Splunk 5.0.3 has an Unquoted Service Path in Windows for Universal Forwarder which can allow an attacker to escalate privileges

Splunk before 5.0.4 lacks X-Frame-Options which can allow Clickjacking

IBM SPSS Modeler before 16 on UNIX allows remote authenticated users to bypass intended access restrictions via an SSO token. IBM X-Force ID: 89855.

Tube Map Live Underground for Android before 3.0.22 has an Information Disclosure Vulnerability

Bayeux: Reflected Cross-Site Scripting (XSS)

JBossWeb Bayeux has reflected XSS

rubygem-nokogiri: DoS while parsing XML entities

Nokogiri gem 1.5.x and 1.6.x has DoS while parsing XML entities by failing to apply limits

rubygem-nokogiri: DoS while parsing XML documents

Nokogiri gem 1.5.x has Denial of Service via infinite loop when parsing XML documents

The CentralAuth extension for MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 allows remote attackers to obtain usernames via vectors related to writing the names to the DOM of a page.

Cross-site scripting (XSS) vulnerability in MediaWiki 1.19.9 before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 allows remote attackers to inject arbitrary web script or HTML via unspecified CSS values.

Framework: org.spring.web.util.JavaScriptUtils.javaScriptEscape insufficient escaping of characters

The JavaScriptUtils.javaScriptEscape method in web/util/JavaScriptUtils.java in Spring MVC in Spring Framework before 3.2.2 does not properly escape certain characters, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a (1) line separator or (2) paragraph separator Unicode character or (3) left or (4) right angle bracket.

Horde Groupware Web mail 5.1.2 has CSRF with requests to change permissions

Horde Groupware Webmail Edition has CSRF and XSS when saving search as a virtual address book

Xerox ColorCube and WorkCenter devices in 2013 had hardcoded FTP and shell user accounts.

TRENDnet TS-S402 has a backdoor to enable TELNET.

PrestaShop 1.5.5 allows remote authenticated attackers to execute arbitrary code by uploading a crafted profile and then accessing it in the module/ directory.

PrestaShop 1.5.5 vulnerable to privilege escalation via a Salesman account via upload module

QNAP VioCard 300 has hardcoded RSA private keys.

QNAP F_VioCard 2312 and F_VioGate 2308 have hardcoded entries in authorized_keys files. NOTE: 1. All active models are not affected. The last affected model was EOL since 2010. 2. The legacy authorization mechanism is no longer adopted in all active models

Multiple CSRF issues in Horde Groupware Webmail Edition 5.1.2 and earlier in basic.php.

The NotificationBroadcastReceiver class in the com.android.phone process in Google Android 4.1.1 through 4.4.2 allows attackers to bypass intended access restrictions and consequently make phone calls to arbitrary numbers, send mmi or ussd codes, or hangup ongoing calls via a crafted application.