2018

An exploitable improper authorization vulnerability exists in miner_setGasPrice API of cpp-ethereum's JSON-RPC (commit 4

An exploitable improper authorization vulnerability exists in miner_stop API of cpp-ethereum's JSON-RPC (commit 4e101574

FasterXML jackson-databind through 2.8.11 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because o

A man-in-the-middle vulnerability related to vCenter access was found in Rubrik CDM 3.x and 4.x before 4.0.4-p2. This vu

The server in Flexense SysGauge 3.6.18 operating on port 9221 can be exploited remotely with the attacker gaining system

It was found that 389-ds-base since 1.3.6.1 up to and including 1.4.0.3 did not always handle internal hash comparison o

A race condition during Jenkins 2.81 through 2.94 (inclusive); 2.89.1 startup could result in the wrong order of executi

A race condition during Jenkins 2.94 and earlier; 2.89.1 and earlier startup could result in the wrong order of executio

It was found that the fix for CVE-2016-9606 in versions 3.0.22 and 3.1.2 was incomplete and Yaml unmarshalling in Restea

Biscom Secure File Transfer (SFT) 5.0.1000 through 5.0.1048 does not validate the dataFieldId value, and uses sequential

IBM Tealeaf Customer Experience 8.7, 8.8, and 9.0.2 could allow a remote attacker under unusual circumstances to read op

htdocs/setup/index.php in Eventum before 2.3.5 allows remote attackers to inject and execute arbitrary PHP code via the

A signature-validation bypass issue was discovered in SimpleSAMLphp through 1.14.16. A SimpleSAMLphp Service Provider us

An issue was discovered in Flexense DiskBoss 8.8.16 and earlier. Due to the usage of plaintext information from the hand

Docker before 1.3 does not properly validate image IDs, which allows remote attackers to redirect to another image throu

A Server Side Request Forgery vulnerability exists in the install app process in Sandstorm before build 0.203. A remote

This vulnerability allows remote attackers to create a denial-of-service condition on vulnerable installations of Quest

VOBOT CLOCK before 0.99.30 devices do not verify X.509 certificates from SSL servers, which allows man-in-the-middle att

In Apache jUDDI 3.2 through 3.3.4, if using the WADL2Java or WSDL2Java classes, which parse a local or remote XML docume

Jerome Gamez Firebase Admin SDK for PHP version from 3.2.0 to 3.8.0 contains a Incorrect Access Control vulnerability in

In Exiv2 0.26, there is a heap-based buffer over-read in the Exiv2::Image::byteSwap4 function in image.cpp. Remote attac

A cross-site request forgery vulnerability exists on the Secure Gateway component of Schneider Electric's PowerSCADA Any

In SAP HANA Extended Application Services, 1.0, a controller user who has SpaceAuditor authorization in a specific space

In SAP HANA Extended Application Services, 1.0, a controller user who has SpaceAuditor authorization in a specific space

A Classic Buffer Overflow issue was discovered in Smiths Medical Medfusion 4000 Wireless Syringe Infusion Pump, Version

An Improper Access Control issue was discovered in Smiths Medical Medfusion 4000 Wireless Syringe Infusion Pump, Version

A Use of Hard-coded Credentials issue was discovered in Smiths Medical Medfusion 4000 Wireless Syringe Infusion Pump, Ve

An arbitrary command execution vulnerability in HPE Aruba ClearPass Policy Manager version 6.6.x was found.

A vulnerability in the Trend Micro InterScan Messaging Security Virtual Appliance 9.0 and 9.1 management portal could al

An issue was discovered in iDashboards 9.6b. The SSO implementation is affected by a weak obfuscation library, allowing

An issue was discovered in MetInfo 6.0.0. In install/install.php in the installation process, the config/config_db.php c

An issue was discovered in Reprise License Manager 11.0. This vulnerability is a Path Traversal where the attacker, by c

In version 1012 and prior of Insteon's Insteon Hub, the radio transmissions used for communication between the hub and c

Under certain circumstances, a flaw in the J9 JVM (IBM SDK, Java Technology Edition 7.1 and 8.0) allows untrusted code r

In /usr/local/etc/config/addons/mh/loopupd.sh on eQ-3 AG HomeMatic CCU2 2.29.22 devices, software update packages are do

Arbitrary Code Execution vulnerability in Micro Focus Universal CMDB, version 4.10, 4.11, 4.12. This vulnerability could

An issue was discovered in Icinga 2.x through 2.8.1. The lack of a constant-time password comparison function can disclo

In builtin.c in zsh before 5.4, when sh compatibility mode is used, there is a NULL pointer dereference during processin

In libzypp before 20170803 it was possible to add unsigned YUM repositories without warning to the user that could lead

In libzypp before 20170803 it was possible to retrieve unsigned packages without a warning to the user which could lead

In Drupal versions 8.4.x versions before 8.4.5 users with permission to post comments are able to view content and comme

In Drupal versions 8.4.x versions before 8.4.5 when using node access controls with a multilingual site, Drupal marks th

An issue was discovered in D-Link mydlink+ 3.8.5 build 259 for DCS-933L 1.05.04 and DCS-934L 1.05.04 devices. The mydlin

HTTPRedirect.php in the saml2 library in SimpleSAMLphp before 1.15.4 has an incorrect check of return values in the sign

JBoss RESTEasy before version 3.1.2 could be forced into parsing a request with YamlProvider, resulting in unmarshalling

A vulnerability exists in Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3.29.67 which

BMC Remedy AR System before 9.1 SP3, when Remedy AR Authentication is enabled, allows attackers to obtain administrative

Hammer CLI, a CLI utility for Foreman, before version 0.10.0, did not explicitly set the verify_ssl flag for apipie-bind

The verify_certificate function in lib/vtls/schannel.c in libcurl 7.30.0 through 7.51.0, when built for Windows CE using

brianleroux tiny-json-http version all versions since commit 9b8e74a232bba4701844e07bcba794173b0238a8 (Oct 29 2016) cont