2018

In Evernote before 7.6 on macOS, there is a local file path traversal issue in attachment previewing, aka MACOSNOTE-2863

A SQL injection issue was discovered in ERPNext 10.x and 11.x through 11.0.3-beta.29. This attack is only available to a

doorGets 7.0 allows remote attackers to write to arbitrary files via directory traversal, as demonstrated by a dg-user/?

A denial of service vulnerability exists when .NET Framework improperly handles special web requests, aka ".NET Framewor

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Mi

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Mi

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Mi

A remote code execution vulnerability exists when the Internet Explorer VBScript execution policy does not properly rest

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Mi

A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka "Windows

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Mi

A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, aka "Internet

A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet

An issue was discovered in XXL-CONF 1.6.0. There is a path traversal vulnerability via ../ in the keys parameter that ca

On BIG-IP 14.0.x, 13.x, 12.x, and 11.x, Enterprise Manager 3.1.1, BIG-IQ 6.x, 5.x, and 4.x, and iWorkflow 2.x, the passp

Incorrect enforcement of authorization checks in eDirectory prior to 9.1 SP2

An out-of-bounds read in dns_validate_dns_response in dns.c was discovered in HAProxy through 1.8.14. Due to a missing c

An issue was discovered in dns.c in HAProxy through 1.8.14. In the case of a compressed pointer, a crafted packet can tr

Open Dental before version 18.4 transmits the entire user database over the network when a remote unauthenticated user a

Insecure handling of temporary files in non-Windows McAfee Agent 5.0.0 through 5.0.6, 5.5.0, and 5.5.1 allows an Unprivi

An issue was discovered in zzzphp cms 1.5.8. del_file in /admin/save.php allows remote attackers to delete arbitrary fil

An issue was discovered in UsualToolCMS v8.0. cmsadmin\a_sqlback.php allows remote attackers to delete arbitrary files v

In Apache OFBiz 16.11.01 to 16.11.04, the OFBiz HTTP engine (org.apache.ofbiz.service.engine.HttpEngine.java) handles re

A vulnerability has been identified in SIMATIC HMI Comfort Panels 4" - 22" (All versions < V15 Update 4), SIMATIC HMI Co

A vulnerability has been identified in SIMATIC S7-1200 (All versions), SIMATIC S7-1500 (All Versions < V2.6). An attacke

A vulnerability has been identified in SIMATIC S7-400 CPU 412-1 DP V7 (All versions), SIMATIC S7-400 CPU 412-2 DP V7 (

Zoho ManageEngine ADAudit before 5.1 build 5120 allows remote attackers to cause a denial of service (stack-based buffer

Eclipse Mosquitto 1.5.x before 1.5.5 allows ACL bypass: if the option per_listener_settings was set to true, and the def

GE Mark VIe, EX2100e, EX2100e_Reg, and LS2100e Versions 03.03.28C to 05.02.04C, EX2100e All versions prior to v04.09.00C

In WordPress before 4.9.9 and 5.x before 5.0.1, the user-activation page could be read by a search engine's web crawler

The data import functionality in OpenRefine through 3.1 allows an XML External Entity (XXE) attack through a crafted (zi

Rendertron 1.0.0 includes an _ah/stop route to shutdown the Chrome instance responsible for serving render requests to a

Rendertron 1.0.0 allows for alternative protocols such as 'file://' introducing a Local File Inclusion (LFI) bug where a

Installed packages are exposed by node_modules in Rendertron 1.0.0, allowing remote attackers to read absolute paths on

Icinga Web 2 before 2.6.2 allows parameters that break navigation dashlets, as demonstrated by a single '$' character as

A stack-based buffer overflow in the LAN UPnP service running on UDP port 1900 of Swisscom Internet-Box (2, Standard, an

PTC ThingWorx Platform through 8.3.0 is vulnerable to a directory traversal attack on ZIP files via a POST request.

An Information Exposure through Discrepancy vulnerability exists in the embedded web servers in all Modicon M340, Premiu

An Improper Check for Unusual or Exceptional Conditions vulnerability exists in the embedded web servers in all Modicon

In all versions of ARM Trusted Firmware up to and including v1.4, not initializing or saving/restoring the PMCR_EL0 regi

wbook_addworksheet in workbook.c in libexcel.a in libexcel 0.01 allows attackers to cause a denial of service (SEGV) via

RDF4J 2.4.2 allows Directory Traversal via ../ in an entry in a ZIP archive.

When a client request to a cluster node was replicated to other nodes in the cluster for verification, the Content-Lengt

The template upload API endpoint accepted requests from different domain when sent in conjunction with ARP spoofing + ma

LibVNC before commit c3115350eb8bb635d0fdb4dbbb0d0541f38ed19c contains a CWE-835: Infinite loop vulnerability in VNC cli

LibVNC before 2f5b2ad1c6c99b1ac6482c95844a84d66bb52838 contains multiple weaknesses CWE-665: Improper Initialization vul

LibVNC before 8b06f835e259652b0ff026898014fc7297ade858 contains CWE-665: Improper Initialization vulnerability in VNC Re

LibVNC before commit 4a21bbd097ef7c44bb000c3bd0907f96a10e4ce7 contains null pointer dereference in VNC client code that

In pkg/tool/path.go in Gogs before 0.11.82.1218, a directory traversal in the file-upload functionality can allow an att

A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet