavaScript heavy application through key-value pairs and custom events

engine.io-client is the client for engine.io, the implementation of a transport-based cross-browser/cross-device bi-dire

csrf-lite is a cross-site request forgery protection library for framework-less node sites. csrf-lite uses `===`, a fail

electron-packager is a command line tool that packages Electron source code into `.app` and `.exe` packages. along with

marked is an application that is meant to parse and compile markdown. Due to the way that marked 0.3.5 and earlier parse

The airbrake module 0.3.8 and earlier defaults to sending environment variables over HTTP. Environment variables can oft

restafary is a REpresentful State Transfer API for Creating, Reading, Using, Deleting files on a server from the web. Re

secure-compare 3.0.0 and below do not actually compare two strings properly. compare was actually comparing the first ar

Hapi versions less than 11.0.0 implement CORS incorrectly and allowed for configurations that at best returned inconsist

Certain input when passed into remarkable before 1.4.1 will bypass the bad protocol check that disallows the javascript:

Sinatra before 2.0.2 has XSS via the 400 Bad Request page that occurs upon a params parser exception.

The 'systemui/settings_network.php' and 'systemui/settings_patching.php' scripts in the Quest KACE System Management App

The 'checksum' parameter of the '/common/download_attachment.php' script in the Quest KACE System Management Appliance 8

The 'fmt' parameter of the '/common/run_cross_report.php' script in the the Quest KACE System Management Appliance 8.0.3

Espruino before 1.99 allows attackers to cause a denial of service (application crash) with a user crafted input file vi

Espruino before 1.99 allows attackers to cause a denial of service (application crash) with a user crafted input file vi

Espruino before 1.99 allows attackers to cause a denial of service (application crash) with a user crafted input file vi

Espruino before 1.98 allows attackers to cause a denial of service (application crash) with a user crafted input file vi

Espruino before 1.98 allows attackers to cause a denial of service (application crash) with a user crafted input file vi

Espruino before 1.99 allows attackers to cause a denial of service (application crash) with a user crafted input file vi

In stroke_socket.c in strongSwan before 5.6.3, a missing packet length check could allow a buffer underflow, which may l

The Head Unit HU_NBT (aka Infotainment) component on BMW i Series, BMW X Series, BMW 3 Series, BMW 5 Series, and BMW 7 S

The Head Unit HU_NBT (aka Infotainment) component on BMW i Series, BMW X Series, BMW 3 Series, BMW 5 Series, and BMW 7 S

SeaCMS 6.61 has stored XSS in admin_collect.php via the siteurl parameter.

An issue was discovered in mass-pages-posts-creator.php in the MULTIDOTS Mass Pages/Posts Creator plugin 1.2.2 for WordP

class-woo-banner-management.php in the MULTIDOTS WooCommerce Category Banner Management plugin 1.1.0 for WordPress has a

GifIndexToTrueColor in ngiflib.c in MiniUPnP ngiflib 0.4 has a Segmentation fault.

ClipperCMS 1.3.3 has XSS in the "Module name" field in a "Modules -> Manage modules -> edit" action to the manager/ URI.

Reflected XSS is possible in the GamePlan theme through 1.5.13.2 for WordPress because of insufficient input sanitizatio

In Stealth Authorization Server before 3.3.017.0 in Unisys Stealth Solution, an encryption key may be left in memory.

Mahara 17.04 before 17.04.8 and 17.10 before 17.10.5 and 18.04 before 18.04.1 are vulnerable to mentioning the usernames

An issue was discovered on Vgate iCar 2 Wi-Fi OBD2 Dongle devices. The data packets that are sent between the iOS or And

Zimbra Web Client (ZWC) in Zimbra Collaboration Suite 8.8 before 8.8.8.Patch4 and 8.7 before 8.7.11.Patch4 has Persisten

NULL pointer dereference vulnerability in the rebuild_vlists function in lib/dotgen/conc.c in the dotgen library in Grap

An issue was discovered in MISP 2.4.91. A vulnerability in app/View/Elements/eventattribute.ctp allows reflected XSS if

SchedMD Slurm before 17.02.11 and 17.1x.x before 17.11.7 mishandles user names (aka user_name fields) and group ids (aka

The TagLib::Ogg::FLAC::File::scan function in oggflacfile.cpp in TagLib 1.11.1 allows remote attackers to cause informat

The mobi_reconstruct_parts function in parse_rawml.c in Libmobi 0.3 allows remote attackers to cause information disclos

The buffer_addraw function in buffer.c in Libmobi 0.3 allows remote attackers to cause information disclosure (heap-base