Cross-site scripting (XSS) vulnerability in the web UI in Mailman before 2.1.26 allows remote attackers to inject arbitrary web script or HTML via a user-options URL

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: AWT)

The docshell implementation in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and SeaMonkey before 2.26 allows remote attackers to trigger the…

There is an issue with grub2 before version 2.06 while handling symlink on ext filesystems

There is an issue on grub2 before version 2.06 at function read_section_as_string()

The vga_draw_text function in Qemu allows local OS guest privileged users to cause a denial of service (out-of-bounds read and QEMU process crash) by leveraging improper memory…

Glibc: potential use-after-free in gaih_inet()

A flaw was found in the way samba implemented SMB1 authentication

A NULL pointer dereference flaw was found in the Linux kernel's SELinux subsystem in versions before 5.7

Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: RMI)

When proxy auto-detection is enabled, if a web server serves a Proxy Auto-Configuration (PAC) file or if a PAC file is loaded locally, this PAC file can specify that requests to…

An issue was discovered in OpenSSH 7.9

An error in TSIG authentication can permit unauthorized dynamic updates

Combination of DNS64 and RPZ Can Lead to Crash

An error handling synthesized records could cause an assertion failure when using DNS64 with "break-dnssec yes;"

It was found that Diffie Hellman Client key exchange handling in NSS 3.21.x was vulnerable to small subgroup confinement attack

389-ds-base before versions 1.4.0.10, 1.3.8.3 is vulnerable to a race condition in the way 389-ds-base handles persistent search, resulting in a crash if the server is under load

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Client programs)

In systemd prior to 234 a race condition exists between .mount and .automount units such that automount requests from kernel may not be serviced by systemd resulting in kernel…

Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JCE)

The Realm implementations in Apache Tomcat versions 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 did not process the supplied…

Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JCE)

ntpq in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (crash) via crafted mode 6 response packets

ISC BIND 9.x before 9.9.9-P2, 9.10.x before 9.10.4-P2, and 9.11.x before 9.11.0b2, when lwresd or the named lwres option is enabled, allows remote attackers to cause a denial of…

Oracle MySQL before 5.7.3, Oracle MySQL Connector/C (aka libmysqlclient) before 6.1.3, and MariaDB before 5.5.44 use the --ssl option to mean that SSL is optional, which allows…

A flaw was found in c-ares library, where a missing input validation check of host names returned by DNS (Domain Name Servers) can lead to output of wrong hostnames which might…

An information disclosure vulnerability exists when certain central processing units (CPU) speculatively access memory

A flaw was found in the way KVM hypervisor handled x2APIC Machine Specific Rregister (MSR) access with nested(=1) virtualization enabled

Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JSSE)

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Packaging)

A heap overflow flaw was found in 389-ds-base

A flaw was found in the Linux kernel

A NULL pointer dereference flaw was found in the Linux kernel’s IEEE 802.15.4 wireless networking subsystem in the way the user closes the LR-WPAN connection

A memory leak flaw was found in the Linux kernel in the ccp_run_aes_gcm_cmd() function in drivers/crypto/ccp/ccp-ops.c, which allows attackers to cause a denial of service (memory…

Qemu before 2.0 block driver for Hyper-V VHDX Images is vulnerable to infinite loops and other potential issues when calculating BAT entries, due to missing bounds checks for…

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Security: Audit)

fs/ext4/extents.c in the Linux kernel through 5.1.2 does not zero out the unused memory region in the extent tree block, which might allow local users to obtain sensitive…

The tiff_document_render() and tiff_document_get_thumbnail() functions in the TIFF document backend in GNOME Evince through 3.32.0 did not handle errors from…

It was found that the forceput operator could be extracted from the DefineResource method in ghostscript before 9.27

It was found that the superexec operator was available in the internal dictionary in ghostscript before 9.27

The KVM implementation in the Linux kernel through 4.20.5 has an Information Leak

An issue was discovered in sd-bus in systemd 239

In elfutils 0.175, a negative-sized memcpy is attempted in elf_cvt_note in libelf/note_xlate.h because of an incorrect overflow check

In elfutils 0.175, a heap-based buffer over-read was discovered in the function elf32_xlatetom in elf32_xlatetom.c in libelf

An issue was discovered in elfutils 0.175

Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Replication)

The userfaultfd implementation in the Linux kernel before 4.19.7 mishandles access control for certain UFFDIO_ ioctl calls, as demonstrated by allowing local users to write data…

The Linux kernel before 4.15-rc8 was found to be vulnerable to a NULL pointer dereference bug in the __netlink_ns_capable() function in the net/netlink/af_netlink.c file

If a user saved passwords before Firefox 58 and then later set a master password, an unencrypted copy of these passwords is still accessible

An issue was discovered in the proc_pid_stack function in fs/proc/base.c in the Linux kernel through 4.18.11