It was found that some PostgreSQL extensions did not use search_path safely in their installation script. An attacker with sufficient privileges could use this flaw to trick an administrator into executing a specially crafted script, during the insta

GRUB2 contains a race condition in grub_script_function_create() leading to a use-after-free vulnerability which can be triggered by redefining a function whilst the same function is already executing, leading to arbitrary code execution and secure b

GRUB2 fails to validate kernel signature when booted directly without shim, allowing secure boot to be bypassed. This only affects systems where the kernel signing certificate has been imported directly into the secure boot database and the GRUB imag

Integer overflows were discovered in the functions grub_cmd_initrd and grub_initrd_init in the efilinux component of GRUB2, as shipped in Debian, Red Hat, and Ubuntu (the functionality is not included in GRUB2 upstream), leading to a heap-based buffe

tftp.c in libslirp 4.1.0, as used in QEMU 4.2.0, does not prevent ..\ directory traversal on Windows.

Python keyring has insecure permissions on new databases allowing world-readable files to be created

letodms 3.3.6 has CSRF via change password

letodms has multiple XSS issues: Reflected XSS in Login Page, Stored XSS in Document Owner/User name, Stored XSS in Calendar

atop: symlink attack possible due to insecure tempfile handling

Elgg through 1.7.10 has XSS

Elgg through 1.7.10 has a SQL injection vulnerability

statusnet before 0.9.9 has XSS

TWiki allows arbitrary shell command execution via the Include function

qtparted has insecure library loading which may allow arbitrary code execution

pootle 2.0.5 has XSS via 'match_names' parameter

pixelpost 1.7.1 has SQL injection

pixelpost 1.7.1 has XSS

Snoopy before 2.0.0 has a security hole in exec cURL

mailscanner can allow local users to prevent virus signatures from being updated