2018

Multiple vulnerabilities in the Login Enhancements (Login Block) feature of Cisco IOS Software could allow an unauthenti

Multiple vulnerabilities in the Login Enhancements (Login Block) feature of Cisco IOS Software could allow an unauthenti

An issue was discovered in certain Apple products. iOS before 11 is affected. The issue involves the "APNs" component. I

An issue was discovered in certain Apple products. iOS before 11.2 is affected. tvOS before 11.2 is affected. The issue

An issue was discovered in certain Apple products. iOS before 11.2.5 is affected. macOS before 10.13.3 is affected. tvOS

An issue was discovered in certain Apple products. macOS before 10.13.4 is affected. The issue involves the "Mail" compo

An issue was discovered in certain Apple products. iOS before 11.3 is affected. macOS before 10.13.4 is affected. The is

In Qualcomm Android for MSM, Firefox OS for MSM, and QRD Android with all Android releases from CAF using the Linux kern

Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow app

OleumTech Wireless Sensor Network devices allow remote attackers to obtain sensitive information about sensor nodes or s

rhnreg_ks in Red Hat Network Client Tools (aka rhn-client-tools) on Red Hat Gluster Storage 2.1 and Enterprise Linux (RH

On F5 BIG-IP PEM versions 13.0.0, 12.0.0-12.1.3.1, 11.6.0-11.6.2, 11.5.1-11.5.5, or 11.2.1, under certain conditions, TM

The OpenSSL RSA Key generation algorithm has been shown to be vulnerable to a cache timing side channel attack. An attac

tlslite-ng version 0.7.3 and earlier, since commit d7b288316bca7bcdd082e6ccff5491e241305233 contains a CWE-354: Improper

Vulnerability in the Oracle HTTP Server component of Oracle Fusion Middleware (subcomponent: OSSL Module). Supported ver

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Client programs). Supported versions that are

A vulnerability in the Secure Sockets Layer (SSL) Engine of Cisco Firepower System Software could allow an unauthenticat

IBM Tivoli Identity Manager 5.1.x before 5.1.0.15-ISS-TIM-IF0057 and Security Identity Manager 6.0.x before 6.0.0.4-ISS-

IBM Tivoli Identity Manager 5.1.x before 5.1.0.15-ISS-TIM-IF0057 and Security Identity Manager 6.0.x before 6.0.0.4-ISS-

curl before version 7.52.0 is vulnerable to a buffer overflow when doing a large floating point output in libcurl's impl

An exploitable denial of service vulnerability exists within the reading of proprietary server certificates in FreeRDP 2

An exploitable denial of service vulnerability exists within the handling of security data in FreeRDP 2.0.0-beta1+androi

An exploitable denial of service vulnerability exists within the handling of challenge packets in FreeRDP 2.0.0-beta1+an

An exploitable denial of service vulnerability exists within the handling of challenge packets in FreeRDP 2.0.0-beta1+an

Unbounded memory allocation in Google Guava 11.0 through 24.x before 24.1.1 allows remote attackers to conduct denial of

389 Directory Server 1.2.7.5, when built with mozldap, allows remote attackers to cause a denial of service (replica cra

A session fixaction vulnerability exists in Jenkins Google Login Plugin 1.3 and older in GoogleOAuth2SecurityRealm.java

python-oslo-middleware before versions 3.8.1, 3.19.1, 3.23.1 is vulnerable to an information disclosure. Software using

The request_dividend function of a smart contract implementation for ROC (aka Rasputin Online Coin), an Ethereum ERC20 t

The KINEPASS App for Android Ver 3.1.1 and earlier, and for iOS Ver 3.1.2 and earlier do not verify X.509 certificates f

The OpenPGP specification allows a Cipher Feedback Mode (CFB) malleability-gadget attack that can indirectly lead to pla

The S/MIME specification allows a Cipher Block Chaining (CBC) malleability-gadget attack that can indirectly lead to pla

This vulnerability allows remote attackers to deny service on vulnerable installations of The Squid Software Foundation

Symantec SSL Visibility (SSLV) 3.8.4FC, 3.10 prior to 3.10.4.1, 3.11, and 3.12 prior to 3.12.2.1 are vulnerable to the R

Symantec IntelligenceCenter 3.3 is vulnerable to the Return of the Bleichenbacher Oracle Threat (ROBOT) attack. A remote

kernel drivers before version 4.17-rc1 are vulnerable to a weakness in the Linux kernel's implementation of random seed

An issue was discovered in Joomla! Core before 3.8.8. A long running background process, such as remote checks for core

In the Linux kernel 4.13 through 4.16.11, ext4_read_inline_data() in fs/ext4/inline.c performs a memcpy with an untruste

Incorrect caching of responses to requests including an Authorization header in HAProxy 1.8.0 through 1.8.9 (if cache en

IBM Security Guardium Big Data Intelligence (SonarG) 3.1 does not renew a session variable after a successful authentica

paypal-ipn before 3.0.0 uses the `test_ipn` parameter (which is set by the PayPal IPN simulator) to determine if it shou

When server level, connection level or route level CORS configurations in hapi node module before 11.1.4 are combined an

The airbrake module 0.3.8 and earlier defaults to sending environment variables over HTTP. Environment variables can oft

electron-packager is a command line tool that packages Electron source code into `.app` and `.exe` packages. along with

csrf-lite is a cross-site request forgery protection library for framework-less node sites. csrf-lite uses `===`, a fail

engine.io-client is the client for engine.io, the implementation of a transport-based cross-browser/cross-device bi-dire

uws is a WebSocket server library. By sending a 256mb websocket message to a uws server instance with permessage-deflate

On F5 BIG-IP 13.0.0, 12.0.0-12.1.2, 11.6.1-11.6.3.1, 11.5.1-11.5.5, or 11.2.1, when processing DIAMETER transactions wit

cobalt-cli downloads resources over HTTP, which leaves it vulnerable to MITM attacks.

bionode-sra is a Node.js wrapper for SRA Toolkit. bionode-sra downloads data resources over HTTP, which leaves it vulner