phpbb 3.0.x-3.0.6 has an XSS vulnerability via the [flash] BB tag.

Weborf before 0.12.5 is affected by a Denial of Service (DOS) due to malformed fields in HTTP.

Trac 0.11.6 does not properly check workflow permissions before modifying a ticket. This can be exploited by an attacker to change the status and resolution of tickets without having proper permissions.

pithos before 0.3.5 allows overwrite of arbitrary files via symlinks.

ConsoleKit: Policy restrictions break-out via remote Virtual Network Computing (VNC) session

In ConsoleKit before 0.4.2, an intended security policy restriction bypass was found. This flaw allows an authenticated system user to escalate their privileges by initiating a remote VNC session.

udisks: arbitrary Linux kernel loading flaw

udisks before 1.0.3 allows a local user to load arbitrary Linux kernel modules.

php: XMLWriter information leak

PHP5 before 5.4.4 allows passing invalid utf-8 strings via the xmlTextWriterWriteAttribute, which are then misparsed by libxml2. This results in memory leak into the resulting output.

xpdf: corruption of the Gfx contexts states stack

poppler before 0.16.3 has malformed commands that may cause corruption of the internal stack.

xpdf: integer overflow in CharCodeToUnicode::addMapping

An integer overflow condition in poppler before 0.16.3 can occur when parsing CharCodes for fonts.

offlineimap before 6.3.4 added support for SSL server certificate validation but it is still possible to use SSL v2 protocol, which is a flawed protocol with multiple security deficiencies.

offlineimap before 6.3.2 does not check for SSL server certificate validation when "ssl = yes" option is specified which can allow man-in-the-middle attacks.

An unchecked sscanf() call in ettercap before 0.7.5 allows an insecure temporary settings file to overflow a static-sized buffer on the stack.

TYPO3 before 4.4.1 allows XSS in the frontend search box.

babiloo 2.0.9 before 2.0.11 creates temporary files with predictable names when downloading and unpacking dictionary files, allowing a local attacker to overwrite arbitrary files.

It is possible to cause a DoS condition by causing the server to crash in alien-arena 7.33 by supplying various invalid parameters to the download command.

libpoe-component-irc-perl before v6.32 does not remove carriage returns and line feeds. This can be used to execute arbitrary IRC commands by passing an argument such as "some text\rQUIT" to the 'privmsg' handler, which would cause the client to disconnect from the server.

paxtest handles temporary files insecurely

If LD_LIBRARY_PATH is undefined in gargoyle-free before 2009-08-25, the variable will point to the current directory. This can allow a local user to trick another user into running gargoyle in a directory with a cracked libgarglk.so and gain access to the user's account.

The encrypt/decrypt functions in Ruby on Rails 2.3 are vulnerable to padding oracle attacks.

Mumble: murmur-server has DoS due to malformed client query