Open redirect vulnerability in a report-routing component in Symantec Endpoint Protection Manager (SEPM) 12.1 before RU6 MP5 allows remote authenticated users to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.

Cross-site scripting (XSS) vulnerability in the Horde Text Filter API in Horde Groupware and Horde Groupware Webmail Edition before 5.2.16 allows remote attackers to inject arbitrary web script or HTML via crafted data:text/html content in a form (1) action or (2) xlink attribute.

Ruckus Wireless H500 web management interface denial of service

Reflected XSS in wordpress plugin wpsolr-search-engine v7.6

Reflected XSS in wordpress plugin tera-charts v1.0

Reflected XSS in wordpress plugin simplified-content v1.0.0

Reflected XSS in wordpress plugin recipes-writer v1.0.4

Reflected XSS in wordpress plugin pondol-carousel v1.0

Reflected XSS in wordpress plugin photoxhibit v2.1.8

CAREL PlantVisorEnhanced allows remote attackers to bypass intended access restrictions via a direct file request.

Mozilla: global-buffer-overflow in mozilla::gfx::FilterSupport::ComputeSourceNeededRegions (MFSA 2016-85)

Buffer overflow in the mozilla::gfx::FilterSupport::ComputeSourceNeededRegions function in Mozilla Firefox before 49.0 allows remote attackers to execute arbitrary code by leveraging improper interaction between empty filters and CANVAS element rendering.

Heap-based buffer overflow in MICROSYS PROMOTIC before 8.3.11 allows remote authenticated users to cause a denial of service via a malformed HTML document.

An HTTP servlet in vApp Manager in EMC Unisphere for VMAX Virtual Appliance before 8.2.0 allows remote attackers to write to arbitrary files via a crafted pathname.

EMC NetWorker 8.2.1.x and 8.2.2.x before 8.2.2.6 and 9.x before 9.0.0.6 mishandles authentication, which allows remote attackers to execute arbitrary commands by leveraging access to a different NetWorker instance.

Mozilla: iframe src fragment timing attack can reveal cross-origin data (MFSA 2016-85)

Mozilla Firefox before 49.0 allows remote attackers to bypass the Same Origin Policy via a crafted fragment identifier in the SRC attribute of an IFRAME element, leading to insufficient restrictions on link-color information after a document is resized.

Mirror Manager version 0.7.2 and older is vulnerable to remote code execution in the checkin code.

TGCaptcha2 version 0.3.0 is vulnerable to a replay attack due to a missing nonce allowing attackers to use a single solved CAPTCHA multiple times.

Reflected XSS in wordpress plugin admin-font-editor v1.8

Reflected XSS in wordpress plugin e-search v1.0

Mozilla: Heap-buffer-overflow in nsCaseTransformTextRunFactory::TransformString (MFSA 2016-85, MFSA 2016-86)

Heap-based buffer overflow in the nsCaseTransformTextRunFactory::TransformString function in Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4, and Thunderbird < 45.4 allows remote attackers to cause a denial of service (boolean out-of-bounds write) or possibly have unspecified other impact via Unicode characters that are mishandled during text conversion.