2018

IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 Admin Console is vulnerable to cross-site request forgery, cause

IBM Security Access Manager Appliance 9.0.1.0, 9.0.2.0, 9.0.3.0, 9.0.4.0, and 9.0.5.0 generates an error message that in

IBM Security Access Manager Appliance 9.0.1.0, 9.0.2.0, 9.0.3.0, 9.0.4.0, and 9.0.5.0 uses incomplete blacklisting for i

A SQL injection flaw was found in katello's errata-related API. An authenticated remote attacker can craft input data to

A vulnerability in the API of SonarSource SonarQube before 7.4 could allow an authenticated user to discover sensitive i

The WP Maintenance Mode plugin before 2.0.7 for WordPress allows remote authenticated users to discover all subscriber e

The WP Maintenance Mode plugin before 2.0.7 for WordPress allows remote authenticated subscriber users to bypass intende

A NULL pointer dereference in dhd_prot_txdata_write_flush in drivers/net/wireless/bcmdhd4358/dhd_msgbuf.c in the bcmdhd4

Pulse Secure Virtual Traffic Manager 9.9 versions prior to 9.9r2 and 10.4r1 allow a remote authenticated user to obtain

Brave Software Inc. Brave version version 0.22.810 to 0.24.0 contains a Other/Unknown vulnerability in function ContentS

A cross-site request forgery (CSRF) vulnerability in the APM webtop 11.2.1 or greater may allow attacker to force an APM

ZTE ZXV10 B860AV2.1 product ChinaMobile branch with the ICNT versions up to V1.3.3, the BESTV versions up to V1.2.2, the

Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows an attacker to acces

IBM QRadar 7.2 and 7.3 specifies permissions for a security-critical resource in a way that allows that resource to be r

IBM Security Access Manager Appliance 8.0.0 and 9.0.0 specifies permissions for a security-critical resource in a way th

In XBLRamDump mode, there is a debug feature that can be used to dump memory contents, if an attacker has physical acces

The LDAP backend in Novell eDirectory before 9.0 SP4 when switched to EBA (Enhanced Background Authentication) kept open

IBM QRadar 7.3 and 7.3.1 specifies permissions for a security-critical resource in a way that allows that resource to be

Vulnerability in the Solaris component of Oracle Sun Systems Products Suite (subcomponent: LDAP Library). Supported vers

Vulnerability in the Java SE, JRockit component of Oracle Java SE (subcomponent: RMI). Supported versions that are affec

jenkins before versions 2.44, 2.32.2 is vulnerable to a persisted cross-site scripting vulnerability in console notes (S

IBM Security Guardium Big Data Intelligence (SonarG) 3.1 specifies permissions for a security-critical resource in a way

Some Huawei smart phones have the denial of service (DoS) vulnerability due to the improper processing of malicious para

In Kubernetes versions 1.5.x, 1.6.x, 1.7.x, 1.8.x, and prior to version 1.9.6, the kubectl cp command insecurely handles

Incomplete Cleanup vulnerability in ECOS Secure Boot Stick (aka SBS) 5.6.5 allows an attacker to compromise authenticati

A flaw was found in the Linux kernel's ext4 filesystem. A local user can cause a use-after-free in ext4_xattr_set_entry

A flaw was found in the Linux kernel's ext4 filesystem. A local user can cause an out-of-bound access in ext4_get_group_

prosody before versions 0.10.2, 0.9.14 is vulnerable to an Authentication Bypass. Prosody did not verify that the virtua

A confused deputy vulnerability exists in Jenkins Publisher Over CIFS Plugin 0.10 and earlier in CifsPublisherPluginDesc

IBM Security Identity Governance Virtual Appliance 5.2 through 5.2.3.2 specifies permissions for a security-critical res

From version 1.3.0 onward, Apache Spark's standalone master exposes a REST API for job submission, in addition to the su

The hotrod java client in infinispan before 9.1.0.Final automatically deserializes bytearray message contents in certain

Tendrl API in Red Hat Gluster Storage before 3.4.0 does not immediately remove session tokens after a user logs out. Ses

An information disclosure vulnerability exists when the browser scripting engine improperly handle object types, aka "Mi

A security feature bypass vulnerability exists when Windows Hyper-V BIOS loader fails to provide a high-entropy source,

IBM Security Key Lifecycle Manager 3.0 specifies permissions for a security-critical resource in a way that allows that

An issue was discovered on Samsung 840 EVO devices. Vendor-specific commands may allow access to the disk-encryption key

Execution of Ansible playbooks on Windows platforms with PowerShell ScriptBlock logging and Module logging enabled can a

A vulnerability in the UPC bar code of the Avanti Markets MarketCard could allow an unauthenticated, local attacker to a

Cloud Foundry UAA, versions 60 prior to 66.0, contain an authorization logic error. In environments with multiple identi

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Client programs). Supported versions that are

The installation process in IBM Security Key Lifecycle Manager 2.5 stores unencrypted credentials, which might allow loc

A vulnerability in Central Web Authentication (CWA) with FlexConnect Access Points (APs) for Cisco Aironet 1560, 1810, 1

The Bitpie application through 3.2.4 for Android and iOS uses cleartext storage for digital currency initial keys, which

Absolute Computrace Agent, as distributed on certain Dell Inspiron systems through 2009, has a race condition with the D

Schneider Electric Ampla MES 6.4 provides capability to interact with data from third party databases. When connectivity

An information leak flaw was found in the way SMB1 protocol was implemented by Samba before 4.4.16, 4.5.x before 4.5.14,

A flaw was discovered in gdm 3.24.1 where gdm greeter was no longer setting the ran_once boolean during autologin. If au

The dialog for creating cloud volumes (cinder provider) in CloudForms does not filter cloud tenants by user. An attacker

A number of unused delete routes are present in CloudForms before 5.7.2.1 which can be accessed via GET requests instead