2018

In Kubernetes versions 1.5.x, 1.6.x, 1.7.x, 1.8.x, and prior to version 1.9.6, the kubectl cp command insecurely handles

Incomplete Cleanup vulnerability in ECOS Secure Boot Stick (aka SBS) 5.6.5 allows an attacker to compromise authenticati

A flaw was found in the Linux kernel's ext4 filesystem. A local user can cause a use-after-free in ext4_xattr_set_entry

A flaw was found in the Linux kernel's ext4 filesystem. A local user can cause an out-of-bound access in ext4_get_group_

prosody before versions 0.10.2, 0.9.14 is vulnerable to an Authentication Bypass. Prosody did not verify that the virtua

A confused deputy vulnerability exists in Jenkins Publisher Over CIFS Plugin 0.10 and earlier in CifsPublisherPluginDesc

IBM Security Identity Governance Virtual Appliance 5.2 through 5.2.3.2 specifies permissions for a security-critical res

From version 1.3.0 onward, Apache Spark's standalone master exposes a REST API for job submission, in addition to the su

The hotrod java client in infinispan before 9.1.0.Final automatically deserializes bytearray message contents in certain

Tendrl API in Red Hat Gluster Storage before 3.4.0 does not immediately remove session tokens after a user logs out. Ses

An information disclosure vulnerability exists when the browser scripting engine improperly handle object types, aka "Mi

A security feature bypass vulnerability exists when Windows Hyper-V BIOS loader fails to provide a high-entropy source,

IBM Security Key Lifecycle Manager 3.0 specifies permissions for a security-critical resource in a way that allows that

An issue was discovered on Samsung 840 EVO devices. Vendor-specific commands may allow access to the disk-encryption key

Execution of Ansible playbooks on Windows platforms with PowerShell ScriptBlock logging and Module logging enabled can a

A vulnerability in the UPC bar code of the Avanti Markets MarketCard could allow an unauthenticated, local attacker to a

Cloud Foundry UAA, versions 60 prior to 66.0, contain an authorization logic error. In environments with multiple identi

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Client programs). Supported versions that are

The installation process in IBM Security Key Lifecycle Manager 2.5 stores unencrypted credentials, which might allow loc

A vulnerability in Central Web Authentication (CWA) with FlexConnect Access Points (APs) for Cisco Aironet 1560, 1810, 1

The Bitpie application through 3.2.4 for Android and iOS uses cleartext storage for digital currency initial keys, which

Absolute Computrace Agent, as distributed on certain Dell Inspiron systems through 2009, has a race condition with the D

Schneider Electric Ampla MES 6.4 provides capability to interact with data from third party databases. When connectivity

An information leak flaw was found in the way SMB1 protocol was implemented by Samba before 4.4.16, 4.5.x before 4.5.14,

A flaw was discovered in gdm 3.24.1 where gdm greeter was no longer setting the ran_once boolean during autologin. If au

The dialog for creating cloud volumes (cinder provider) in CloudForms does not filter cloud tenants by user. An attacker

A number of unused delete routes are present in CloudForms before 5.7.2.1 which can be accessed via GET requests instead

IBM Spectrum Protect Server 7.1 and 8.1 could disclose highly sensitive information via trace logs to a local privileged

The Identity and Access Management (IAM) services (IBM Cloud Private 3.1.0) do not use a secure channel, such as SSL, to

IBM Cognos Analytics 11.0 could allow a local user to change parameters set from the Cognos Analytics menus without prop

IBM DataPower Gateways 7.1, 7,2, 7.5, and 7.6 could allow an attacker using man-in-the-middle techniques to spoof DNS re

IBM Spectrum Scale 4.1.1 and 4.2.0 - 4.2.3 could allow a local unprivileged user access to information located in dump f

IBM Business Process Manager 8.6 allows web pages to be stored locally which can be read by another user on the system.

IBM QRadar 7.3 stores potentially sensitive information in log files that could be read by a local user. IBM X-Force ID:

IBM AIX 5.3, 6.1, 7.1, and 7.2 contains a vulnerability in the rmsock command that may be used to expose kernel memory.

Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). The supported version

Open Whisper Signal (aka Signal-Desktop) before 1.15.0-beta.10 allows information leakage.

IBM OpenPages GRC Platform 7.1, 7.2, and 7.3 could allow a local user to obtain sensitive information when a previous us

Dell EMC VPlex GeoSynchrony, versions prior to 6.1, contains an Insecure File Permissions vulnerability. A remote authen

The Wallabag application 2.2.3 to 2.3.2 is affected by one cross-site scripting (XSS) vulnerability that is stored withi

A vulnerability in the per-user-override feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower

A permissions flaw was found in redis, which sets weak permissions on certain files and directories that could potential

IBM Campaign 9.1.0, 9.1.2, 10.0, and 10.1 could allow an authenticated user with access to the local network to bypass s

An issue was discovered on Samsung 840 EVO and 850 EVO devices (only in "ATA high" mode, not vulnerable in "TCG" or "ATA

IBM Integration Bus 9.0.0.0, 9.0.0.11, 10.0.0.0, and 10.0.0.14 (including IBM WebSphere Message Broker 8.0.0.0 and 8.0.0

IBM QRadar SIEM 7.2 and 7.3 allows web pages to be stored locally which can be read by another user on the system. IBM X

IBM i2 Enterprise Insight Analysis 2.1.7 allows web pages to be stored locally which can be read by another user on the

IBM WebSphere Application Server 9 could allow sensitive information to be available caused by mishandling of data by th

IBM BigFix Platform 9.2.0 through 9.2.14 and 9.5 through 9.5.9 does not set the 'HttpOnly' attribute on authorization to