2018

IBM BigFix Platform 9.2.0 through 9.2.14 and 9.5 through 9.5.9 discloses sensitive information to unauthorized users. Th

Open Dental before version 18.4 stores user passwords as base64 encoded MD5 hashes.

IBM Security Access Manager Appliance 9.0.1.0, 9.0.2.0, 9.0.3.0, 9.0.4.0, and 9.0.5.0 discloses sensitive information to

A flaw was found in qemu Media Transfer Protocol (MTP). The code opening files in usb_mtp_get_object and usb_mtp_get_par

IBM DB2 for Linux, UNIX and Windows 11.1 (includes DB2 Connect Server) contains a denial of service vulnerability. A rem

OpenStack Keystone through 14.0.1 has a user enumeration vulnerability because invalid usernames have much faster respon

In GraphicsMagick 1.4 snapshot-20181209 Q8 on 32-bit platforms, there is a heap-based buffer over-read in the ReadBMPIma

IBM Event Streams 2018.3.0 could allow a remote attacker to submit an API request with a fake Host request header. An at

An issue was discovered in Symfony 2.7.x before 2.7.50, 2.8.x before 2.8.49, 3.x before 3.4.20, 4.0.x before 4.0.15, 4.1

Incorrect access control in StackStorm API (st2api) in StackStorm before 2.9.2 and 2.10.x before 2.10.1 allows an attack

A Reachable Assertion issue was discovered in the KDC in MIT Kerberos 5 (aka krb5) before 1.17. If an attacker can obtai

An issue was discovered in DouCo DouPHP 1.5 20181221. It allows full path disclosure in "Smarty error: unable to read re

An issue was discovered in DouCo DouPHP 1.5 20181221. \install\index.php allows a reload of the product in opportunistic

imcat 4.4 allows remote attackers to obtain potentially sensitive debugging information via the root/tools/adbug/binfo.p

imcat 4.4 allows remote attackers to obtain potentially sensitive configuration information via the root/tools/adbug/che

It was discovered that libICE before 1.0.9-8 used a weak entropy to generate keys. A local attacker could potentially us

Medtronic MyCareLink Patient Monitor uses per-product credentials that are stored in a recoverable format. An attacker c

Ansible Tower as shipped with Red Hat CloudForms Management Engine 5 is vulnerable to CRLF Injection. It was found that

A null pointer dereference flaw was found in the way samba checked database outputs from the LDB database layer. An auth

IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 uses weaker than expected cr

The NetIQ Identity Manager communication channel, in versions prior to 4.7, is susceptible to a DoS attack.

The GSKit (IBM Spectrum Protect 7.1 and 7.2) and (IBM Spectrum Protect Snapshot 4.1.3, 4.1.4, and 4.1.6) CMS KDB logic f

IBM Sterling B2B Integrator Standard Edition (IBM Sterling File Gateway 2.2.0 through 2.2.6) uses weaker than expected c

A kernel data leak due to an out-of-bound read was found in the Linux kernel in inet_diag_msg_sctp{,l}addr_fill() and sc

IBM Sterling B2B Integrator Standard Edition 5.2.6.0 and 6.2.6.1 could allow a local user to obtain highly sensitive inf

IBM DataPower Gateways 7.1, 7.2, 7.5, 7.5.1, 7.5.2, 7.6, and 7.7 and IBM MQ Appliance are vulnerable to a denial of serv

All versions up to ZXCLOUD iRAI V5.01.05 of the ZTE uSmartView product are impacted by untrusted search path vulnerabili

Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: Kernel). The supported versio

IBM Curam Social Program Management 6.0.5, 6.1.1, 6.2.0, and 7.0.1 within Citizen Portal could allow an authenticated us

Any authenticated user (valid client certificate but without ACL permissions) could upload a template which contained ma

GIT version 2.15.1 and earlier contains a Input Validation Error vulnerability in Client that can result in problems inc

The bs_worker code in open build service before 20170320 followed relative symlinks, allowing reading of files outside o

Maliciously misconfigured registry vulnerability in all Microsoft Windows products in McAfee consumer and corporate prod

Vulnerability in the Siebel Core - Server Framework component of Oracle Siebel CRM (subcomponent: Services). The support

Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: Kernel). The supported versio

Vulnerability in the Sun ZFS Storage Appliance Kit (AK) component of Oracle Sun Systems Products Suite (subcomponent: AP

Vulnerability in the MySQL Cluster component of Oracle MySQL (subcomponent: Cluster: ndbcluster/plugin). Supported versi

ovirt-engine up to version 4.2.3 is vulnerable to an unfiltered password when choosing manual db provisioning. When engi

ovirt-ansible-roles before version 1.0.6 has a vulnerability due to a missing no_log directive, resulting in the 'Add oV

ovirt-engine before version ovirt 4.2.2 is vulnerable to an information exposure through log files. When engine-backup w

Vulnerability in the MySQL Client component of Oracle MySQL (subcomponent: Client programs). Supported versions that are

A flaw was found in Linux kernel in the ext4 filesystem code. A use-after-free is possible in ext4_ext_remove_space() fu

A local information disclosure issue was found in dracut before 045 when generating initramfs images with world-readable

The OpenShift Enterprise cluster-read can access webhook tokens which would allow an attacker with sufficient privileges

IBM WebSphere Portal 7.0, 8.0, 8.5, and 9.0 may fail to set the correct user context in certain impersonation scenarios,

Vulnerability in the Oracle Agile Product Lifecycle Management for Process component of Oracle Supply Chain Products Sui

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Partition). Supported versions that a

When a device connects only over WiFi VPN, the device may not receive security updates due to some incorrect checks. Thi

IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to temporarily gain elevated privileges on th

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: InnoDB). Supported versions that are