2018

A flaw was found in Foreman's katello plugin version 3.4.5. After setting a new role to allow restricted access on a rep

A heap-buffer overflow was found in the way samba clients processed extra long filename in a directory listing. A malici

The Samba Active Directory LDAP server was vulnerable to an information disclosure flaw because of missing access contro

A exposure of sensitive information vulnerability exists in Jenkins 2.137 and earlier, 2.121.2 and earlier in Computer.j

An issue was discovered in portfolioCMS 1.0.5. There is CSRF to update the website settings via admin/aboutus.php.

In Vanilla before 2.6.1, the polling functionality allows Insecure Direct Object Reference (IDOR) via the Poll ID, leadi

ASUSTOR Data Master 3.1.5 and below allows authenticated remote non-administrative users to enumerate all user accounts

Use of uninitialized memory in Skia in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to obtain potential

Insufficient data validation in Chromecast plugin in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to in

Endless recursion when handling responses from an IAS-ECC card in iasecc_select_file in libopensc/card-iasecc.c in OpenS

Various out of bounds reads when handling responses in OpenSC before 0.19.0-rc1 could be used by attackers able to suppl

An information disclosure vulnerability in Fortinet FortiManager 6.0.1 and below versions allows a standard user with ad

An issue was discovered in Gleez CMS v1.2.0. Because of an Insecure Direct Object Reference vulnerability, it is possibl

foreman before 1.14.0 is vulnerable to an information leak. It was found that Foreman form helper does not authorize opt

foreman before version 1.15.0 is vulnerable to an information leak through organizations and locations feature. When a u

A flaw was found in the CloudForms API before 5.6.3.0, 5.7.3.1 and 5.8.1.2. A user with permissions to use the MiqReport

IBM Datacap Fastdoc Capture 9.1.1, 9.1.3, and 9.1.4 could allow an authenticated user to bypass future authentication me

Wisetail Learning Ecosystem (LE) through v4.11.6 allows insecure direct object reference (IDOR) attacks to download non-

Wisetail Learning Ecosystem (LE) through v4.11.6 allows insecure direct object reference (IDOR) attacks to access non-pu

A spoofing vulnerability exists when Microsoft Edge improperly handles specific HTML content, aka "Microsoft Edge Spoofi

An information disclosure vulnerability exists when the scripting engine does not properly handle objects in memory in M

A vulnerability in BIG-IP APM portal access 11.5.1-11.5.7, 11.6.0-11.6.3, and 12.1.0-12.1.3 discloses the BIG-IP softwar

Tor Browser on Windows before 8.0 allows remote attackers to bypass the intended anonymity feature and discover a client

An issue was discovered in Open vSwitch (OvS) 2.7.x through 2.7.6, affecting parse_group_prop_ntr_selection_method in li

Incorrect security UI in navigation in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to spoof the conte

Incorrect security UI in Omnibox in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to spoof the contents

Insufficient policy enforcement in WebGL in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentiall

Insufficient policy enforcement in Blink in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentiall

XSS Auditor in Google Chrome prior to 64.0.3282.119, did not ensure the reporting URL was in the same origin as the page

Lack of support for a non standard no-referrer policy value in Blink in Google Chrome prior to 64.0.3282.119 allowed a r

Citrix ShareFile StorageZones Controller before 5.4.2 has Information Exposure Through an Error Message.

e107 2.1.9 allows CSRF via e107_admin/wmessage.php?mode=&action=inline&ajax_used=1&id= for changing the title of an arbi

In Open Ticket Request System (OTRS) 4.0.x before 4.0.32, 5.0.x before 5.0.30, and 6.0.x before 6.0.11, an attacker coul

When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 returned a r

Mediawiki 1.31 before 1.31.1, 1.30.1, 1.29.3 and 1.27.5 contains a flaw where contrary to the documentation, $wgRateLimi

A vulnerability in the DHCP service of Cisco Industrial Network Director could allow an unauthenticated, adjacent attack

A vulnerability in the server backup function of Cisco Prime Infrastructure could allow an authenticated, remote attacke

A vulnerability in the server backup function of Cisco Prime Infrastructure could allow an authenticated, remote attacke

IBM Tivoli Key Lifecycle Manager 2.6, 2.7, and 3.0 uses incomplete blacklisting for input validation which allows attack

IBM Tivoli Key Lifecycle Manager 2.6, 2.7, and 3.0 generates an error message that includes sensitive information about

An issue was discovered in Joomla! before 3.8.13. Inadequate checks on the tags search fields can lead to an access leve

An issue was discovered in Joomla! before 3.8.13. Inadequate checks in com_contact could allow mail submission in disabl

A security feature bypass vulnerability exists in DNS Global Blocklist feature, aka "Windows DNS Security Feature Bypass

A security feature bypass vulnerability exists when Microsoft Edge improperly handles requests of different origins, aka

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Console). Supported ver

Vulnerability in the Oracle Applications Framework component of Oracle E-Business Suite (subcomponent: REST Services). S

Vulnerability in the Oracle Demantra Demand Management component of Oracle Supply Chain Products Suite (subcomponent: Pr

Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products (subcomponent: Portal). S

Vulnerability in the Oracle Outside In Technology component of Oracle Fusion Middleware (subcomponent: Outside In Filter

Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: SMB Server). The supported ve