2018

waimai Super Cms 20150505 has a logic flaw allowing attackers to modify a price, before form submission, by observing da

The IIOP OpenJDK Subsystem in WildFly before version 14.0.0 does not honour configuration when SSL transport is required

It was discovered that fsync(2) system call in glusterfs client code leaks memory. An authenticated attacker could use t

NodeJS Tough-Cookie version 2.2.2 contains a Regular Expression Parsing vulnerability in HTTP request Cookie Header pars

An issue was discovered in BTITeam XBTIT. By using String.replace and eval, it is possible to bypass the includes/crk_pr

An issue was discovered in BTITeam XBTIT. PHP error logs are stored in an open directory (/include/logs) using predictab

HScripts PHP File Browser Script v1.0 allows Directory Traversal via the index.php path parameter.

The Pulse Secure Desktop (macOS) 5.3RX before 5.3R5 and 9.0R1 has a Privilege Escalation Vulnerability.

IBM Security Identity Governance and Intelligence 5.2.3.2 and 5.2.4 could allow an attacker to obtain sensitive informat

A vulnerability in the Gleez CMS 1.2.0 login page could allow an unauthenticated, remote attacker to perform multiple us

Endress+Hauser WirelessHART Fieldgate SWG70 3.x devices allow Directory Traversal via the fcgi-bin/wgsetcgi filename par

A flaw was found in the Linux Kernel where an attacker may be able to have an uncontrolled read to kernel-memory from wi

An issue has been found in PowerDNS Authoritative Server before 3.4.11 and 4.0.2 allowing a remote, unauthenticated atta

Live-migrated instances are briefly able to inspect traffic for other instances on the same hypervisor. This brief windo

An issue has been found in PowerDNS before 3.4.11 and 4.0.2, and PowerDNS recursor before 3.7.4 and 4.0.4, allowing a re

An issue has been found in PowerDNS before 3.4.11 and 4.0.2, and PowerDNS recursor before 4.0.4, allowing an attacker in

An issue has been found in PowerDNS before 3.4.11 and 4.0.2, and PowerDNS recursor before 4.0.4, allowing an attacker in

The VMware Content Locker for iOS prior to 4.14 contains a data protection vulnerability in the SQLite database. This vu

DLL injection vulnerability in software installer for Intel Data Center Migration Center Software v3.1 and before may al

Multiple memory leaks in Intel AMT in Intel CSME firmware versions before 12.0.5 may allow an unauthenticated user with

Monstra CMS V3.0.4 has an information leakage risk (e.g., PATH, DOCUMENT_ROOT, and SERVER_ADMIN) in libraries/Gelato/Err

A security feature bypass vulnerability exists when Windows Subsystem for Linux improperly handles case sensitivity, aka

IBM Maximo Asset Management 7.6 through 7.6.3 could allow an unauthenticated attacker to obtain sensitive information fr

oBike relies on Hangzhou Luoping Smart Locker to lock bicycles, which allows attackers to bypass the locking mechanism b

A denial of service vulnerability was identified that exists in Apache SpamAssassin before 3.4.2. The vulnerability aris

Apache Camel's Mail 2.20.0 through 2.20.3, 2.21.0 through 2.21.1 and 2.22.0 is vulnerable to path traversal.

An issue was discovered in Oracle WebCenter Interaction Portal 10.3.3. The portal component is delivered with an insecur

An information leak vulnerability was found in Undertow. If all headers are not written out in the first write() call th

In the marshmallow library before 2.15.1 and 3.x before 3.0.0b9 for Python, the schema "only" option treats an empty lis

An issue was discovered on Neato Botvac Connected 2.2.0 devices. They execute unauthenticated manual drive commands (sen

An issue was discovered in CIRCONTROL CirCarLife before 4.3. There is internal installation path disclosure due to the l

An issue was discovered in CIRCONTROL CirCarLife before 4.3. There is PLC status disclosure due to lack of authenticatio

An issue was discovered in CIRCONTROL CirCarLife before 4.3. There is system software information disclosure due to lack

An unprivileged user can delete arbitrary files on a Linux system running ENSLTP 10.5.1, 10.5.0, and 10.2.3 Hotfix 12467

An exploitable buffer overflow vulnerability exists in the UPnP implementation used by the Foscam C1 Indoor HD Camera ru

In Elastic Cloud Enterprise (ECE) versions prior to 1.1.4 it was discovered that a user could scale out allocators on ne

SeaCMS 6.64 allows arbitrary directory listing via upload/admin/admin_template.php?path=../templets/../../ requests.

An issue was discovered in PublicCMS V4.0.180825. For an invalid login attempt, the response length is different dependi

The PhonePe wallet (aka com.PhonePe.app) application 3.0.6 through 3.3.26 for Android might allow attackers to discover

The SBIbuddy (aka com.sbi.erupee) application 1.41 and 1.42 for Android might allow an attacker to sniff private informa

Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have a dire

Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have a secu

Philips e-Alert Unit (non-medical device), Version R2.1 and prior. The Philips e-Alert contains a banner disclosure vuln

Fuji Electric Alpha5 Smart Loader Versions 3.7 and prior. A buffer overflow information disclosure vulnerability occurs

Fuji Electric FRENIC LOADER v3.3 v7.3.4.1a of FRENIC-Mini (C1), FRENIC-Mini (C2), FRENIC-Eco, FRENIC-Multi, FRENIC-MEGA,

IBM WebSphere Portal 7.0, 8.0, 8.5, and 9.0 resets access control settings to the out of the box configuration during Co

Zimbra Collaboration before 8.8.10 GA allows text content spoofing via a loginErrorCode value.

Failure to validate certificates in OPC Foundation UA Client Applications communicating without security allows attacker

The statistics generator in Apache Pony Mail 0.7 to 0.9 was found to be returning timestamp data without proper authoriz

Mediawiki 1.31 before 1.31.1 misses .htaccess files in the provided tarball used to protect some directories that should