2018

SAP Enterprise Financial Services, versions 6.05, 6.06, 6.16, 6.17, 6.18, 8.0 (in business function EAFS_BCA_BUSOPR_SEPA

SAP Enterprise Financial Services, versions 6.05, 6.06, 6.16, 6.17, 6.18, 8.0 (in business function EAFS_BCA_BUSOPR_2) d

The logon application of SAP NetWeaver AS Java 7.10 to 7.11, 7.20, 7.30, 7.31, 7.40, 7.50 does not sufficiently encode u

Tendrl API in Red Hat Gluster Storage before 3.4.0 does not immediately remove session tokens after a user logs out. Ses

It was found that URLResource.getLastModified() in Undertow closes the file descriptors only when they are finalized whi

A flaw was found in the 389 Directory Server that allows users to cause a crash in the LDAP server using ldapsearch with

Multiple integer overflow and buffer overflow issues were discovered in spice-client's handling of LZ compressed frames.

The VMware Content Locker for iOS prior to 4.14 contains a data protection vulnerability in the SQLite database. This vu

The AirWatch Agent for iOS prior to 5.8.1 contains a data protection vulnerability whereby the files and keychain entrie

A flaw was found in the way Linux kernel KVM hypervisor before 4.18 emulated instructions such as sgdt/sidt/fxsave/fxrst

It was found that the improper default permissions on /tmp/auth directory in JBoss Enterprise Application Platform befor

CSRF in the anti-csrf decorator in xunfeng 0.2.0 allows an attacker to modify the configuration via a Flash file because

Smarty before 3.1.33-dev-4 allows attackers to bypass the trusted_dir protection mechanism via a file:./../ substring in

An issue has been found in PowerDNS before 3.4.11 and 4.0.2, and PowerDNS recursor before 4.0.4, allowing an attacker in

An issue has been found in PowerDNS before 3.4.11 and 4.0.2, and PowerDNS recursor before 4.0.4, allowing an attacker in

A privilege escalation flaw was found in the Ansible Tower. When Tower before 3.0.3 deploys a PostgreSQL database, it in

An issue has been found in dnsdist before 1.2.0 in the way EDNS0 OPT records are handled when parsing responses from a b

An issue has been found in PowerDNS before 3.4.11 and 4.0.2, and PowerDNS recursor before 3.7.4 and 4.0.4, allowing a re

A flaw was found in the CloudForms API before 5.6.3.0, 5.7.3.1 and 5.8.1.2. A user with permissions to use the MiqReport

The hotrod java client in infinispan before 9.1.0.Final automatically deserializes bytearray message contents in certain

IBM QRadar 7.2 and 7.3 could allow a remote authenticated attacker to execute arbitrary commands on the system. By sendi

In Bro through 2.5.5, there is a memory leak potentially leading to DoS in scripts/base/protocols/krb/main.bro in the Ke

A Pektron Passive Keyless Entry and Start (PKES) system, as used on the Tesla Model S and possibly other vehicles, relie

In b3log Solo 2.9.3, XSS in the Input page under the Publish Articles menu, with an ID of linkAddress stored in the link

TLS hostname verification when using the Apache ActiveMQ Client before 5.15.6 was missing which could make the client vu

An exploitable buffer overflow vulnerability exists in the credentials handler of video-core's HTTP server of Samsung Sm

Live-migrated instances are briefly able to inspect traffic for other instances on the same hypervisor. This brief windo

When using the Linux bridge ml2 driver, non-privileged tenants are able to create and attach ports without specifying an

The OpenStack RabbitMQ container image insecurely retrieves the rabbitmq_clusterer component over HTTP during the build

FURUNO FELCOM 250 and 500 devices allow unauthenticated access to the xml/permission.xml file containing all of the syst

FURUNO FELCOM 250 and 500 devices allow unauthenticated users to change the password for the Admin, Log and Service acco

An issue was discovered in Docker Moby before 17.06.0. The Docker engine validated a client TLS certificate using both t

An issue has been found in PowerDNS Authoritative Server before 3.4.11 and 4.0.2 allowing a remote, unauthenticated atta

An issue was discovered in Artifex Ghostscript before 9.25. Incorrect "restoration of privilege" checking when running o

Multiple exploitable SQL Injection vulnerabilities exists in ProcessMaker Enterprise Core 3.0.1.7-community. Specially c

An information disclosure vulnerability was found in JBoss Enterprise Application Platform before 7.0.4. It was discover

A timing attack flaw was found in OpenSSL 1.0.1u and before that could allow a malicious user with local access to recov

Drools Workbench contains a path traversal vulnerability. The vulnerability allows a remote, authenticated attacker to b

An authorization flaw was found in Pacemaker before 1.1.16, where it did not properly guard its IPC interface. An attack

An exploitable buffer overflow vulnerabilities exist in the /cameras/XXXX/clips handler of video-core's HTTP server of S

An exploitable buffer overflow vulnerabilities exist in the /cameras/XXXX/clips handler of video-core's HTTP server of S

foreman before version 1.15.0 is vulnerable to an information leak through organizations and locations feature. When a u

foreman before 1.14.0 is vulnerable to an information leak. It was found that Foreman form helper does not authorize opt

It was found that the CloudForms before 5.6.2.2, and 5.7.0.7 did not properly apply permissions controls to VM IDs passe

IBM OpenPages GRC Platform 7.2, 7.3, 7.4, and 8.0 could allow an attacker to obtain sensitive information from error log

It was found that Kubernetes as used by Openshift Enterprise 3 did not correctly validate X.509 client intermediate cert

Monit before version 5.20.0 is vulnerable to a cross site request forgery attack. Successful exploitation will enable an

A heap-based buffer overflow in PotPlayerMini.exe in PotPlayer 1.7.8556 allows remote attackers to execute arbitrary cod

In Monstra CMS 3.0.4, an attacker with 'Editor' privileges can change the password of the administrator via an admin/ind

Monstra CMS 3.0.4 does not properly restrict modified Snippet content, as demonstrated by the admin/index.php?id=snippet