Arjun Basnet from Securin

World-accessible IPC shared memory with predictable name in TightVNC Server

Out-of-bounds read in TightVNC Viewer ZRLE palette decoding

WinRAR / UnRAR RAR5 recovery-volume (.rev) out-of-bounds heap write in RecVolumes5::ReadHeader

system() after failed chdir()

SQL injection in MySQL CNID backend

Stack buffer overflow via UCS-2 type confusion in convert_charset()

Out-of-bounds write in convert_charset() null termination

Heap buffer overflow in CNID daemon comm_rcv()

Arbitrary file read via attacker-controlled symlink creation

Weak cryptography in DHCAST128 UAM