Multiple cross-site scripting (XSS) vulnerabilities in Red Hat Satellite 5 allow remote attackers to inject arbitrary web script or HTML via (1) the label parameter to admin/BunchDetail.do; (2) the package_name, (3) search_subscribed_channels, or (4) channel_filter parameter to software/packages/NameOverview.do; or unspecified vectors related to (5) <input:hidden> or (6) <bean:message> tags.

Shoplat App for iOS 1.10.00 through 1.18.00 does not properly verify SSL certificates.

The AMF3ReadString function in amf.c in RTMPDump 2.4 allows remote RTMP Media servers to cause a denial of service (invalid pointer dereference and process crash).

Pulp before 2.8.3 creates a temporary directory during CA key generation in an insecure manner.

Firejail uses weak permissions for /dev/shm/firejail and possibly other files, which allows local users to gain privileges.

modules/chef.py in SaltStack before 2014.7.4 does not properly handle files in /tmp.

SeaWell Networks Spectrum SDC 02.05.00 has a default password of “admin” for the “admin” account.

The “Smart related articles” extension 1.1 for Joomla! does not prevent direct requests to dialog.php (there is a missing _JEXEC check).

The “Smart related articles” extension 1.1 for Joomla! has XSS in dialog.php (n_art,type in GET Method).

The “Smart related articles” extension 1.1 for Joomla! has SQL injection in dialog.php (attacker must use search_cats variable in POST method to exploit this vulnerability).