gri before 2.12.18 generates temporary files in an insecure way.

An access control issue in MantisBT before 1.2.13 allows users with "Reporter" permissions to change any issue to "New".

Gambas before 3.4.0 allows remote attackers to move or manipulate directory contents or perform symlink attacks due to the creation of insecure temporary directories.

clamav 0.91.2 suffers from a floating point exception when using ScanOLE2.

Lintian before 2.5.12 allows remote attackers to gather information about the "host" system using crafted symlinks.

viewvc 1.0.3 allows improper access control to files in a repository when using the "forbidden" configuration option.

ldap-git-backup before 1.0.4 exposes password hashes due to incorrect directory permissions.

The keygen.sh script in Shibboleth SP 2.0 (located in /usr/local/etc/shibboleth by default) uses OpenSSL to create a DES private key which is placed in sp-key.pm. It relies on the root umask (default 22) instead of chmoding the resulting file itself, so the generated private key is world readable by default.

Rob Richards XmlSecLibs, all versions prior to v3.0.3, as used for example by SimpleSAMLphp, performed incorrect validation of cryptographic signatures in XML messages, allowing an authenticated attacker to impersonate others or elevate privileges by creating a crafted XML message.

Tahoe-LAFS 1.9.0 fails to ensure integrity which allows remote attackers to corrupt mutable files or directories upon retrieval.

OpenTTD before 1.1.5 contains a Denial of Service (slow read attack) that prevents users from joining the server.

A memory leak in the af9005_identify_state() function in drivers/media/usb/dvb-usb/af9005.c in the Linux kernel through 5.3.9 allows attackers to cause a denial of service (memory consumption), aka CID-2289adbfa559.

JSP Dump and Session Dump Servlet XSS in jetty before 6.1.22.

Dump Servlet information leak in jetty before 6.1.22.

WebApp JSP Snoop page XSS in jetty though 6.1.21.

drupal6 version 6.16 has open redirection

TYPO3 before 4.5.4 allows Information Disclosure in the backend.

simplesamlphp before 1.6.3 (squeeze) and before 1.8.2 (sid) incorrectly handles XML encryption which could allow remote attackers to decrypt or forge messages.

There is a possible heap overflow in libclamav/fsg.c before 0.100.0.

archivemail 0.6.2 uses temporary files insecurely leading to a possible race condition.