libpoe-component-irc-perl before v6.32 does not remove carriage returns and line feeds. This can be used to execute arbitrary IRC commands by passing an argument such as "some text\rQUIT" to the 'privmsg' handler, which would cause the client to disconnect from the server.

If LD_LIBRARY_PATH is undefined in gargoyle-free before 2009-08-25, the variable will point to the current directory. This can allow a local user to trick another user into running gargoyle in a directory with a cracked libgarglk.so and gain access to the user's account.

OpenStack Keystone: extremely long passwords can crash Keystone by exhausting stack space

atop: symlink attack possible due to insecure tempfile handling

gdk-pixbuf through 2.31.1 has GIF loader buffer overflow when initializing decompression tables due to an input validation flaw

liboping 1.3.2 allows users reading arbitrary files upon the local system.

gri before 2.12.18 generates temporary files in an insecure way.

Gambas before 3.4.0 allows remote attackers to move or manipulate directory contents or perform symlink attacks due to the creation of insecure temporary directories.

clamav 0.91.2 suffers from a floating point exception when using ScanOLE2.

Lintian before 2.5.12 allows remote attackers to gather information about the "host" system using crafted symlinks.

viewvc 1.0.3 allows improper access control to files in a repository when using the "forbidden" configuration option.

ldap-git-backup before 1.0.4 exposes password hashes due to incorrect directory permissions.

Rob Richards XmlSecLibs, all versions prior to v3.0.3, as used for example by SimpleSAMLphp, performed incorrect validation of cryptographic signatures in XML messages, allowing an authenticated attacker to impersonate others or elevate privileges by creating a crafted XML message.

Tahoe-LAFS 1.9.0 fails to ensure integrity which allows remote attackers to corrupt mutable files or directories upon retrieval.

OpenTTD before 1.1.5 contains a Denial of Service (slow read attack) that prevents users from joining the server.

DjVuLibre 3.5.27 has a NULL pointer dereference in the function DJVU::filter_fv at IW44EncodeCodec.cpp.

simplesamlphp before 1.6.3 (squeeze) and before 1.8.2 (sid) incorrectly handles XML encryption which could allow remote attackers to decrypt or forge messages.

There is a possible heap overflow in libclamav/fsg.c before 0.100.0.

archivemail 0.6.2 uses temporary files insecurely leading to a possible race condition.

The mirroring support (-M, --use-mirrors) in Python Pip before 1.5 uses insecure DNS querying and authenticity checks which allows attackers to perform man-in-the-middle attacks.