2017

In Kaspersky Internet Security for Android 11.12.4.1622, some of the application trace files were not encrypted.

In FlightGear before version 2017.3.1, Main/logger.cxx in the FGLogger subsystem allows one to overwrite any file via a

The setup_group function in elf.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binuti

Unspecified vulnerability in FFMPEG 0.10 allows remote attackers to cause a denial of service.

Directory traversal vulnerability in hybris Commerce software suite 5.0.3.3 and earlier, 5.0.0.3 and earlier, 5.0.4.4 an

Emacs 24.4 allows remote attackers to bypass security restrictions.

libhtp 0.5.15 allows remote attackers to cause a denial of service (NULL pointer dereference).

Multiple directory traversal vulnerabilities in ha 0.999p+dfsg-5.

Directory traversal vulnerability in ppmd 10.1-5.

Directory traversal vulnerability in unshield 1.0-1.

Directory traversal vulnerability in ES File Explorer 3.2.4.1.

The expansion of '\h' in the prompt string in bash 4.3 allows remote authenticated users to execute arbitrary code via s

FreeIPA uses a default password policy that locks an account after 5 unsuccessful authentication attempts, which allows

kgb-bot 1.33-2 allows remote attackers to cause a denial of service (crash).

Information disclosure vulnerability in Netatmo Indoor Module firmware 100 and earlier.

NULL Pointer Dereference in the id3v2AddAudioDuration function in libmp3lame/id3tag.c in LAME 3.99.5 allows attackers to

The transit path validation code in Heimdal before 7.3 might allow attackers to bypass the capath policy protection mech

Multiple temporary file creation vulnerabilities in pki-core 10.2.0.

baserCMS version 3.0.14 and earlier, 4.0.5 and earlier allows remote attackers to delete arbitrary files via unspecified

There is an infinite loop in the next_char function in comp_scan.c in ncurses 6.0, related to libtic. A crafted input wi

There is a floating point exception in the kodak_radc_load_raw function in dcraw_common.cpp in LibRaw 0.18.2. It will le

There is a reachable assertion abort in the function jpc_dec_process_sot() in jpc/jpc_dec.c in JasPer 2.0.12 that will l

There is a reachable assertion abort in the function jpc_dec_process_siz() in jpc/jpc_dec.c:1297 in JasPer 2.0.12 that w

There is a reachable assertion abort in the function jpc_floorlog2() in jpc/jpc_math.c in JasPer 2.0.12 that will lead t

There are lots of memory leaks in JasPer 2.0.12, triggered in the function jas_strdup() in base/jas_string.c, that will

There is a reachable assertion abort in the function jpc_pi_nextrpcl() in jpc/jpc_t2cod.c in JasPer 2.0.12 that will lea

There is a reachable assertion abort in the function jpc_dec_process_siz() in jpc/jpc_dec.c:1296 in JasPer 2.0.12 that w

There is a reachable assertion abort in the function calcstepsizes() in jpc/jpc_dec.c in JasPer 2.0.12 that will lead to

There is a reachable assertion abort in the function jpc_dequantize() in jpc/jpc_dec.c in JasPer 2.0.12 that will lead t

Apache Struts 2.x before 2.3.24.1 allows remote attackers to manipulate Struts internals, alter user sessions, or affect

ZTE OX-330P, ZXHN H108N, W300V1.0.0S_ZRD_TR1_D68, HG110, GAN9.8T101A-B, MF28G, ZXHN H108N use non-unique X.509 certifica

qa-include/qa-install.php in Question2Answer before 1.7.5 allows remote attackers to create multiple user accounts.

The Googlemaps plugin before 3.1 for Joomla! allows remote attackers to bypass an intended protection mechanism.

Buffer overflow in mpg123 before 1.18.0.

Apache Atlas versions 0.6.0 (incubating), 0.7.0 (incubating), and 0.7.1 (incubating) allow access to the webapp director

Error responses from Apache Atlas versions 0.6.0-incubating and 0.7.0-incubating included stack trace, exposing excessiv

Libgcrypt before 1.8.1 does not properly consider Curve25519 side-channel attacks, which makes it easier for attackers t

ONOS versions 1.8.0, 1.9.0, and 1.10.0 do not restrict the amount of memory allocated. The Netty payload size is not lim

In Wireshark 2.4.0, the Modbus dissector could crash with a NULL pointer dereference. This was addressed in epan/dissect

In Wireshark 2.4.0, 2.2.0 to 2.2.8, and 2.0.0 to 2.0.14, the IrCOMM dissector has a buffer over-read and application cra

In Wireshark 2.4.0 and 2.2.0 to 2.2.8, the Profinet I/O dissector could crash with an out-of-bounds write. This was addr

In Wireshark 2.4.0, 2.2.0 to 2.2.8, and 2.0.0 to 2.0.14, the MSDP dissector could go into an infinite loop. This was add

When using the Index Replication feature, Apache Solr nodes can pull index files from a master/leader node using an HTTP

The EyesOfNetwork web interface (aka eonweb) 5.1-0 allows directory traversal attacks for reading arbitrary files via th

A SQL Injection issue was discovered in Advantech WebAccess versions prior to V8.2_20170817. By submitting a specially c

A vulnerability has been identified in LOGO! 8 BM (incl. SIPLUS variants) (All versions < V1.81.2). An attacker with net

Async Http Client (aka async-http-client) before 2.0.35 can be tricked into connecting to a host different from the one

RubyGems version 2.6.12 and earlier is vulnerable to maliciously crafted gem specifications to cause a denial of service

RubyGems version 2.6.12 and earlier fails to validate specification names, allowing a maliciously crafted gem to potenti

Soplanning 1.32 and earlier generates static links for sharing ICAL calendars with embedded login information, which all