2017

find_abstract_instance_name in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU

read_formatted_entries in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binut

dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, does not validat

bfd_get_debug_link_info_1 in opncls.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Bi

LAME 3.99.5, 3.99.4, 3.99.3, 3.99.2, 3.99.1, 3.99, 3.98.4, 3.98.2 and 3.98 have a heap-based buffer over-read when handl

The Deploy to container Plugin stored passwords unencrypted as part of its configuration. This allowed users with Jenkin

Blue Ocean allows the creation of GitHub organization folders that are set up to scan a GitHub organization for reposito

The custom Details view of the Static Analysis Utilities based OWASP Dependency-Check Plugin, was vulnerable to a persis

The optional Run/Artifacts permission can be enabled by setting a Java system property. Blue Ocean did not check this pe

The Config File Provider Plugin is used to centrally manage configuration files that often include secrets, such as pass

The custom Details view of the Static Analysis Utilities based DRY Plugin, was vulnerable to a persisted cross-site scri

The Details view of some Static Analysis Utilities based plugins, was vulnerable to a persisted cross-site scripting vul

curl supports "globbing" of URLs, in which a user can pass a numerical range to have the tool iterate over those numbers

When doing a TFTP transfer and curl/libcurl is given a URL that contains a very long file name (longer than about 515 by

When asking to get a file from a file:// URL, libcurl provides a feature that outputs meta-data about the file using HTT

The default whitelist included the following unsafe entries: DefaultGroovyMethods.putAt(Object, String, Object); Default

Docker Commons Plugin provides a list of applicable credential IDs to allow users configuring a job to select the one th

GitHub Branch Source Plugin connects to a user-specified GitHub API URL (e.g. GitHub Enterprise) as part of form validat

Builds in Jenkins are associated with an authentication that controls the permissions that the build has to interact wit

The Sidebar Link plugin allows users able to configure jobs, views, and agents to add entries to the sidebar of these ob

GitHub Branch Source provides a list of applicable credential IDs to allow users configuring a job to select the one the

Subversion Plugin connects to a user-specified Subversion repository as part of form validation (e.g. to retrieve a list

Parameterized Trigger Plugin fails to check Item/Build permission: The Parameterized Trigger Plugin did not check the bu

In Apache Impala (incubating) before 2.10.0, a malicious user with "ALTER" permissions on an Impala table can access any

In Cloud Foundry router routing-release all versions prior to v0.163.0 and cf-release all versions prior to v274, in som

PRTG Network Monitor version 17.3.33.2830 is vulnerable to reflected Cross-Site Scripting on error.htm (the error page),

PRTG Network Monitor version 17.3.33.2830 is vulnerable to stored Cross-Site Scripting on all sensor titles, related to

GraphicsMagick 1.3.26 allows remote attackers to cause a denial of service (excessive memory allocation) because of an i

The Management Console in WSO2 Application Server 5.3.0, WSO2 Business Process Server 3.6.0, WSO2 Business Rules Server

ReadDCMImage in coders/dcm.c in GraphicsMagick 1.3.26 allows remote attackers to cause a denial of service (NULL pointer

The sg_ioctl function in drivers/scsi/sg.c in the Linux kernel before 4.13.4 allows local users to obtain sensitive info

IBM WebSphere Message Broker (IBM Integration Bus 9.0 and 10.0) could allow an unauthorized user to obtain sensitive inf

An information disclosure vulnerability in the Android media framework (libeffects). Product: Android. Versions: 4.4.4,

An information disclosure vulnerability in the Android media framework (libeffects). Product: Android. Versions: 4.4.4,

When an Apache Geode cluster before v1.2.1 is operating in secure mode, an unauthenticated client can enter multi-user a

The 'Upload logo from external path' function of SolarWinds Network Performance Monitor version 12.0.15300.90 allows rem

Persistent cross-site scripting (XSS) in the Add Node function of SolarWinds Network Performance Monitor version 12.0.15

WordPress 4.8.2 stores cleartext wp_signups.activation_key values (but stores the analogous wp_users.user_activation_key

A use-after-free in RenderFreetype in MagickCore/annotate.c in ImageMagick 7.0.7-4 Q16 allows attackers to crash the app

Header::readfrom in IlmImf/ImfHeader.cpp in OpenEXR 2.2.0 allows remote attackers to cause a denial of service (excessiv

Cross-site scripting (XSS) vulnerability in the EyesOfNetwork web interface (aka eonweb) 5.1-0 allows remote authenticat

Cross-site scripting (XSS) vulnerability in the EyesOfNetwork web interface (aka eonweb) 5.1-0 allows remote authenticat

Cross-site scripting (XSS) vulnerability in the EyesOfNetwork web interface (aka eonweb) 5.1-0 allows remote authenticat

Cross-Site Scripting (XSS) was discovered in ATutor before 2.2.3. The vulnerability exists due to insufficient filtratio

Skybox Manager Client Application prior to 8.5.501 is prone to an arbitrary file upload vulnerability due to insufficien

Skybox Manager Client Application prior to 8.5.501 is prone to an information disclosure vulnerability of user password

OpenText Document Sciences xPression (formerly EMC Document Sciences xPression) v4.5SP1 Patch 13 (older versions might b

OpenText Document Sciences xPression (formerly EMC Document Sciences xPression) v4.5SP1 Patch 13 (older versions might b

OpenText Document Sciences xPression (formerly EMC Document Sciences xPression) v4.5SP1 Patch 13 (older versions might b

dnsmasq before 2.78, when configured as a relay, allows remote attackers to obtain sensitive memory information via vect