2018

Exiv2 0.26 has an integer overflow in the LoaderExifJpeg class in preview.cpp, leading to an out-of-bounds read in Exiv2

Exiv2 0.26 has integer overflows in LoaderTiff::getData() in preview.cpp, leading to an out-of-bounds read in Exiv2::Val

portfolioCMS 1.0.5 allows upload of arbitrary .php files via the admin/portfolio.php?newpage=true URI.

Buffer over flow can occur while processing a HTT_T2H_MSG_TYPE_TX_COMPL_IND message with an out-of-range num_msdus value

Due to a race condition in the QTEECOM driver in all Android releases from CAF (Android for MSM, Firefox OS for MSM, QRD

In the function wmi_set_ie(), the length validation code does not handle unsigned integer overflow properly. As a result

Early or late retirement of rotation requests can result in a Use After Free condition in all Android releases from CAF

In the video driver function set_output_buffers(), binfo can be accessed after being freed in a failure scenario in all

In the function wma_pdev_div_info_evt_handler() in all Android releases from CAF (Android for MSM, Firefox OS for MSM, Q

An arbitrary address write can occur if a compromised WLAN firmware sends incorrect data to WLAN driver in all Android r

Buffer overflow can occur due to improper input validation in multiple WMA event handler functions in all Android releas

In the WLAN driver in all Android releases from CAF (Android for MSM, Firefox OS for MSM, QRD Android) using the Linux K

improper validation of array index in WiFi driver function sapInterferenceRssiCount() leads to array out-of-bounds acces

While processing a DSP buffer in an audio driver's event handler, an index of a buffer is not checked before accessing t

In the KGSL driver in all Android releases from CAF (Android for MSM, Firefox OS for MSM, QRD Android) using the Linux K

Directory traversal issues in the D-Mod extractor in DFArc and DFArc2 (as well as in RTsoft's Dink Smallwood HD / Proton

In wma_ndp_end_response_event_handler(), the variable len_end_rsp is a uint32 which can be overflowed if the value of va

In the camera driver, an out-of-bounds access can occur due to an error in copying region params from user space in all

The value of fix_param->num_chans is received from firmware and if it is too large, an integer overflow can occur in wma

Due to a race condition in a bus driver, a double free in msm_bus_floor_vote_context() can potentially occur in all Andr

Buffer might get used after it gets freed due to unlocking the mutex before freeing the buffer in all Android releases f

router.php in the Harmis Ek rishta (aka ek-rishta) 2.10 component for Joomla! allows SQL Injection via the PATH_INFO to

A vulnerability in Trend Micro OfficeScan 11.0 SP1 and XG could allow a attacker to exploit it via a Browser Refresh att

A vulnerability in Trend Micro OfficeScan 11.0 SP1 and XG could allow a attacker to use a specially crafted URL to eleva

In the Linux Kernel before version 4.16.11, 4.14.43, 4.9.102, and 4.4.133, multiple race condition errors when handling

Improper restriction of write operations within the bounds of a memory buffer in snscore.sys in SoftControl/SafenSoft Sy

Under certain conditions, SAP Business One, 9.2, 9.3, for SAP HANA backup service allows an attacker to access informati

Missing escaping of ESSID values in sysconfig of SUSE Linux Enterprise allows attackers controlling an access point to c

An issue was discovered in mruby 1.4.1. There is a NULL pointer dereference in mrb_class_real because "class BasicObject

An issue was discovered in mruby 1.4.1. There is a heap-based buffer over-read associated with OP_ENTER because mrbgems/

An issue was discovered in mruby 1.4.1. There is a NULL pointer dereference in mrb_class, related to certain .clone usag

During key agreement in a TLS handshake using a DH(E) based ciphersuite a malicious server can send a very large prime v

In the ea_get function in fs/jfs/xattr.c in the Linux kernel through 4.17.1, a memory corruption bug in JFS can be trigg

VMware NSX SD-WAN Edge by VeloCloud prior to version 3.1.0 contains a command injection vulnerability in the local web U

Using remote content in encrypted messages can lead to the disclosure of plaintext. This vulnerability affects Thunderbi

If a text string that happens to be a filename in the operating system's native format is dragged and dropped onto the a

If a URL using the "file:" protocol is dragged and dropped onto an open tab that is running in a different child process

A use-after-free vulnerability can occur during WebGL operations. While this results in a potentially exploitable crash,

A buffer overflow was found during UTF8 to Unicode string conversion within JavaScript with extremely large amounts of d

A vulnerability exists in XSLT during number formatting where a negative buffer size may be allocated in some instances,

In the Windows 10 April 2018 Update, Windows Defender SmartScreen honors the "SEE_MASK_FLAG_NO_UI" flag associated with

WebExtensions can use request redirection and a "filterReponseData" filter to bypass host permission settings to redirec

If a malicious attacker has used another vulnerability to gain full control over a content process, they may be able to

Plaintext of decrypted emails can leak through the src attribute of remote images, or links. This vulnerability affects

WebRTC can use a "WrappedI420Buffer" pixel buffer but the owning image object can be freed while it is still in use. Thi

The PDF viewer does not sufficiently sanitize PostScript calculator functions, allowing malicious JavaScript to be injec

Same-origin protections for the PDF viewer can be bypassed, allowing a malicious site to intercept messages meant for th

If websocket data is sent with mixed text and binary in a single message, the binary data can be corrupted. This can res

An out of bounds memory write while processing Vorbis audio data was reported through the Pwn2Own contest. This vulnerab

An integer overflow can occur during conversion of text to some Unicode character sets due to an unchecked length parame