letodms has multiple XSS issues: Reflected XSS in Login Page, Stored XSS in Document Owner/User name, Stored XSS in Calendar

mono 2.10.x ASP.NET Web Form Hash collision DoS

ecryptfs-utils: suid helper does not restrict mounting filesystems with nosuid,nodev leading to possible privilege escalation

ecryptfs-utils: suid helper does not restrict mounting filesystems with nosuid,nodev which creates a possible privilege escalation

NetworkManager: creating new WPA-secured wireless network results in insecure network being created instead

In NetworkManager 0.9.2.0, when a new wireless network was created with WPA/WPA2 security in AdHoc mode, it created an open/insecure network.

pam_shield before 0.9.4: Default configuration does not perform protective action

An issue was discovered in dhclient 4.3.1-6 due to an embedded path variable.

Multiple cross-site scripting (XSS) vulnerabilities in Mahara 1.4.x before 1.4.3 and 1.5.x before 1.5.2 allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) javascript innerHTML as used when generating login forms, (2) links or (3) resources URLs, and (4) the Display name in a user profile.

A Security Bypass vulnerability exists in PolarSSL 0.99pre4 through 1.1.1 due to a weak encryption error when generating Diffie-Hellman values and RSA keys.

lib/libc/stdlib/random.c in OpenBSD returns 0 when seeded with 0.

OpenStack Keystone: extremely long passwords can crash Keystone by exhausting stack space

Moodle has a database activity export permission issue where the export function of the database activity module exports all entries even those from groups the user does not belong to

A Cross-Site Scripting (XSS) vulnerability exists in LDAP Account Manager (LAM) Pro 3.6 in the export, add_value_form, and dn parameters to cmd.php.

A Cross-Site Scripting (XSS) vulnerability exists in LDAP Account Manager (LAM) Pro 3.6 in the filter parameter to cmd.php in an export and exporter_id action. and the filteruid parameter to list.php.

An Information Disclosure vulnerability exists in the Jasig Project php-pear-CAS 1.2.2 package in the /tmp directory. The Central Authentication Service client library archives the debug logging file in an insecure manner.

A Security Bypass vulnerability exists in the phpCAS 1.2.2 library from the jasig project due to the way proxying of services are managed.

wpa_supplicant: Improper x509v3 certificate and key file paths sanitization

NetworkManager 0.9 and earlier allows local users to use other users' certificates or private keys when making a connection via the file path when adding a new connection.

The init script in the Debian x11-common package before 1:7.6+12 is vulnerable to a symlink attack that can lead to a privilege escalation during package installation.

Information-disclosure vulnerability in Netsurf through 2.8 due to a world-readable cookie jar.

uzbl: Information disclosure via world-readable cookies storage file

surf: cookie jar has read access from other local user