2018

In ABB IP GATEWAY 3.39 and prior, the web server does not sufficiently verify that a request was performed by the authen

Soar Labs Soar Coin version up to and including git commit 4a2aa71ee21014e2880a3f7aad11091ed6ad434f (latest release as o

IBM Rhapsody DM 5.0 through 5.0.2 and 6.0 through 6.0.5 is vulnerable to a XML External Entity Injection (XXE) attack wh

libjpeg 9c has a large loop because read_pixel in rdtarga.c mishandles EOF.

An issue was discovered in DisplayLink Core Software Cleaner Application 8.2.1956. When the drivers are updated to a new

The remote management interface of cgminer 4.10.0 and bfgminer 5.5.0 allows an authenticated remote attacker to execute

An improper authorization vulnerability exists in Jenkins Black Duck Hub Plugin 3.0.3 and older in PostBuildScanDescript

A path traversal vulnerability exists in Jenkins 2.120 and older, LTS 2.107.2 and older in FilePath.java, SoloFilePathFi

QNAP NAS application Proxy Server through version 1.2.0 does not utilize CSRF protections.

IntelliVue Patient Monitors MP Series (including MP2/X2/MP30/MP50/MP70/NP90/MX700/800) Rev B-M, IntelliVue Patient Monit

IntelliVue Patient Monitors MP Series (including MP2/X2/MP30/MP50/MP70/NP90/MX700/800) Rev B-M, IntelliVue Patient Monit

A command execution vulnerability exists in Jenkins Absint Astree Plugin 1.0.5 and older in AstreeBuilder.java that allo

In Eclipse Mosquitto 1.4.15 and earlier, a Memory Leak vulnerability was found within the Mosquitto Broker. Unauthentica

There is an authentication bypass vulnerability in some Huawei servers. A remote attacker with low privilege may bypass

An issue was discovered in GamerPolls 0.4.6, related to config/environments/all.js and config/initializers/02_passport.j

In Dedos-web 1.0, the cookie and session secrets used in the Express.js application have hardcoded values that are visib

IBM InfoSphere Information Server 9.1, 11.3, 11.5, and 11.7 could allow a user to escalate their privileges to administr

Privilege Escalation vulnerability in McAfee Management of Native Encryption (MNE) before 4.1.4 allows local users to ga

Kitura 2.3.0 and earlier have an unintended read access to unauthorised files and folders that can be exploited by a cra

Bouncy Castle BC 1.54 - 1.59, BC-FJA 1.0.0, BC-FJA 1.0.1 and earlier have a flaw in the Low-level interface to RSA key p

RSA Web Threat Detection versions prior to 6.4, contain an SQL injection vulnerability in the Administration and Forensi

An issue was discovered in libtskbase.a in The Sleuth Kit (TSK) from release 4.0.2 through to 4.6.1. An out-of-bounds re

An issue was discovered in libtskimg.a in The Sleuth Kit (TSK) from release 4.0.2 through to 4.6.1. An out-of-bounds rea

An issue was discovered in libtskfs.a in The Sleuth Kit (TSK) from release 4.0.2 through to 4.6.1. An out-of-bounds read

An issue was discovered in libtskfs.a in The Sleuth Kit (TSK) from release 4.0.2 through to 4.6.1. An out-of-bounds read

In the Bouncy Castle JCE Provider version 1.55 and earlier the ECIES implementation allowed the use of ECB mode. This mo

In the Bouncy Castle JCE Provider version 1.55 and earlier the DHIES implementation allowed the use of ECB mode. This mo

An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Software Foxit PDF Reader version 9

`sqlserver` was a malicious module published with the intent to hijack environment variables. It has been unpublished by

`nodefabric` was a malicious module published with the intent to hijack environment variables. It has been unpublished b

`fabric-js` was a malicious module published with the intent to hijack environment variables. It has been unpublished by

`node-fabric` was a malicious module published with the intent to hijack environment variables. It has been unpublished

`sqliter` was a malicious module published with the intent to hijack environment variables. It has been unpublished by n

`sqlite.js` was a malicious module published with the intent to hijack environment variables. It has been unpublished by

`nodesqlite` was a malicious module published with the intent to hijack environment variables. It has been unpublished b

`node-sqlite` was a malicious module published with the intent to hijack environment variables. It has been unpublished

`mariadb` was a malicious module published with the intent to hijack environment variables. It has been unpublished by n

`jquery.js` was a malicious module published with the intent to hijack environment variables. It has been unpublished by

`d3.js` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm

gfe-sass is a library for promises (CommonJS/Promises/A,B,D) gfe-sass downloads resources over HTTP, which leaves it vul

`hftp` is a static http or ftp server `hftp` is vulnerable to a directory traversal issue, giving an attacker access to

`f2e-server` 1.12.11 and earlier is vulnerable to a directory traversal issue, giving an attacker access to the filesyst

`gomeplus-h5-proxy` is vulnerable to a directory traversal issue, allowing attackers to access any file in the system by

`badjs-sourcemap-server` receives files sent by `badjs-sourcemap`. `badjs-sourcemap-server` is vulnerable to a directory

The hubl-server module is a wrapper for the HubL Development Server. During installation hubl-server downloads a set of

Socket.io is a realtime application framework that provides communication via websockets. Because socket.io 0.9.6 and ea

Useragent is used to parse useragent headers. It uses several regular expressions to accomplish this. An attacker could

hostr is a simple web server that serves up the contents of the current directory. There is a directory traversal vulner

Decamelize is used to convert a dash/dot/underscore/space separated string to camelCase. Decamelize 1.1.0 through 1.1.1

Http-proxy is a proxying library. Because of the way errors are handled in versions before 0.7.0, an attacker that force