In GNU Binutils 2.31.1, there is a use-after-free in the error function in elfcomm.c when called from the process_archive function in readelf.c via a crafted ELF file. Date published : 2018-12-31 http://www.securityfocus.com/bid/106370 https://support.f5.com/csp/article/K38336243
JasPer 2.0.14 has a memory leak in base/jas_malloc.c in libjasper.a when "–output-format jp2" is used. Date published : 2018-12-31 http://www.securityfocus.com/bid/106373 https://github.com/mdadams/jasper/issues/193
ok-file-formats through 2018-10-16 has a heap-based buffer over-read in the ok_mo_decode2 function in ok_mo.c. Date published : 2018-12-31 https://github.com/brackeen/ok-file-formats/issues/6
ok-file-formats through 2018-10-16 has a heap-based buffer overflow in the ok_csv_decode2 function in ok_csv.c. Date published : 2018-12-31 https://github.com/brackeen/ok-file-formats/issues/5
ok-file-formats through 2018-10-16 has a heap-based buffer overflow in the ok_wav_decode_ms_adpcm_data function in ok_wav.c. Date published : 2018-12-31 https://github.com/brackeen/ok-file-formats/issues/4
A local, authenticated attacker can bypass the passcode in the VideoLAN VLC media player app before 3.1.5 for iOS by opening a URL and turning the phone. Date published : 2018-12-31 https://itunes.apple.com/ms/app/vlc-for-mobile/id650377962?mt=8 https://github.com/videolan/vlc-ios/pull/178/commits/d84d7c0a94eb7fba202d2c5fc3739276d2d3986f
CuppaCMS has XSS via an SVG document uploaded to the administrator/#/component/table_manager/view/cu_views URI. Date published : 2018-12-31 https://github.com/CuppaCMS/CuppaCMS/issues/3 https://github.com/security-breachlock/CVE-2018-19918/blob/master/cuppa_svg.pdf
Stored XSS exists in razorCMS 3.4.8 via the /#/page description parameter. Date published : 2018-12-31 https://github.com/security-breachlock/CVE-2018-19906/blob/master/razor_xss.pdf https://github.com/smiffy6969/razorCMS/issues/56
HTML injection exists in razorCMS 3.4.8 via the /#/page keywords parameter. Date published : 2018-12-31 https://github.com/security-breachlock/CVE-2018-19905/blob/master/RAZOR_HTML.pdf
Persistent XSS exists in XSLT CMS via the create/?action=items.edit&type=Page "body" field. Date published : 2018-12-31 https://github.com/security-breachlock/CVE-2018-19904/blob/master/XSS2.pdf
Persistent XSS exists in XSLT CMS via the create/?action=items.edit&type=Page title field. Date published : 2018-12-31 https://github.com/security-breachlock/CVE-2018-19903/blob/master/XSS1.pdf
No-CMS 1.1.3 is prone to Persistent XSS via the blog/manage_article "keyword" parameter. Date published : 2018-12-31 https://github.com/security-breachlock/CVE-2018-19902/blob/master/XSS.pdf
No-CMS 1.1.3 is prone to Persistent XSS via the blog/manage_article/index/ "article_title" parameter. Date published : 2018-12-31 https://github.com/security-breachlock/CVE-2018-19901/blob/master/XSS-1.pdf
There is Stored XSS in GetSimple CMS 3.3.12 via the admin/edit.php "post-menu" parameter, a related issue to CVE-2018-16325. Date published : 2018-12-31 https://github.com/security-breachlock/CVE-2018-19845/blob/master/XSS.pdf