CWE-20

Improper verification when expanding ZIP64 archives in Lhaplus versions 1.73 and earlier may lead to unintended contents

Huawei AR120-S V200R006C10, V200R007C00, V200R008C20, V200R008C30, AR1200 V200R006C10, V200R006C13, V200R007C00, V200R00

Some Huawei smart phones with software EVA-L09C34B142; EVA-L09C40B196; EVA-L09C432B210; EVA-L09C440B138; EVA-L09C464B150

ClamAV before 0.100.1 lacks a PDF object length check, resulting in an unreasonably long time to parse a relatively smal

An input validation flaw was found in the way OpenShift 3 handles requests for images. A user, with a copy of the manife

When registering and activating a new system with Red Hat Satellite 6 if the new systems hostname is then reset to the h

It was discovered that the Dashbuilder login page as used in Red Hat JBoss BPM Suite before 6.4.2 and Red Hat JBoss Data

The Jenkins 2.73.1 and earlier, 2.83 and earlier default form control for passwords and other secrets, <f:password/>, su

NetIQ Identity Manager before 4.5.6.1 allowed uploading files with double extensions or non-image content in the Themes

When executing a program via the bubblewrap sandbox, the nonpriv session can escape to the parent session by using the T

Zoho ManageEngine Desktop Central before build 100082 allows remote attackers to obtain control over all connected activ

Xen through 4.8.x does not validate memory allocations during certain P2M operations, which allows guest OS users to obt

hw/input/ps2.c in Qemu does not validate 'rptr' and 'count' values during guest migration, leading to out-of-bounds acce

Improper input validation in Access Control APIs. Access control API may return memory range checking incorrectly. Produ

Exponent CMS 2.3.9 suffers from a remote code execution vulnerability in /install/index.php. An attacker can upload 'php

Exponent CMS 2.3.9 suffers from a remote code execution vulnerability in /install/index.php. An attacker can upload an e

CGI handling flaw in bozohttpd in NetBSD 6.0 through 6.0.6, 6.1 through 6.1.5, and 7.0 allows remote attackers to execut

ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows remote attackers to bypass authentication and impersonate arbitrary users v

The NETGEAR WNR2000v5 router allows an administrator to perform sensitive actions by invoking the apply.cgi URL on the w

MyBB (aka MyBulletinBoard) before 1.8.8 and MyBB Merge System before 1.8.8 allow remote attackers to have unspecified im

A vulnerability in a proprietary device driver in the kernel of Cisco TelePresence Multipoint Control Unit (MCU) Softwar

OpenText Documentum D2 (formerly EMC Documentum D2) 4.x allows remote attackers to execute arbitrary commands via a craf

Format string vulnerability in Dropbear SSH before 2016.74 allows remote attackers to execute arbitrary code via format

The dropbearconvert command in Dropbear SSH before 2016.74 allows attackers to execute arbitrary code via a crafted Open

PHP remote file inclusion vulnerability in editInplace.php in Wonder CMS 2014 allows remote attackers to execute arbitra

A vulnerability in the Cisco Cluster Management Protocol (CMP) processing code in Cisco IOS and Cisco IOS XE Software co

Huawei AR3200 routers with software before V200R007C00SPC600 allow remote attackers to cause a denial of service or exec

An issue was discovered in certain Apple products. iOS before 10.3 is affected. The issue involves the "HomeKit" compone

The Curve25519 code in botan before 1.11.31, on systems without a native 128-bit integer type, might allow attackers to

An issue was discovered in api/includes/systems.php in Unitrends Enterprise Backup before 9.0.0. User input is not prope

The FeedProxy.aspx script in Umbraco 4.7.0 allows remote attackers to proxy requests on their behalf via the "url" param

The datamover module in the Linux version of NovaBACKUP DataCenter before 09.06.03.0353 is vulnerable to remote command

The datamover module in the Linux version of NovaBACKUP DataCenter before 09.06.03.0353 is vulnerable to remote command

org.springframework.core.serializer.DefaultDeserializer in Spring AMQP before 1.5.5 allows remote attackers to execute a

The backend/Login/load/ script in Shopware before 5.1.5 allows remote attackers to execute arbitrary code.

TeX Live allows remote attackers to execute arbitrary commands by leveraging inclusion of mpost in shell_escape_commands

Pexip Infinity before 14.2 allows remote attackers to cause a denial of service (service restart) or execute arbitrary c

The Codextrous B2J Contact (aka b2j_contact) extension before 2.1.13 for Joomla! allows a rename attack that bypasses a

Multiple unspecified vulnerabilities in Google Chrome before 53.0.2785.143 allow remote attackers to cause a denial of s

libautotrace.a in AutoTrace 0.31.1 has a "left shift ... cannot be represented in type int" issue in input-bmp.c:516:63.

Trend Micro ServerProtect for Linux 3.0 before CP 1531 allows attackers to write to arbitrary files and consequently exe

IBM Domino 8.5 and 9.0 could allow an attacker to steal credentials using multiple sessions and large amounts of data us

An issue was discovered in Cloud Foundry Foundation routing-release versions prior to 0.142.0 and cf-release versions 20

An issue was discovered in Pivotal PCF Elastic Runtime 1.6.x versions prior to 1.6.60, 1.7.x versions prior to 1.7.41, 1

A vulnerability in the update process for the dynamic JAR file of the Cisco Context Service software development kit (SD

Policy resource matcher in Apache Ranger before 0.7.1 ignores characters after '*' wildcard character - like my*test, te

install/make-config.php in ProjectSend r754 allows remote attackers to execute arbitrary PHP code via the dbprefix param

Adobe Captivate versions 9 and earlier have a remote code execution vulnerability in the quiz reporting feature that cou

EMC VASA Provider Virtual Appliance versions 8.3.x and prior has an unauthenticated remote code execution vulnerability

The Struts 1 plugin in Apache Struts 2.1.x and 2.3.x might allow remote code execution via a malicious field value passe