A potential vulnerability in the WMI Setup driver on some consumer Lenovo Notebook devices may allow an attacker with elevated privileges to modify secure boot setting by modifying an NVRAM variable.

There is a heap-based buffer over-read in libdwarf 0.4.0. This issue is related to dwarf_global_formref_b.

The NT auth module in OpenAM before 14.6.6 allows a “replace Samba username attack.”

Yii Yii2 Gii through 2.2.4 allows stored XSS by injecting a payload into any field.

In Zalando Skipper before 0.13.218, a query predicate could be bypassed via a prepared request.

totd before 1.5.3 does not properly randomize mesg IDs.