Weekly Vulnerabilities Reports > June 11 to 17, 2018

Overview

613 new vulnerabilities reported during this period, including 21 critical vulnerabilities and 161 high severity vulnerabilities. This weekly summary report vulnerabilities in 241 products from 129 vendors including Mozilla, Debian, Redhat, Canonical, and Microsoft. Vulnerabilities are notably categorized as "Improper Input Validation", "Improper Restriction of Operations within the Bounds of a Memory Buffer", "Use After Free", "Information Exposure", and "Cross-site Scripting".

  • 515 reported vulnerabilities are remotely exploitables.
  • 36 reported vulnerabilities have public exploit available.
  • 103 reported vulnerabilities are related to weaknesses in OWASP Top Ten.
  • 567 reported vulnerabilities are exploitable by an anonymous user.
  • Mozilla has the most reported vulnerabilities, with 321 reported vulnerabilities.
  • Mozilla has the most reported critical vulnerabilities, with 11 reported vulnerabilities.

TOTAL
VULNERABILITIES
CRITICAL RISK
VULNERABILITIES
HIGH RISK
VULNERABILITIES
MEDIUM RISK
VULNERABILITIES
LOW RISK
VULNERABILITIES
REMOTELY
EXPLOITABLE
LOCALLY
EXPLOITABLE
EXPLOIT
AVAILABLE
EXPLOITABLE
ANONYMOUSLY
AFFECTING
WEB APPLICATION

Vulnerability Details

The following table list reported vulnerabilities for the period covered by this report:

Expand/Hide

21 Critical Vulnerabilities

DATE CVE VENDOR VULNERABILITY CVSS
2018-06-17 CVE-2018-12072 Cloudmedia Unspecified vulnerability in Cloudmedia Popcorn A-200 Firmware 030513070821Pop411000

An issue was discovered in Cloud Media Popcorn A-200 03-05-130708-21-POP-411-000 firmware.

10.0
2018-06-17 CVE-2018-10997 Etere SQL Injection vulnerability in Etere Etereweb

Etere EtereWeb before 28.1.20 has a pre-authentication blind SQL injection in the POST parameters txUserName and txPassword.

10.0
2018-06-17 CVE-2018-12338 Ecos Unspecified vulnerability in Ecos System Management Appliance 5.2.68

Undocumented Factory Backdoor in ECOS System Management Appliance (aka SMA) 5.2.68 allows the vendor to extract confidential information and manipulate security relevant configurations via remote root SSH access.

10.0
2018-06-17 CVE-2018-12336 Ecos Information Exposure vulnerability in Ecos Secure Boot Stick Firmware 5.6.5

Undocumented Factory Backdoor in ECOS Secure Boot Stick (aka SBS) 5.6.5 allows the vendor to extract confidential information via remote root SSH access.

10.0
2018-06-15 CVE-2018-1085 Redhat Improper Authentication vulnerability in Redhat Openshift Container Platform

openshift-ansible before versions 3.9.23, 3.7.46 deploys a misconfigured etcd file that causes the SSL client certificate authentication to be disabled.

10.0
2018-06-12 CVE-2018-1151 Westerndigital Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in Westerndigital TV Live HUB Firmware and TV Media Player Firmware

The web server on Western Digital TV Media Player 1.03.07 and TV Live Hub 3.12.13 allow unauthenticated remote attackers to execute arbitrary code or cause denial of service via crafted HTTP requests to toServerValue.cgi.

10.0
2018-06-11 CVE-2018-5151 Mozilla
Canonical
Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in multiple products

Memory safety bugs were reported in Firefox 59.

10.0
2018-06-11 CVE-2018-5090 Mozilla
Canonical
Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in multiple products

Memory safety bugs were reported in Firefox 57.

10.0
2018-06-11 CVE-2017-7827 Mozilla Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in Mozilla Firefox

Memory safety bugs were reported in Firefox 56.

10.0
2018-06-11 CVE-2017-7826 Debian
Redhat
Canonical
Mozilla
Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in multiple products

Memory safety bugs were reported in Firefox 56 and Firefox ESR 52.4.

10.0
2018-06-11 CVE-2017-7811 Mozilla Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in Mozilla Firefox

Memory safety bugs were reported in Firefox 55.

10.0
2018-06-11 CVE-2017-7810 Debian
Redhat
Canonical
Mozilla
Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in multiple products

Memory safety bugs were reported in Firefox 55 and Firefox ESR 52.3.

10.0
2018-06-11 CVE-2017-7779 Debian
Redhat
Mozilla
Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in multiple products

Memory safety bugs were reported in Firefox 54, Firefox ESR 52.2, and Thunderbird 52.2.

10.0
2018-06-11 CVE-2017-5399 Mozilla Buffer Errors vulnerability in Mozilla Firefox and Thunderbird

Memory safety bugs were reported in Firefox 51.

10.0
2018-06-11 CVE-2017-5398 Debian
Redhat
Mozilla
Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in multiple products

Memory safety bugs were reported in Thunderbird 45.7.

10.0
2018-06-11 CVE-2017-5397 Mozilla Inclusion of Functionality From Untrusted Control Sphere vulnerability in Mozilla Firefox

The cache directory on the local file system is set to be world writable.

10.0
2018-06-14 CVE-2017-17173 Huawei Improper Input Validation vulnerability in Huawei Mate 9 PRO Fimware Lonal00B8.0.0.334(C00)/Lonal00B8.0.0.340A(C00)

Due to insufficient parameters verification GPU driver of Mate 9 Pro Huawei smart phones with the versions before LON-AL00B 8.0.0.356(C00) has an arbitrary memory free vulnerability.

9.3
2018-06-14 CVE-2018-8248 Microsoft Unspecified vulnerability in Microsoft Office 2010/2013/2016

A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka "Microsoft Excel Remote Code Execution Vulnerability." This affects Microsoft Office.

9.3
2018-06-14 CVE-2018-8231 Microsoft Unspecified vulnerability in Microsoft products

A remote code execution vulnerability exists when HTTP Protocol Stack (Http.sys) improperly handles objects in memory, aka "HTTP Protocol Stack Remote Code Execution Vulnerability." This affects Windows Server 2016, Windows 10, Windows 10 Servers.

9.3
2018-06-14 CVE-2018-8225 Microsoft Unspecified vulnerability in Microsoft products

A remote code execution vulnerability exists in Windows Domain Name System (DNS) DNSAPI.dll when it fails to properly handle DNS responses, aka "Windows DNSAPI Remote Code Execution Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers.

9.3
2018-06-11 CVE-2017-7845 Mozilla
Microsoft
Buffer Errors vulnerability in Mozilla Firefox, Firefox ESR and Thunderbird

A buffer overflow occurs when drawing and validating elements using Direct 3D 9 with the ANGLE graphics library, used for WebGL content.

9.3

161 High Vulnerabilities

DATE CVE VENDOR VULNERABILITY CVSS
2018-06-17 CVE-2018-12330 Ecos Unspecified vulnerability in Ecos Secure Boot Stick Firmware 5.6.5

Protection Mechanism Failure in ECOS Secure Boot Stick (aka SBS) 5.6.5 allows an attacker to compromise authentication and encryption keys via compromised firmware.

8.5
2018-06-14 CVE-2017-17309 Huawei Path Traversal vulnerability in Huawei Hg255S-10 Firmware V100R001C163B025Sp02

Huawei HG255s-10 V100R001C163B025SP02 has a path traversal vulnerability due to insufficient validation of the received HTTP requests, a remote attacker may access the local files on the device without authentication.

7.8
2018-06-14 CVE-2018-8226 Microsoft Unspecified vulnerability in Microsoft products

A denial of service vulnerability exists in the HTTP 2.0 protocol stack (HTTP.sys) when HTTP.sys improperly parses specially crafted HTTP 2.0 requests, aka "HTTP.sys Denial of Service Vulnerability." This affects Windows Server 2016, Windows 10, Windows 10 Servers.

7.8
2018-06-13 CVE-2018-7162 Nodejs Improper Input Validation vulnerability in Nodejs Node.Js

All versions of Node.js 9.x and 10.x are vulnerable and the severity is HIGH.

7.8
2018-06-13 CVE-2018-7161 Nodejs Improper Input Validation vulnerability in Nodejs Node.Js

All versions of Node.js 8.x, 9.x, and 10.x are vulnerable and the severity is HIGH.

7.8
2018-06-11 CVE-2017-5419 Mozilla Multiple Security vulnerability in Mozilla Firefox and Thunderbird

If a malicious site repeatedly triggers a modal authentication prompt, eventually the browser UI will become non-responsive, requiring shutdown through the operating system.

7.8
2018-06-14 CVE-2018-8267 Microsoft Out-Of-Bounds Write vulnerability in Microsoft Internet Explorer 10/11/9

A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "Scripting Engine Memory Corruption Vulnerability." This affects Internet Explorer 9, Internet Explorer 11, Internet Explorer 10.

7.6
2018-06-14 CVE-2018-8251 Microsoft Out-Of-Bounds Write vulnerability in Microsoft products

A memory corruption vulnerability exists when Windows Media Foundation improperly handles objects in memory, aka "Media Foundation Memory Corruption Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers.

7.6
2018-06-14 CVE-2018-8249 Microsoft Out-Of-Bounds Write vulnerability in Microsoft Internet Explorer 11

A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, aka "Internet Explorer Memory Corruption Vulnerability." This affects Internet Explorer 11.

7.6
2018-06-14 CVE-2018-8243 Microsoft Out-Of-Bounds Write vulnerability in Microsoft Chakracore

A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability." This affects ChakraCore.

7.6
2018-06-14 CVE-2018-8236 Microsoft Out-Of-Bounds Write vulnerability in Microsoft Edge

A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka "Microsoft Edge Memory Corruption Vulnerability." This affects Microsoft Edge.

7.6
2018-06-14 CVE-2018-8229 Microsoft Type Confusion vulnerability in Microsoft Chakracore and Edge

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore.

7.6
2018-06-14 CVE-2018-8227 Microsoft Out-Of-Bounds Write vulnerability in Microsoft Chakracore and Edge

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore.

7.6
2018-06-14 CVE-2018-8111 Microsoft Out-Of-Bounds Write vulnerability in Microsoft Edge

A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka "Microsoft Edge Memory Corruption Vulnerability." This affects Microsoft Edge.

7.6
2018-06-14 CVE-2018-8110 Microsoft Out-Of-Bounds Write vulnerability in Microsoft Edge

A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka "Microsoft Edge Memory Corruption Vulnerability." This affects Microsoft Edge.

7.6
2018-06-14 CVE-2018-0978 Microsoft Out-Of-Bounds Write vulnerability in Microsoft Internet Explorer 10/11/9

A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, aka "Internet Explorer Memory Corruption Vulnerability." This affects Internet Explorer 9, Internet Explorer 11, Internet Explorer 10.

7.6
2018-06-17 CVE-2018-12071 Codeigniter Session Fixation vulnerability in Codeigniter

A Session Fixation issue exists in CodeIgniter before 3.1.9 because session.use_strict_mode in the Session Library was mishandled.

7.5
2018-06-17 CVE-2018-12026 Phusion Link Following vulnerability in Phusion Passenger 5.3.0/5.3.1

During the spawning of a malicious Passenger-managed application, SpawningKit in Phusion Passenger 5.3.x before 5.3.2 allows such applications to replace key files or directories in the spawning communication directory with symlinks.

7.5
2018-06-17 CVE-2018-11219 Redislabs
Debian
Oracle
Redhat
Integer Overflow OR Wraparound vulnerability in multiple products

An Integer Overflow issue was discovered in the struct library in the Lua subsystem in Redis before 3.2.12, 4.x before 4.0.10, and 5.x before 5.0 RC2, leading to a failure of bounds checking.

7.5
2018-06-17 CVE-2018-11218 Redislabs
Debian
Oracle
Redhat
Out-Of-Bounds Write vulnerability in multiple products

Memory Corruption was discovered in the cmsgpack library in the Lua subsystem in Redis before 3.2.12, 4.x before 4.0.10, and 5.x before 5.0 RC2 because of stack-based buffer overflows.

7.5
2018-06-17 CVE-2018-10969 Genetechsolutions SQL Injection vulnerability in Genetechsolutions PIE Register

SQL injection vulnerability in the Pie Register plugin before 3.0.10 for WordPress allows remote attackers to execute arbitrary SQL commands via the invitation codes grid.

7.5
2018-06-16 CVE-2018-12503 Tinyexr Project Out-Of-Bounds Read vulnerability in Tinyexr Project Tinyexr 0.9.5

tinyexr 0.9.5 has a heap-based buffer over-read in LoadEXRImageFromMemory in tinyexr.h.

7.5
2018-06-16 CVE-2018-11221 Artica Unrestricted Upload of File With Dangerous Type vulnerability in Artica Pandora FMS

Unauthenticated untrusted file upload in Artica Pandora FMS through version 7.23 allows an attacker to upload an arbitrary plugin via include/ajax/update_manager.ajax in the update system.

7.5
2018-06-15 CVE-2018-12498 Icmsdev SQL Injection vulnerability in Icmsdev Icms 7.0.8

spider.admincp.php in iCMS v7.0.8 has SQL Injection via the id parameter in an app=spider&do=batch request to admincp.php.

7.5
2018-06-15 CVE-2018-12491 Phpok Unrestricted Upload of File With Dangerous Type vulnerability in PHPok 4.9.032

PHPOK 4.9.032 has an arbitrary file upload vulnerability in the import_f function in framework/admin/modulec_control.php, as demonstrated by uploading a .php file within a .php.zip archive, a similar issue to CVE-2018-8944.

7.5
2018-06-15 CVE-2018-12422 Gnome Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in Gnome Evolution

** DISPUTED ** addressbook/backends/ldap/e-book-backend-ldap.c in Evolution-Data-Server in GNOME Evolution through 3.29.2 might allow attackers to trigger a Buffer Overflow via a long query that is processed by the strcat function.

7.5
2018-06-15 CVE-2018-12356 Simple Password Store Project Improper Verification of Cryptographic Signature vulnerability in Simple Password Store Project Simple Password Store

An issue was discovered in password-store.sh in pass in Simple Password Store 1.7.x before 1.7.2.

7.5
2018-06-14 CVE-2018-11574 Point TO Point Protocol Project Improper Input Validation vulnerability in Point-To-Point Protocol Project Point-To-Point Protocol

Improper input validation together with an integer overflow in the EAP-TLS protocol implementation in PPPD may cause a crash, information disclosure, or authentication bypass.

7.5
2018-06-13 CVE-2017-3936 Mcafee OS Command Injection vulnerability in Mcafee Epolicy Orchestrator

OS Command Injection vulnerability in McAfee ePolicy Orchestrator (ePO) 5.9.0, 5.3.2, 5.3.1, 5.1.3, 5.1.2, 5.1.1, and 5.1.0 allows attackers to run arbitrary OS commands with limited privileges via not sanitizing the user input data before exporting it into a CSV format output.

7.5
2018-06-13 CVE-2017-3907 Mcafee Code Injection vulnerability in Mcafee Threat Intelligence Exchange 2.1.0

Code Injection vulnerability in the ePolicy Orchestrator (ePO) extension in McAfee Threat Intelligence Exchange (TIE) Server 2.1.0 and earlier allows remote attackers to execute arbitrary HTML code to be reflected in the response web page via unspecified vector.

7.5
2018-06-13 CVE-2018-5488 Netapp Improper Input Validation vulnerability in Netapp products

NetApp SANtricity Web Services Proxy versions 1.10.x000.0002 through 2.12.X000.0002 and SANtricity Storage Manager 11.30.0X00.0004 through 11.42.0X00.0001 ship with the Java Management Extension Remote Method Invocation (JMX RMI) service bound to the network, and are susceptible to unauthenticated remote code execution.

7.5
2018-06-13 CVE-2018-11407 Sensiolabs Improper Authentication vulnerability in Sensiolabs Symfony

An issue was discovered in the Ldap component in Symfony 2.8.x before 2.8.37, 3.3.x before 3.3.17, 3.4.x before 3.4.7, and 4.0.x before 4.0.7.

7.5
2018-06-13 CVE-2018-12292 Palemoon USE After Free vulnerability in Palemoon Pale Moon

A use-after-free vulnerability exists in DOMProxyHandler::EnsureExpandoObject in Pale Moon before 27.9.3.

7.5
2018-06-13 CVE-2011-4183 Opensuse Unrestricted Upload of File With Dangerous Type vulnerability in Opensuse Open Build Service

A vulnerability in open build service allows remote attackers to upload arbitrary RPM files.

7.5
2018-06-13 CVE-2018-12268 Acccheck Project OS Command Injection vulnerability in Acccheck Project Acccheck.Pl 0.2.1

acccheck.pl in acccheck 0.2.1 allows Command Injection via shell metacharacters in a username or password file, as demonstrated by injection into an smbclient command line.

7.5
2018-06-12 CVE-2017-18291 Pvpgn SQL Injection vulnerability in Pvpgn Stats 2.4.6

An issue was discovered in PvPGN Stats 2.4.6.

7.5
2018-06-12 CVE-2017-18290 Pvpgn SQL Injection vulnerability in Pvpgn Stats 2.4.6

An issue was discovered in PvPGN Stats 2.4.6.

7.5
2018-06-12 CVE-2017-18289 Pvpgn SQL Injection vulnerability in Pvpgn Stats 2.4.6

An issue was discovered in PvPGN Stats 2.4.6.

7.5
2018-06-12 CVE-2017-18288 Pvpgn SQL Injection vulnerability in Pvpgn Stats 2.4.6

An issue was discovered in PvPGN Stats 2.4.6.

7.5
2018-06-12 CVE-2017-18287 Pvpgn SQL Injection vulnerability in Pvpgn Stats 2.4.6

An issue was discovered in PvPGN Stats 2.4.6.

7.5
2018-06-11 CVE-2018-6968 Vmware Unspecified vulnerability in VMWare Airwatch Agent

The VMware AirWatch Agent for Android prior to 8.2 and AirWatch Agent for Windows Mobile prior to 6.5.2 contain a remote code execution vulnerability in real time File Manager capabilities.

7.5
2018-06-11 CVE-2018-5183 Redhat
Debian
Canonical
Mozilla
Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in multiple products

Mozilla developers backported selected changes in the Skia library.

7.5
2018-06-11 CVE-2018-5159 Debian
Redhat
Mozilla
Canonical
Integer Overflow OR Wraparound vulnerability in multiple products

An integer overflow can occur in the Skia library due to 32-bit integer use in an array without integer overflow checks, resulting in possible out-of-bounds writes.

7.5
2018-06-11 CVE-2018-5155 Debian
Redhat
Mozilla
Canonical
USE After Free vulnerability in multiple products

A use-after-free vulnerability can occur while adjusting layout during SVG animations with text paths.

7.5
2018-06-11 CVE-2018-5154 Debian
Redhat
Mozilla
Canonical
USE After Free vulnerability in multiple products

A use-after-free vulnerability can occur while enumerating attributes during SVG animations with clip paths.

7.5
2018-06-11 CVE-2018-5150 Debian
Redhat
Mozilla
Canonical
Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in multiple products

Memory safety bugs were reported in Firefox 59, Firefox ESR 52.7, and Thunderbird 52.7.

7.5
2018-06-11 CVE-2018-5148 Debian
Redhat
Mozilla
Canonical
USE After Free vulnerability in multiple products

A use-after-free vulnerability can occur in the compositor during certain graphics operations when a raw pointer is used instead of a reference counted one.

7.5
2018-06-11 CVE-2018-5147 Debian
Mozilla
Out-Of-Bounds Write vulnerability in multiple products

The libtremor library has the same flaw as CVE-2018-5146.

7.5
2018-06-11 CVE-2018-5145 Debian
Redhat
Mozilla
Canonical
Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in multiple products

Memory safety bugs were reported in Firefox ESR 52.6.

7.5
2018-06-11 CVE-2018-5144 Redhat
Debian
Canonical
Mozilla
Integer Overflow OR Wraparound vulnerability in multiple products

An integer overflow can occur during conversion of text to some Unicode character sets due to an unchecked length parameter.

7.5
2018-06-11 CVE-2018-5128 Mozilla
Canonical
USE After Free vulnerability in multiple products

A use-after-free vulnerability can occur when manipulating elements, events, and selection ranges during editor operations.

7.5
2018-06-11 CVE-2018-5126 Mozilla
Canonical
Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in multiple products

Memory safety bugs were reported in Firefox 58.

7.5
2018-06-11 CVE-2018-5122 Mozilla
Canonical
Integer Overflow OR Wraparound vulnerability in multiple products

A potential integer overflow in the "DoCrypt" function of WebCrypto was identified.

7.5
2018-06-11 CVE-2018-5116 Mozilla
Canonical
Origin Validation Error vulnerability in multiple products

WebExtensions with the "ActiveTab" permission are able to access frames hosted within the active tab even if the frames are cross-origin.

7.5
2018-06-11 CVE-2018-5104 Debian
Redhat
Mozilla
Canonical
USE After Free vulnerability in multiple products

A use-after-free vulnerability can occur during font face manipulation when a font face is freed while still in use, resulting in a potentially exploitable crash.

7.5
2018-06-11 CVE-2018-5103 Debian
Redhat
Mozilla
Canonical
USE After Free vulnerability in multiple products

A use-after-free vulnerability can occur during mouse event handling due to issues with multiprocess support.

7.5
2018-06-11 CVE-2018-5102 Debian
Redhat
Mozilla
Canonical
USE After Free vulnerability in multiple products

A use-after-free vulnerability can occur when manipulating HTML media elements with media streams, resulting in a potentially exploitable crash.

7.5
2018-06-11 CVE-2018-5099 Debian
Redhat
Mozilla
Canonical
USE After Free vulnerability in multiple products

A use-after-free vulnerability can occur when the widget listener is holding strong references to browser objects that have previously been freed, resulting in a potentially exploitable crash when these references are used.

7.5
2018-06-11 CVE-2018-5098 Debian
Redhat
Mozilla
Canonical
USE After Free vulnerability in multiple products

A use-after-free vulnerability can occur when form input elements, focus, and selections are manipulated by script content.

7.5
2018-06-11 CVE-2018-5097 Debian
Redhat
Mozilla
Canonical
USE After Free vulnerability in multiple products

A use-after-free vulnerability can occur during XSL transformations when the source document for the transformation is manipulated by script content during the transformation.

7.5
2018-06-11 CVE-2018-5096 Debian
Redhat
Mozilla
USE After Free vulnerability in multiple products

A use-after-free vulnerability can occur while editing events in form elements on a page, resulting in a potentially exploitable crash.

7.5
2018-06-11 CVE-2018-5095 Debian
Redhat
Mozilla
Canonical
USE of Uninitialized Resource vulnerability in multiple products

An integer overflow vulnerability in the Skia library when allocating memory for edge builders on some systems with at least 8 GB of RAM.

7.5
2018-06-11 CVE-2018-5092 Mozilla
Canonical
USE After Free vulnerability in multiple products

A use-after-free vulnerability can occur when the thread for a Web Worker is freed from memory prematurely instead of from memory in the main thread while cancelling fetch operations.

7.5
2018-06-11 CVE-2018-5091 Debian
Redhat
Mozilla
Canonical
USE After Free vulnerability in multiple products

A use-after-free vulnerability can occur during WebRTC connections when interacting with the DTMF timers.

7.5
2018-06-11 CVE-2018-5089 Canonical
Redhat
Debian
Mozilla
Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in multiple products

Memory safety bugs were reported in Firefox 57 and Firefox ESR 52.5.

7.5
2018-06-11 CVE-2017-7835 Mozilla Unspecified vulnerability in Mozilla Firefox

Mixed content blocking of insecure (HTTP) sub-resources in a secure (HTTPS) document was not correctly applied for resources that redirect from HTTPS to HTTP, allowing content that should be blocked, such as scripts, to be loaded on a page.

7.5
2018-06-11 CVE-2017-7828 Debian
Redhat
Mozilla
USE After Free vulnerability in multiple products

A use-after-free vulnerability can occur when flushing and resizing layout because the "PressShell" object has been freed while still in use.

7.5
2018-06-11 CVE-2017-7824 Redhat
Debian
Mozilla
Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in multiple products

A buffer overflow occurs when drawing and validating elements with the ANGLE graphics library, used for WebGL content.

7.5
2018-06-11 CVE-2017-7821 Mozilla Incorrect Permission Assignment FOR Critical Resource vulnerability in Mozilla Firefox

A vulnerability where WebExtensions can download and attempt to open a file of some non-executable file types.

7.5
2018-06-11 CVE-2017-7819 Redhat
Debian
Mozilla
USE After Free vulnerability in multiple products

A use-after-free vulnerability can occur in design mode when image objects are resized if objects referenced during the resizing have been freed from memory.

7.5
2018-06-11 CVE-2017-7818 Redhat
Debian
Mozilla
USE After Free vulnerability in multiple products

A use-after-free vulnerability can occur when manipulating arrays of Accessible Rich Internet Applications (ARIA) elements within containers through the DOM.

7.5
2018-06-11 CVE-2017-7809 Debian
Redhat
Mozilla
USE After Free vulnerability in multiple products

A use-after-free vulnerability can occur when an editor DOM node is deleted prematurely during tree traversal while still bound to the document.

7.5
2018-06-11 CVE-2017-7802 Debian
Redhat
Mozilla
USE After Free vulnerability in multiple products

A use-after-free vulnerability can occur when manipulating the DOM during the resize event of an image element.

7.5
2018-06-11 CVE-2017-7801 Debian
Redhat
Mozilla
USE After Free vulnerability in multiple products

A use-after-free vulnerability can occur while re-computing layout for a "marquee" element during window resizing where the updated style object is freed while still in use.

7.5
2018-06-11 CVE-2017-7800 Debian
Redhat
Mozilla
USE After Free vulnerability in multiple products

A use-after-free vulnerability can occur in WebSockets when the object holding the connection is freed before the disconnection operation is finished.

7.5
2018-06-11 CVE-2017-7793 Debian
Redhat
Mozilla
USE After Free vulnerability in multiple products

A use-after-free vulnerability can occur in the Fetch API when the worker or the associated window are freed when still in use, resulting in a potentially exploitable crash.

7.5
2018-06-11 CVE-2017-7792 Debian
Redhat
Mozilla
Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in multiple products

A buffer overflow will occur when viewing a certificate in the certificate manager if the certificate has an extremely long object identifier (OID).

7.5
2018-06-11 CVE-2017-7788 Mozilla Injection vulnerability in Mozilla Firefox

When an "iframe" has a "sandbox" attribute and its content is specified using "srcdoc", that content does not inherit the containing page's Content Security Policy (CSP) as it should unless the sandbox attribute included "allow-same-origin".

7.5
2018-06-11 CVE-2017-7786 Debian
Redhat
Mozilla
Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in multiple products

A buffer overflow can occur when the image renderer attempts to paint non-displayable SVG elements.

7.5
2018-06-11 CVE-2017-7785 Debian
Redhat
Mozilla
Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in multiple products

A buffer overflow can occur when manipulating Accessible Rich Internet Applications (ARIA) attributes within the DOM.

7.5
2018-06-11 CVE-2017-7784 Debian
Redhat
Mozilla
USE After Free vulnerability in multiple products

A use-after-free vulnerability can occur when reading an image observer during frame reconstruction after the observer has been freed.

7.5
2018-06-11 CVE-2017-7780 Mozilla Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in Mozilla Firefox

Memory safety bugs were reported in Firefox 54.

7.5
2018-06-11 CVE-2017-7778 Mozilla
Debian
SIL
Buffer Errors vulnerability in Mozilla Firefox, Firefox ESR and Thunderbird

A number of security vulnerabilities in the Graphite 2 library including out-of-bounds reads, buffer overflow reads and writes, and the use of uninitialized memory.

7.5
2018-06-11 CVE-2017-7757 Mozilla
Debian
USE After Free vulnerability in Mozilla Firefox, Firefox ESR and Thunderbird

A use-after-free vulnerability in IndexedDB when one of its objects is destroyed in memory while a method on it is still being executed.

7.5
2018-06-11 CVE-2017-7756 Mozilla
Debian
USE After Free vulnerability in Mozilla Firefox, Firefox ESR and Thunderbird

A use-after-free and use-after-scope vulnerability when logging errors from headers for XML HTTP Requests (XHR).

7.5
2018-06-11 CVE-2017-7751 Debian
Redhat
Mozilla
USE After Free vulnerability in multiple products

A use-after-free vulnerability with content viewer listeners that results in a potentially exploitable crash.

7.5
2018-06-11 CVE-2017-7750 Debian
Redhat
Mozilla
USE After Free vulnerability in multiple products

A use-after-free vulnerability during video control operations when a "<track>" element holds a reference to an older window if that window has been replaced in the DOM.

7.5
2018-06-11 CVE-2017-7749 Debian
Redhat
Mozilla
USE After Free vulnerability in multiple products

A use-after-free vulnerability when using an incorrect URL during the reloading of a docshell.

7.5
2018-06-11 CVE-2017-5472 Debian
Redhat
Mozilla
USE After Free vulnerability in multiple products

A use-after-free vulnerability with the frameloader during tree reconstruction while regenerating CSS layout when attempting to use a node in the tree that no longer exists.

7.5
2018-06-11 CVE-2017-5471 Mozilla Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in Mozilla Firefox

Memory safety bugs were reported in Firefox 53.

7.5
2018-06-11 CVE-2017-5470 Debian
Redhat
Mozilla
Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in multiple products

Memory safety bugs were reported in Firefox 53 and Firefox ESR 52.1.

7.5
2018-06-11 CVE-2017-5469 Debian
Redhat
Mozilla
Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in multiple products

Fixed potential buffer overflows in generated Firefox code due to CVE-2016-6354 issue in Flex.

7.5
2018-06-11 CVE-2017-5464 Debian
Redhat
Mozilla
Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in multiple products

During DOM manipulations of the accessibility tree through script, the DOM tree can become out of sync with the accessibility tree, leading to memory corruption and a potentially exploitable crash.

7.5
2018-06-11 CVE-2017-5460 Debian
Redhat
Mozilla
USE After Free vulnerability in multiple products

A use-after-free vulnerability in frame selection triggered by a combination of malicious script content and key presses by a user.

7.5
2018-06-11 CVE-2017-5459 Redhat
Debian
Mozilla
Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in multiple products

A buffer overflow in WebGL triggerable by web content, resulting in a potentially exploitable crash.

7.5
2018-06-11 CVE-2017-5456 Redhat
Mozilla
Incorrect Permission Assignment FOR Critical Resource vulnerability in multiple products

A mechanism to bypass file system access protections in the sandbox using the file system request constructor through an IPC message.

7.5
2018-06-11 CVE-2017-5448 Debian
Redhat
Mozilla
Out-Of-Bounds Write vulnerability in multiple products

An out-of-bounds write in "ClearKeyDecryptor" while decrypting some Clearkey-encrypted media content.

7.5
2018-06-11 CVE-2017-5446 Debian
Redhat
Mozilla
Out-Of-Bounds Read vulnerability in multiple products

An out-of-bounds read when an HTTP/2 connection to a servers sends "DATA" frames with incorrect data content.

7.5
2018-06-11 CVE-2017-5443 Debian
Redhat
Mozilla
Out-Of-Bounds Write vulnerability in multiple products

An out-of-bounds write vulnerability while decoding improperly formed BinHex format archives.

7.5
2018-06-11 CVE-2017-5442 Debian
Redhat
Mozilla
USE After Free vulnerability in multiple products

A use-after-free vulnerability during changes in style when manipulating DOM elements.

7.5
2018-06-11 CVE-2017-5441 Debian
Redhat
Mozilla
USE After Free vulnerability in multiple products

A use-after-free vulnerability when holding a selection during scroll events.

7.5
2018-06-11 CVE-2017-5440 Debian
Redhat
Mozilla
USE After Free vulnerability in multiple products

A use-after-free vulnerability during XSLT processing due to a failure to propagate error conditions during matching while evaluating context, leading to objects being used when they no longer exist.

7.5
2018-06-11 CVE-2017-5439 Debian
Redhat
Mozilla
USE After Free vulnerability in multiple products

A use-after-free vulnerability during XSLT processing due to poor handling of template parameters.

7.5
2018-06-11 CVE-2017-5438 Debian
Redhat
Mozilla
USE After Free vulnerability in multiple products

A use-after-free vulnerability during XSLT processing due to the result handler being held by a freed handler during handling.

7.5
2018-06-11 CVE-2017-5435 Debian
Redhat
Mozilla
USE After Free vulnerability in multiple products

A use-after-free vulnerability occurs during transaction processing in the editor during design mode interactions.

7.5
2018-06-11 CVE-2017-5434 Redhat
Debian
Mozilla
USE After Free vulnerability in multiple products

A use-after-free vulnerability occurs when redirecting focus handling which results in a potentially exploitable crash.

7.5
2018-06-11 CVE-2017-5433 Debian
Redhat
Mozilla
USE After Free vulnerability in multiple products

A use-after-free vulnerability in SMIL animation functions occurs when pointers to animation elements in an array are dropped from the animation controller while still in use.

7.5
2018-06-11 CVE-2017-5432 Debian
Redhat
Mozilla
USE After Free vulnerability in multiple products

A use-after-free vulnerability occurs during certain text input selection resulting in a potentially exploitable crash.

7.5
2018-06-11 CVE-2017-5430 Redhat
Mozilla
Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in multiple products

Memory safety bugs were reported in Firefox 52, Firefox ESR 52, and Thunderbird 52.

7.5
2018-06-11 CVE-2017-5429 Redhat
Debian
Mozilla
Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in multiple products

Memory safety bugs were reported in Firefox 52, Firefox ESR 45.8, Firefox ESR 52, and Thunderbird 52.

7.5
2018-06-11 CVE-2017-5428 Redhat
Mozilla
Integer Overflow OR Wraparound vulnerability in multiple products

An integer overflow in "createImageBitmap()" was reported through the Pwn2Own contest.

7.5
2018-06-11 CVE-2017-5413 Mozilla Buffer Errors vulnerability in Mozilla Firefox and Thunderbird

A segmentation fault can occur during some bidirectional layout operations.

7.5
2018-06-11 CVE-2017-5410 Debian
Redhat
Mozilla
Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in multiple products

Memory corruption resulting in a potentially exploitable crash during garbage collection of JavaScript due errors in how incremental sweeping is managed for memory cleanup.

7.5
2018-06-11 CVE-2017-5404 Debian
Redhat
Mozilla
USE After Free vulnerability in multiple products

A use-after-free error can occur when manipulating ranges in selections with one node inside a native anonymous tree and one node outside of it.

7.5
2018-06-11 CVE-2017-5403 Mozilla USE After Free vulnerability in Mozilla Firefox and Thunderbird

When adding a range to an object in the DOM, it is possible to use "addRange" to add the range to an incorrect root object.

7.5
2018-06-11 CVE-2017-5402 Debian
Redhat
Mozilla
USE After Free vulnerability in multiple products

A use-after-free can occur when events are fired for a "FontFace" object after the object has been already been destroyed while working with fonts.

7.5
2018-06-11 CVE-2017-5401 Debian
Redhat
Mozilla
7PK - Errors vulnerability in multiple products

A crash triggerable by web content in which an "ErrorResult" references unassigned memory due to a logic error.

7.5
2018-06-11 CVE-2017-5400 Redhat
Debian
Mozilla
Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in multiple products

JIT-spray targeting asm.js combined with a heap spray allows for a bypass of ASLR and DEP protections leading to potential memory corruption attacks.

7.5
2018-06-11 CVE-2017-5396 Debian
Redhat
Mozilla
USE After Free vulnerability in multiple products

A use-after-free vulnerability in the Media Decoder when working with media files when some events are fired after the media elements are freed from memory.

7.5
2018-06-11 CVE-2017-5392 Mozilla
Google
Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in Mozilla Firefox

Weak proxy objects have weak references on multiple threads when they should only have them on one, resulting in incorrect memory usage and corruption, which leads to potentially exploitable crashes.

7.5
2018-06-11 CVE-2017-5391 Mozilla Multiple Security vulnerability in Mozilla Firefox

Special "about:" pages used by web content, such as RSS feeds, can load privileged "about:" pages in an iframe.

7.5
2018-06-11 CVE-2017-5390 Debian
Redhat
Mozilla
Multiple Security vulnerability in Mozilla Firefox

The JSON viewer in the Developer Tools uses insecure methods to create a communication channel for copying and viewing JSON or HTTP headers data, allowing for potential privilege escalation.

7.5
2018-06-11 CVE-2017-5386 Debian
Redhat
Mozilla
Multiple Security vulnerability in Mozilla Firefox

WebExtension scripts can use the "data:" protocol to affect pages loaded by other web extensions using this protocol, leading to potential data disclosure or privilege escalation in affected extensions.

7.5
2018-06-11 CVE-2017-5380 Debian
Redhat
Mozilla
USE After Free vulnerability in multiple products

A potential use-after-free found through fuzzing during DOM manipulation of SVG content.

7.5
2018-06-11 CVE-2017-5377 Mozilla Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in Mozilla Firefox

A memory corruption vulnerability in Skia that can occur when using transforms to make gradients, resulting in a potentially exploitable crash.

7.5
2018-06-11 CVE-2017-5376 Debian
Redhat
Mozilla
USE After Free vulnerability in multiple products

Use-after-free while manipulating XSL in XSLT documents.

7.5
2018-06-11 CVE-2017-5375 Redhat
Mozilla
Debian
Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in multiple products

JIT code allocation can allow for a bypass of ASLR and DEP protections leading to potential memory corruption attacks.

7.5
2018-06-11 CVE-2017-5374 Mozilla Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in Mozilla Firefox

Memory safety bugs were reported in Firefox 50.1.

7.5
2018-06-11 CVE-2017-5373 Mozilla
Debian
Redhat
Buffer Errors vulnerability in Mozilla Firefox, Firefox ESR and Thunderbird

Memory safety bugs were reported in Firefox 50.1 and Firefox ESR 45.6.

7.5
2018-06-11 CVE-2016-9901 Redhat
Mozilla
Improper Input Validation vulnerability in multiple products

HTML tags received from the Pocket server will be processed without sanitization and any JavaScript code executed will be run in the "about:pocket-saved" (unprivileged) page, giving it access to Pocket's messaging API through HTML injection.

7.5
2018-06-11 CVE-2016-9899 Debian
Redhat
Mozilla
USE After Free vulnerability in multiple products

Use-after-free while manipulating DOM events and removing audio elements due to errors in the handling of node adoption.

7.5
2018-06-11 CVE-2016-9898 Debian
Redhat
Mozilla
USE After Free vulnerability in multiple products

Use-after-free resulting in potentially exploitable crash when manipulating DOM subtrees in the Editor.

7.5
2018-06-11 CVE-2016-9893 Debian
Redhat
Mozilla
Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in multiple products

Memory safety bugs were reported in Thunderbird 45.5.

7.5
2018-06-11 CVE-2016-9080 Mozilla Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in Mozilla Firefox

Memory safety bugs were reported in Firefox 50.0.2.

7.5
2018-06-11 CVE-2016-9075 Mozilla Permissions, Privileges, and Access Controls vulnerability in Mozilla Firefox

An issue where WebExtensions can use the mozAddonManager API to elevate privilege due to privileged pages being allowed in the permissions list.

7.5
2018-06-11 CVE-2016-9063 Mozilla
Debian
Integer Overflow OR Wraparound vulnerability in multiple products

An integer overflow during the parsing of XML using the Expat library.

7.5
2018-06-11 CVE-2016-5297 Mozilla
Debian
Integer Overflow OR Wraparound vulnerability in Mozilla Firefox, Firefox ESR and Thunderbird

An error in argument length checking in JavaScript, leading to potential integer overflows or other bounds checking issues.

7.5
2018-06-11 CVE-2016-5290 Mozilla
Debian
Buffer Errors vulnerability in Mozilla Firefox, Firefox ESR and Thunderbird

Memory safety bugs were reported in Firefox 49 and Firefox ESR 45.4.

7.5
2018-06-11 CVE-2016-5289 Mozilla Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in Mozilla Firefox

Memory safety bugs were reported in Firefox 49.

7.5
2018-06-11 CVE-2016-5287 Mozilla USE After Free vulnerability in Mozilla Firefox

A potentially exploitable use-after-free crash during actor destruction with service workers.

7.5
2018-06-11 CVE-2018-6512 Puppet Code Injection vulnerability in Puppet Pe-Razor-Server, Puppet Enterprise and Razor-Server

The previous version of Puppet Enterprise 2018.1 is vulnerable to unsafe code execution when upgrading pe-razor-server.

7.5
2018-06-11 CVE-2017-3208 Themidnightcoders XXE vulnerability in Themidnightcoders Weborb for Java 5.1.1.0

The Java implementation of AMF3 deserializers used by WebORB for Java by Midnight Coders, version 5.1.1.0, allows external entity references (XXEs) from XML documents embedded within AMF3 messages.

7.5
2018-06-11 CVE-2017-3207 Themidnightcoders Deserialization of Untrusted Data vulnerability in Themidnightcoders Weborb for Java 5.1.1.0

The Java implementations of AMF3 deserializers in WebORB for Java by Midnight Coders, version 5.1.1.0, derive class instances from java.io.Externalizable rather than the AMF3 specification's recommendation of flash.utils.IExternalizable.

7.5
2018-06-11 CVE-2017-3206 Exadel XXE vulnerability in Exadel Flamingo 2.2.0

The Java implementation of AMF3 deserializers used by Flamingo amf-serializer by Exadel, version 2.2.0, allows external entity references (XXEs) from XML documents embedded within AMF3 messages.

7.5
2018-06-11 CVE-2017-3202 Exadel Deserialization of Untrusted Data vulnerability in Exadel Flamingo 2.2.0

The Java implementation of AMF3 deserializers used in Flamingo amf-serializer by Exadel, version 2.2.0, may allow instantiation of arbitrary classes via their public parameter-less constructor and subsequently call arbitrary Java Beans setter methods.

7.5
2018-06-11 CVE-2018-12092 Tinyexr Project Out-Of-Bounds Read vulnerability in Tinyexr Project Tinyexr 0.9.5

tinyexr 0.9.5 has a heap-based buffer over-read in tinyexr::DecodePixelData in tinyexr.h, related to OpenEXR code.

7.5
2018-06-15 CVE-2018-1460 IBM Improper Privilege Management vulnerability in IBM Puredata System for Analytics 1.0.0

IBM Netezza Platform Software (IBM PureData System for Analytics 1.0.0) could allow a local user to modify a world writable file, which could be used to execute commands as root.

7.2
2018-06-14 CVE-2018-8233 Microsoft Improper Resource Shutdown OR Release vulnerability in Microsoft Windows 10 and Windows Server 2016

An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka "Win32k Elevation of Privilege Vulnerability." This affects Windows 10, Windows 10 Servers.

7.2
2018-06-14 CVE-2018-8213 Microsoft Improper Resource Shutdown OR Release vulnerability in Microsoft Windows 10 and Windows Server 2016

A remote code execution vulnerability exists when Windows improperly handles objects in memory, aka "Windows Remote Code Execution Vulnerability." This affects Windows Server 2016, Windows 10, Windows 10 Servers.

7.2
2018-06-14 CVE-2018-8210 Microsoft Improper Resource Shutdown OR Release vulnerability in Microsoft products

A remote code execution vulnerability exists when Windows improperly handles objects in memory, aka "Windows Remote Code Execution Vulnerability." This affects Windows Server 2012 R2, Windows RT 8.1, Windows Server 2012, Windows Server 2016, Windows 8.1, Windows 10, Windows 10 Servers.

7.2
2018-06-13 CVE-2017-11672 Opcfoundation Unquoted Search Path OR Element vulnerability in Opcfoundation Local Discovery Server 1.03.355

The OPC Foundation Local Discovery Server (LDS) before 1.03.367 is installed as a Windows Service without adding double quotes around the opcualds.exe executable path, which might allow local users to gain privileges.

7.2
2018-06-13 CVE-2018-5242 Symantec Unspecified vulnerability in Symantec Norton APP Lock

Norton App Lock prior to version 1.3.0.329 can be susceptible to a bypass exploit.

7.2
2018-06-13 CVE-2018-12323 Apollotechnologiesinc USE of Hard-Coded Credentials vulnerability in Apollotechnologiesinc Momentum Axel 720P and Momentum Axel 720P Firmware

An issue was discovered on Momentum Axel 720P 5.1.8 devices.

7.2
2018-06-13 CVE-2018-11806 Qemu
Canonical
Redhat
Debian
Out-Of-Bounds Write vulnerability in multiple products

m_cat in slirp/mbuf.c in Qemu has a heap-based buffer overflow via incoming fragmented datagrams.

7.2
2018-06-12 CVE-2018-12259 Apollotechnologiesinc Incorrect Permission Assignment for Critical Resource vulnerability in Apollotechnologiesinc Momentum Axel 720P Firmware 5.1.8

An issue was discovered on Momentum Axel 720P 5.1.8 devices.

7.2
2018-06-12 CVE-2018-12258 Apollotechnologiesinc Unspecified vulnerability in Apollotechnologiesinc Momentum Axel 720P Firmware 5.1.8

An issue was discovered on Momentum Axel 720P 5.1.8 devices.

7.2
2018-06-11 CVE-2018-5105 Mozilla
Canonical
WebExtensions can bypass user prompts to first save and then open an arbitrarily downloaded file.
7.2
2018-06-16 CVE-2018-5755 Open Xchange Path Traversal vulnerability in Open-Xchange Appsuite

Absolute path traversal vulnerability in the readerengine component in Open-Xchange OX App Suite before 7.6.3-rev3, 7.8.x before 7.8.2-rev4, 7.8.3 before 7.8.3-rev5, and 7.8.4 before 7.8.4-rev4 allows remote attackers to read arbitrary files via a full pathname in a formula in a spreadsheet.

7.1
2018-06-14 CVE-2018-8175 Microsoft Unspecified vulnerability in Microsoft products

An denial of service vulnerability exists when Windows NT WEBDAV Minirdr attempts to query a WEBDAV directory, aka "WEBDAV Denial of Service Vulnerability." This affects Windows 10 Servers, Windows 10.

7.1
2018-06-13 CVE-2018-10850 Fedoraproject
Debian
Redhat
Race Condition vulnerability in multiple products

389-ds-base before versions 1.4.0.10, 1.3.8.3 is vulnerable to a race condition in the way 389-ds-base handles persistent search, resulting in a crash if the server is under load.

7.1
2018-06-12 CVE-2018-12232 Linux Race Condition vulnerability in Linux Kernel

In net/socket.c in the Linux kernel through 4.17.1, there is a race condition between fchownat and close in cases where they target the same socket file descriptor, related to the sock_close and sockfs_setattr functions.

7.1

383 Medium Vulnerabilities

DATE CVE VENDOR VULNERABILITY CVSS
2018-06-14 CVE-2018-8224 Microsoft Improper Resource Shutdown OR Release vulnerability in Microsoft Windows 7 and Windows Server 2008

An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory, aka "Windows Kernel Elevation of Privilege Vulnerability." This affects Windows Server 2008, Windows 7, Windows Server 2008 R2.

6.9
2018-06-14 CVE-2018-8214 Microsoft Unspecified vulnerability in Microsoft Windows 10 and Windows Server 2016

An elevation of privilege vulnerability exists in Windows when Desktop Bridge does not properly manage the virtual registry, aka "Windows Desktop Bridge Elevation of Privilege Vulnerability." This affects Windows Server 2016, Windows 10, Windows 10 Servers.

6.9
2018-06-14 CVE-2018-8208 Microsoft Unspecified vulnerability in Microsoft Windows 10 and Windows Server 2016

An elevation of privilege vulnerability exists in Windows when Desktop Bridge does not properly manage the virtual registry, aka "Windows Desktop Bridge Elevation of Privilege Vulnerability." This affects Windows Server 2016, Windows 10, Windows 10 Servers.

6.9
2018-06-14 CVE-2018-8169 Microsoft Improper Resource Shutdown OR Release vulnerability in Microsoft products

An elevation of privilege vulnerability exists when the (Human Interface Device) HID Parser Library driver improperly handles objects in memory, aka "HIDParser Elevation of Privilege Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers.

6.9
2018-06-14 CVE-2018-1036 Microsoft Incorrect Permission Assignment FOR Critical Resource vulnerability in Microsoft products

An elevation of privilege vulnerability exists when NTFS improperly checks access, aka "NTFS Elevation of Privilege Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers.

6.9
2018-06-14 CVE-2018-0982 Microsoft Incorrect Permission Assignment FOR Critical Resource vulnerability in Microsoft Windows 10 and Windows Server 2016

An elevation of privilege vulnerability exists in the way that the Windows Kernel API enforces permissions, aka "Windows Elevation of Privilege Vulnerability." This affects Windows Server 2016, Windows 10, Windows 10 Servers.

6.9
2018-06-13 CVE-2018-12271 Dropbox Improper Authentication vulnerability in Dropbox 100.2

** DISPUTED ** An issue was discovered in the com.getdropbox.Dropbox app 100.2 for iOS.

6.9
2018-06-12 CVE-2018-5814 Linux
Debian
Canonical
Race Condition vulnerability in Linux Kernel

In the Linux Kernel before version 4.16.11, 4.14.43, 4.9.102, and 4.4.133, multiple race condition errors when handling probe, disconnect, and rebind operations can be exploited to trigger a use-after-free condition or a NULL pointer dereference by sending multiple USB over IP packets.

6.9
2018-06-17 CVE-2018-12028 Phusion Incorrect Permission Assignment for Critical Resource vulnerability in Phusion Passenger 5.3.0/5.3.1

An Incorrect Access Control vulnerability in SpawningKit in Phusion Passenger 5.3.x before 5.3.2 allows a Passenger-managed malicious application, upon spawning a child process, to report an arbitrary different PID back to Passenger's process manager.

6.8
2018-06-17 CVE-2018-12333 Ecos Insufficient Verification of Data Authenticity vulnerability in Ecos Secure Boot Stick Firmware 5.6.5

Insufficient Verification of Data Authenticity vulnerability in ECOS Secure Boot Stick (aka SBS) 5.6.5 allows an attacker to manipulate security relevant configurations and execute malicious code.

6.8
2018-06-16 CVE-2018-6497 Microfocus Cross-Site Request Forgery (CSRF) vulnerability in Microfocus CMS Server and Universal Cmbd Server

Remote Cross-site Request forgery (CSRF) potential has been identified in UCMBD Server version DDM Content Pack V 10.20, 10.21, 10.22, 10.22 CUP7, 10.30, 10.31, 10.32, 10.33, 10.33 CUP2, 11.0 and CMS Server version 2018.05 BACKGROUND which could allow for remote unsafe deserialization and cross-site request forgery (CSRF).

6.8
2018-06-16 CVE-2018-6496 Microfocus Cross-Site Request Forgery (CSRF) vulnerability in Microfocus Universal Cmbd Browser

Remote Cross-site Request forgery (CSRF) potential has been identified in UCMBD Browser version 4.10, 4.11, 4.12, 4.13, 4.14, 4.15, 4.15.1 which could allow for remote unsafe deserialization and cross-site request forgery (CSRF).

6.8
2018-06-15 CVE-2018-12035 Virustotal Out-Of-Bounds Write vulnerability in Virustotal Yara

In YARA 3.7.1 and prior, parsing a specially crafted compiled rule file can cause an out of bounds write vulnerability in yr_execute_code in libyara/exec.c.

6.8
2018-06-15 CVE-2018-12034 Virustotal Out-Of-Bounds Read vulnerability in Virustotal Yara

In YARA 3.7.1 and prior, parsing a specially crafted compiled rule file can cause an out of bounds read vulnerability in yr_execute_code in libyara/exec.c.

6.8
2018-06-15 CVE-2018-12447 Libbpg Project Integer Overflow OR Wraparound vulnerability in Libbpg Project Libbpg 0.9.8

The restore_tqb_pixels function in hevc_filter.c in libavcodec, as used in libbpg 0.9.8 and other products, has an integer overflow that leads to a heap-based buffer overflow and remote code execution.

6.8
2018-06-14 CVE-2018-6516 Puppet
Microsoft
Unspecified vulnerability in Puppet Enterprise Client Tools

On Windows only, with a specifically crafted configuration file an attacker could get Puppet PE client tools (aka pe-client-tools) 16.4.x prior to 16.4.6, 17.3.x prior to 17.3.6, and 18.1.x prior to 18.1.2 to load arbitrary code with privilege escalation.

6.8
2018-06-14 CVE-2017-12070 Opcfoundation Improper Input Validation vulnerability in Opcfoundation Ua-.Net-Legacy 1.02.336.0

Unsigned versions of the DLLs distributed by the OPC Foundation may be replaced with malicious code.

6.8
2018-06-14 CVE-2018-12114 Maccms Cross-Site Request Forgery (CSRF) vulnerability in Maccms 10.0

Maccms 10 allows CSRF via admin.php/admin/admin/info.html to add user accounts.

6.8
2018-06-14 CVE-2018-8245 Microsoft Unspecified vulnerability in Microsoft Publisher 2010

A remote code execution vulnerability exists when Microsoft Publisher fails to utilize features that lock down the Local Machine zone when instantiating OLE objects, aka "Microsoft Publisher Remote Code Execution Vulnerability." This affects Microsoft Publisher.

6.8
2018-06-14 CVE-2018-8218 Microsoft Improper Input Validation vulnerability in Microsoft Windows 10 and Windows Server 2016

A denial of service vulnerability exists when Microsoft Hyper-V Network Switch on a host server fails to properly validate input from a privileged user on a guest operating system, aka "Windows Hyper-V Denial of Service Vulnerability." This affects Windows 10, Windows 10 Servers.

6.8
2018-06-13 CVE-2018-12354 Knowage Suite Cross-Site Request Forgery (CSRF) vulnerability in Knowage-Suite Knowage 6.1.1

Knowage (formerly SpagoBI) 6.1.1 allows CSRF via every form, as demonstrated by a /knowage/restful-services/2.0/analyticalDrivers/ POST request.

6.8
2018-06-13 CVE-2018-10408 Virustotal Improper Certificate Validation vulnerability in Virustotal

An issue was discovered in VirusTotal.

6.8
2018-06-13 CVE-2018-10406 Yelp Improper Certificate Validation vulnerability in Yelp Osxcollector 1.8

An issue was discovered in Yelp OSXCollector.

6.8
2018-06-13 CVE-2018-10405 Google Improper Certificate Validation vulnerability in Google Santa

An issue was discovered in Google Santa and molcodesignchecker.

6.8
2018-06-13 CVE-2018-10404 Objective SEE Improper Certificate Validation vulnerability in Objective-See products

An issue was discovered in Objective-See KnockKnock, LuLu, TaskExplorer, WhatsYourSign, and procInfo.

6.8
2018-06-13 CVE-2018-10403 F Secure Improper Certificate Validation vulnerability in F-Secure Xfence

An issue was discovered in F-Secure XFENCE and Little Flocker.

6.8
2018-06-13 CVE-2018-12321 Radare Out-Of-Bounds Read vulnerability in Radare Radare2 2.6.0

There is a heap out of bounds read in radare2 2.6.0 in java_switch_op() in libr/anal/p/anal_java.c via a crafted Java binary file.

6.8
2018-06-13 CVE-2018-12320 Radare USE After Free vulnerability in Radare Radare2 2.6.0

There is a use after free in radare2 2.6.0 in r_anal_bb_free() in libr/anal/bb.c via a crafted Java binary file.

6.8
2018-06-13 CVE-2018-11406 Sensiolabs
Debian
Cross-Site Request Forgery (CSRF) vulnerability in multiple products

An issue was discovered in the Security component in Symfony 2.7.x before 2.7.48, 2.8.x before 2.8.41, 3.3.x before 3.3.17, 3.4.x before 3.4.11, and 4.0.x before 4.0.11.

6.8
2018-06-13 CVE-2018-11385 Sensiolabs
Debian
Fedoraproject
Session Fixation vulnerability in multiple products

An issue was discovered in the Security component in Symfony 2.7.x before 2.7.48, 2.8.x before 2.8.41, 3.3.x before 3.3.17, 3.4.x before 3.4.11, and 4.0.x before 4.0.11.

6.8
2018-06-13 CVE-2018-5434 Tibco XXE vulnerability in Tibco Runtime Agent

The TIBCO Designer component of TIBCO Software Inc.'s TIBCO Runtime Agent, and TIBCO Runtime Agent for z/Linux contains vulnerabilities wherein a malicious user could perform XML external entity expansion (XXE) attacks to disclose host machine information.

6.8
2018-06-13 CVE-2018-5433 Tibco XXE vulnerability in Tibco Administrator

The TIBCO Administrator server component of TIBCO Software Inc.'s TIBCO Administrator - Enterprise Edition, and TIBCO Administrator - Enterprise Edition for z/Linux contains vulnerabilities wherein a malicious user could perform XML external entity expansion (XXE) attacks to disclose host machine information.

6.8
2018-06-13 CVE-2018-12265 Exiv2
Debian
Canonical
Out-Of-Bounds Read vulnerability in multiple products

Exiv2 0.26 has an integer overflow in the LoaderExifJpeg class in preview.cpp, leading to an out-of-bounds read in Exiv2::MemIo::read in basicio.cpp.

6.8
2018-06-13 CVE-2018-12264 Exiv2
Debian
Canonical
Out-Of-Bounds Read vulnerability in multiple products

Exiv2 0.26 has integer overflows in LoaderTiff::getData() in preview.cpp, leading to an out-of-bounds read in Exiv2::ValueType::setDataArea in value.hpp.

6.8
2018-06-12 CVE-2011-4182 Opensuse Improper Input Validation vulnerability in Opensuse Sysconfig

Missing escaping of ESSID values in sysconfig of SUSE Linux Enterprise allows attackers controlling an access point to cause execute arbitrary code.

6.8
2018-06-12 CVE-2018-12233 Linux
Canonical
Buffer Errors vulnerability in Linux Kernel

In the ea_get function in fs/jfs/xattr.c in the Linux kernel through 4.17.1, a memory corruption bug in JFS can be triggered by calling setxattr twice with two different extended attribute names on the same file.

6.8
2018-06-12 CVE-2018-12228 Asterisk Infinite Loop vulnerability in Asterisk Open Source

An issue was discovered in Asterisk Open Source 15.x before 15.4.1.

6.8
2018-06-11 CVE-2018-6961 Vmware OS Command Injection vulnerability in VMWare NSX Sd-Wan BY Velocloud

VMware NSX SD-WAN Edge by VeloCloud prior to version 3.1.0 contains a command injection vulnerability in the local web UI component.

6.8
2018-06-11 CVE-2018-5178 Debian
Mozilla
Canonical
Redhat
Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in multiple products

A buffer overflow was found during UTF8 to Unicode string conversion within JavaScript with extremely large amounts of data.

6.8
2018-06-11 CVE-2018-5158 Debian
Redhat
Mozilla
Canonical
Code Injection vulnerability in multiple products

The PDF viewer does not sufficiently sanitize PostScript calculator functions, allowing malicious JavaScript to be injected through a crafted PDF file.

6.8
2018-06-11 CVE-2018-5146 Redhat
Debian
Canonical
Mozilla
Out-Of-Bounds Write vulnerability in multiple products

An out of bounds memory write while processing Vorbis audio data was reported through the Pwn2Own contest.

6.8
2018-06-11 CVE-2018-5130 Debian
Redhat
Canonical
Mozilla
Improper Input Validation vulnerability in multiple products

When packets with a mismatched RTP payload type are sent in WebRTC connections, in some circumstances a potentially exploitable crash is triggered.

6.8
2018-06-11 CVE-2018-5127 Redhat
Debian
Canonical
Mozilla
Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in multiple products

A buffer overflow can occur when manipulating the SVG "animatedPathSegList" through script.

6.8
2018-06-11 CVE-2018-5125 Canonical
Redhat
Debian
Mozilla
Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in multiple products

Memory safety bugs were reported in Firefox 58 and Firefox ESR 52.6.

6.8
2018-06-11 CVE-2017-7846 Redhat
Debian
Mozilla
Injection vulnerability in multiple products

It is possible to execute JavaScript in the parsed RSS feed when RSS feed is viewed as a website, e.g.

6.8
2018-06-11 CVE-2017-7814 Redhat
Mozilla
Debian
Improper Input Validation vulnerability in multiple products

File downloads encoded with "blob:" and "data:" URL elements bypassed normal file download checks though the Phishing and Malware Protection feature and its block lists of suspicious sites and files.

6.8
2018-06-11 CVE-2017-7798 Debian
Redhat
Mozilla
Code Injection vulnerability in multiple products

The Developer Tools feature suffers from a XUL injection vulnerability due to improper sanitization of the web page source code.

6.8
2018-06-11 CVE-2017-7755 Mozilla
Microsoft
Untrusted Search Path vulnerability in Mozilla Firefox, Firefox ESR and Thunderbird

The Firefox installer on Windows can be made to load malicious DLL files stored in the same directory as the installer when it is run.

6.8
2018-06-11 CVE-2017-7752 Debian
Redhat
Mozilla
USE After Free vulnerability in multiple products

A use-after-free vulnerability during specific user interactions with the input method editor (IME) in some languages due to how events are handled.

6.8
2018-06-11 CVE-2017-5436 Debian
Redhat
SIL
Mozilla
Out-Of-Bounds Write vulnerability in multiple products

An out-of-bounds write in the Graphite 2 library triggered with a maliciously crafted Graphite font.

6.8
2018-06-11 CVE-2017-5394 Mozilla
Google
Cross-Site Request Forgery (CSRF) vulnerability in Mozilla Firefox

A location bar spoofing attack where the location bar of loaded page will be shown over the content of another tab due to a series of JavaScript events combined with fullscreen mode.

6.8
2018-06-11 CVE-2016-9905 Redhat
Debian
Mozilla
Improper Access Control vulnerability in multiple products

A potentially exploitable crash in "EnumerateSubDocuments" while adding or removing sub-documents.

6.8
2018-06-11 CVE-2016-9896 Mozilla USE After Free vulnerability in Mozilla Firefox

Use-after-free while manipulating the "navigator" object within WebVR.

6.8
2018-06-11 CVE-2016-9078 Mozilla Open Redirect vulnerability in Mozilla Firefox 49.0/50.0

Redirection from an HTTP connection to a "data:" URL assigns the referring site's origin to the "data:" URL in some circumstances.

6.8
2018-06-11 CVE-2016-9077 Mozilla Race Condition vulnerability in Mozilla Firefox

Canvas allows the use of the "feDisplacementMap" filter on images loaded cross-origin.

6.8
2018-06-11 CVE-2016-9070 Mozilla Permissions, Privileges, and Access Controls vulnerability in Mozilla Firefox

A maliciously crafted page loaded to the sidebar through a bookmark can reference a privileged chrome window and engage in limited JavaScript operations violating cross-origin protections.

6.8
2018-06-11 CVE-2018-6515 Puppet
Microsoft
Improper Input Validation vulnerability in Puppet

Puppet Agent 1.10.x prior to 1.10.13, Puppet Agent 5.3.x prior to 5.3.7, and Puppet Agent 5.5.x prior to 5.5.2 on Windows only, with a specially crafted configuration file an attacker could get pxp-agent to load arbitrary code with privilege escalation.

6.8
2018-06-11 CVE-2018-6514 Puppet
Microsoft
Untrusted Search Path vulnerability in Puppet

In Puppet Agent 1.10.x prior to 1.10.13, Puppet Agent 5.3.x prior to 5.3.7, Puppet Agent 5.5.x prior to 5.5.2, Facter on Windows is vulnerable to a DLL preloading attack, which could lead to a privilege escalation.

6.8
2018-06-11 CVE-2017-3203 Pivotal Deserialization of Untrusted Data vulnerability in Pivotal Spring-Flex

The Java implementations of AMF3 deserializers in Pivotal/Spring Spring-flex derive class instances from java.io.Externalizable rather than the AMF3 specification's recommendation of flash.utils.IExternalizable.

6.8
2018-06-11 CVE-2017-3201 Exadel Deserialization of Untrusted Data vulnerability in Exadel Flamingo Amf-Serializer 2.2.0

The Java implementation of AMF3 deserializers used in Flamingo amf-serializer by Exadel, version 2.2.0 derives class instances from java.io.Externalizable rather than the AMF3 specification's recommendation of flash.utils.IExternalizable.

6.8
2018-06-11 CVE-2017-3200 Graniteds Deserialization of Untrusted Data vulnerability in Graniteds 3.1.1

The Java implementation of AMF3 deserializers used in GraniteDS, version 3.1.1.G, may allow instantiation of arbitrary classes via their public parameter-less constructor and subsequently call arbitrary Java Beans setter methods.

6.8
2018-06-11 CVE-2017-3199 Graniteds Deserialization of Untrusted Data vulnerability in Graniteds 3.1.1

The Java implementation of GraniteDS, version 3.1.1.GA, AMF3 deserializers derives class instances from java.io.Externalizable rather than the AMF3 specification's recommendation of flash.utils.IExternalizable.

6.8
2018-06-11 CVE-2018-12112 Md4C Project Buffer Errors vulnerability in Md4C Project Md4C 0.2.6

md_build_attribute in md4c.c in md4c 0.2.6 allows remote attackers to cause a denial of service (Segmentation fault and application crash) or possibly have unspecified other impact via a crafted file.

6.8
2018-06-11 CVE-2018-12109 Flif Out-Of-Bounds Write vulnerability in Flif 0.3

An issue was discovered in Free Lossless Image Format (FLIF) 0.3.

6.8
2018-06-17 CVE-2018-12027 Phusion Information Exposure vulnerability in Phusion Passenger 5.3.0/5.3.1

An Insecure Permissions vulnerability in SpawningKit in Phusion Passenger 5.3.x before 5.3.2 causes information disclosure in the following situation: given a Passenger-spawned application process that reports that it listens on a certain Unix domain socket, if any of the parent directories of said socket are writable by a normal user that is not the application's user, then that non-application user can swap that directory with something else, resulting in traffic being redirected to a non-application user's process through an alternative Unix domain socket.

6.5
2018-06-17 CVE-2018-12334 Ecos Unspecified vulnerability in Ecos Secure Boot Stick Firmware 5.6.5

Protection Mechanism Failure in ECOS Secure Boot Stick (aka SBS) 5.6.5 allows an attacker to compromise authentication and encryption keys via a virtualization attack.

6.5
2018-06-16 CVE-2018-5752 Open Xchange Server-Side Request Forgery (SSRF) vulnerability in Open-Xchange Appsuite

The backend component in Open-Xchange OX App Suite before 7.6.3-rev36, 7.8.x before 7.8.2-rev39, 7.8.3 before 7.8.3-rev44, and 7.8.4 before 7.8.4-rev22 allows remote attackers to conduct server-side request forgery (SSRF) attacks via vectors involving non-decimal representations of IP addresses and special IPv6 related addresses.

6.5
2018-06-15 CVE-2018-12457 Expresscart Project Incorrect Permission Assignment FOR Critical Resource vulnerability in Expresscart Project Expresscart

expressCart before 1.1.6 allows remote attackers to create an admin user via a /admin/setup Referer header.

6.5
2018-06-13 CVE-2017-15695 Apache Incorrect Authorization vulnerability in Apache Geode

When an Apache Geode server versions 1.0.0 to 1.4.0 is configured with a security manager, a user with DATA:WRITE privileges is allowed to deploy code by invoking an internal Geode function.

6.5
2018-06-13 CVE-2018-12263 Portfoliocms Project Unrestricted Upload of File With Dangerous Type vulnerability in Portfoliocms Project Portfoliocms 1.0.5

portfolioCMS 1.0.5 allows upload of arbitrary .php files via the admin/portfolio.php?newpage=true URI.

6.5
2018-06-12 CVE-2018-12254 Harmistechnology SQL Injection vulnerability in Harmistechnology EK Rishta 2.10

router.php in the Harmis Ek rishta (aka ek-rishta) 2.10 component for Joomla! allows SQL Injection via the PATH_INFO to a home/requested_user/Sent%20interest/ URI.

6.5
2018-06-12 CVE-2018-10508 Trendmicro Unspecified vulnerability in Trendmicro Officescan 11.0/Xg

A vulnerability in Trend Micro OfficeScan 11.0 SP1 and XG could allow a attacker to use a specially crafted URL to elevate account permissions on vulnerable installations.

6.5
2018-06-12 CVE-2017-3960 Mcafee Unspecified vulnerability in Mcafee Network Security Manager

Exploitation of Authorization vulnerability in the web interface in McAfee Network Security Management (NSM) before 8.2.7.42.2 allows authenticated users to gain elevated privileges via a crafted HTTP request parameter.

6.5
2018-06-11 CVE-2018-6513 Puppet Untrusted Search Path vulnerability in Puppet

Puppet Enterprise 2016.4.x prior to 2016.4.12, Puppet Enterprise 2017.3.x prior to 2017.3.7, Puppet Enterprise 2018.1.x prior to 2018.1.1, Puppet Agent 1.10.x prior to 1.10.13, Puppet Agent 5.3.x prior to 5.3.7, and Puppet Agent 5.5.x prior to 5.5.2, were vulnerable to an attack where an unprivileged user on Windows agents could write custom facts that can escalate privileges on the next puppet run.

6.5
2018-06-11 CVE-2018-12110 Portfoliocms Project SQL Injection vulnerability in Portfoliocms Project Portfoliocms 1.0.5

portfolioCMS 1.0.5 has SQL Injection via the admin/portfolio.php preview parameter.

6.5
2018-06-15 CVE-2018-12492 Phpok Improper Input Validation vulnerability in PHPok 4.9.032

PHPOK 4.9.032 has an arbitrary file deletion vulnerability in the delfile_f function in framework/admin/tpl_control.php.

6.4
2018-06-13 CVE-2017-3968 Mcafee Session Fixation vulnerability in Mcafee products

Session fixation vulnerability in the web interface in McAfee Network Security Manager (NSM) before 8.2.7.42.2 and McAfee Network Data Loss Prevention (NDLP) before 9.3.4.1.5 allows remote attackers to disclose sensitive information or manipulate the database via a crafted authentication cookie.

6.4
2018-06-12 CVE-2018-0496 Dinknetwork
Debian
Path Traversal vulnerability in multiple products

Directory traversal issues in the D-Mod extractor in DFArc and DFArc2 (as well as in RTsoft's Dink Smallwood HD / ProtonSDK version) before 3.14 allow an attacker to overwrite arbitrary files on the user's system.

6.4
2018-06-11 CVE-2018-5141 Mozilla
Canonical
Improper Input Validation vulnerability in multiple products

A vulnerability in the notifications Push API where notifications can be sent through service workers by web content without direct user interaction.

6.4
2018-06-11 CVE-2017-7813 Mozilla Incorrect Type Conversion OR Cast vulnerability in Mozilla Firefox

Inside the JavaScript parser, a cast of an integer to a narrower type can result in data read from outside the buffer being parsed.

6.4
2018-06-11 CVE-2017-7758 Redhat
Mozilla
Debian
Out-Of-Bounds Read vulnerability in multiple products

An out-of-bounds read vulnerability with the Opus encoder when the number of channels in an audio stream changes while the encoder is in use.

6.4
2018-06-11 CVE-2017-7753 Debian
Redhat
Mozilla
Out-Of-Bounds Read vulnerability in multiple products

An out-of-bounds read occurs when applying style rules to pseudo-elements, such as ::first-line, using cached style data.

6.4
2018-06-11 CVE-2017-5468 Mozilla Improper Initialization vulnerability in Mozilla Firefox

An issue with incorrect ownership model of "privateBrowsing" information exposed through developer tools.

6.4
2018-06-11 CVE-2017-5465 Debian
Redhat
Mozilla
Out-Of-Bounds Read vulnerability in multiple products

An out-of-bounds read while processing SVG content in "ConvolvePixel".

6.4
2018-06-11 CVE-2017-5447 Debian
Redhat
Mozilla
USE After Free vulnerability in multiple products

An out-of-bounds read during the processing of glyph widths during text layout.

6.4
2018-06-17 CVE-2018-12331 Ecos Authentication Bypass BY Spoofing vulnerability in Ecos System Management Appliance 5.2.68

Authentication Bypass by Spoofing vulnerability in ECOS System Management Appliance (aka SMA) 5.2.68 allows a man-in-the-middle attacker to compromise authentication keys and configurations via IP spoofing during "Easy Enrollment."

5.8
2018-06-14 CVE-2018-4833 Siemens Improper Input Validation vulnerability in Siemens products

A vulnerability has been identified in RFID 181EIP (All versions), RUGGEDCOM Win (V4.4, V4.5, V5.0, and V5.1), SCALANCE X-200 switch family (incl.

5.8
2018-06-14 CVE-2018-8247 Microsoft Cross-Site Scripting vulnerability in Microsoft Office Online Server and Office web Apps

An elevation of privilege vulnerability exists when Office Web Apps Server 2013 and Office Online Server fail to properly handle web requests, aka "Microsoft Office Elevation of Privilege Vulnerability." This affects Microsoft Office, Microsoft Office Online Server.

5.8
2018-06-13 CVE-2018-11408 Sensiolabs
Debian
Open Redirect vulnerability in multiple products

The security handlers in the Security component in Symfony in 2.7.x before 2.7.48, 2.8.x before 2.8.41, 3.3.x before 3.3.17, 3.4.x before 3.4.11, and 4.0.x before 4.0.11 have an Open redirect vulnerability when security.http_utils is inlined by a container.

5.8
2018-06-13 CVE-2017-16652 Sensiolabs
Debian
Open Redirect vulnerability in multiple products

An issue was discovered in Symfony 2.7.x before 2.7.38, 2.8.x before 2.8.31, 3.2.x before 3.2.14, and 3.3.x before 3.3.13.

5.8
2018-06-11 CVE-2017-7807 Debian
Redhat
Mozilla
Improper Input Validation vulnerability in multiple products

A mechanism that uses AppCache to hijack a URL in a domain using fallback by serving the files from a sub-path on the domain.

5.8
2018-06-11 CVE-2017-5389 Mozilla Open Redirect vulnerability in Mozilla Firefox

WebExtensions could use the "mozAddonManager" API by modifying the CSP headers on sites with the appropriate permissions and then using host requests to redirect script loads to a malicious site.

5.8
2018-06-12 CVE-2018-5718 Safensoft Buffer Errors vulnerability in Safensoft products

Improper restriction of write operations within the bounds of a memory buffer in snscore.sys in SoftControl/SafenSoft SysWatch, SoftControl/SafenSoft TPSecure, SoftControl/SafenSoft Enterprise Suite before version 4.4.1 allows local users to cause a denial of service (BSOD) or modify kernel-mode memory via loading of a forged DLL into an user-mode process.

5.6
2018-06-14 CVE-2018-1040 Microsoft Unspecified vulnerability in Microsoft products

A denial of service vulnerability exists in the way that the Windows Code Integrity Module performs hashing, aka "Windows Code Integrity Module Denial of Service Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers.

5.4
2018-06-16 CVE-2018-9859 Navercorp Unspecified vulnerability in Navercorp Whale

The path of Whale update service was unquoted in NAVER Whale before 1.0.40.7.

5.1
2018-06-11 CVE-2018-5163 Canonical
Mozilla
Improper Preservation of Permissions vulnerability in multiple products

If a malicious attacker has used another vulnerability to gain full control over a content process, they may be able to replace the alternate data resources stored in the JavaScript Start-up Bytecode Cache (JSBC) for other JavaScript code.

5.1
2018-06-17 CVE-2018-12454 1000Guess USE of Cryptographically Weak Pseudo-Random Number Generator (Prng) vulnerability in 1000Guess 1000 Guess

The _addguess function of a simplelottery smart contract implementation for 1000 Guess, an Ethereum gambling game, generates a random value with publicly readable variables such as the current block information and a private variable (which can be read with a getStorageAt call).

5.0
2018-06-16 CVE-2018-12453 Redislabs Incorrect Type Conversion OR Cast vulnerability in Redislabs Redis

Type confusion in the xgroupCommand function in t_stream.c in redis-server in Redis before 5.0 allows remote attackers to cause denial-of-service via an XGROUP command in which the key is not a stream.

5.0
2018-06-16 CVE-2018-12504 Tinyexr Project Reachable Assertion vulnerability in Tinyexr Project Tinyexr 0.9.5

tinyexr 0.9.5 has an assertion failure in ComputeChannelLayout in tinyexr.h.

5.0
2018-06-16 CVE-2018-11222 Artica Improper Input Validation vulnerability in Artica Pandora FMS

Local File Inclusion (LFI) in Artica Pandora FMS through version 7.23 allows an attacker to call any php file via the /pandora_console/ajax.php ajax endpoint.

5.0
2018-06-15 CVE-2018-12481 THE Olive Tree FTP Server Project Information Exposure vulnerability in the Olive Tree FTP Server Project the Olive Tree FTP Server 1.32

The Olive Tree Ftp Server application 1.32 for Android has a "Sensitive Data on the Clipboard" vulnerability, as demonstrated by reading the "User password" field with the Drozer post.capture.clipboard module.

5.0
2018-06-14 CVE-2018-12423 Matrix Unspecified vulnerability in Matrix Synapse

In Synapse before 0.31.2, unauthorised users can hijack rooms when there is no m.room.power_levels event in force.

5.0
2018-06-14 CVE-2018-12420 Icehrm USE of A Broken OR Risky Cryptographic Algorithm vulnerability in Icehrm

IceHrm before 23.0.1.OS has a risky usage of a hashed password in a request.

5.0
2018-06-14 CVE-2018-8819 Automatedlogic XXE vulnerability in Automatedlogic Webctrl 6.0/6.1/6.5

An XXE issue was discovered in Automated Logic Corporation (ALC) WebCTRL Versions 6.0, 6.1 and 6.5.

5.0
2018-06-14 CVE-2018-12421 LTB Project Weak Password Recovery Mechanism FOR Forgotten Password vulnerability in Ltb-Project Ldap Tool BOX Self Service Password

LTB (aka LDAP Tool Box) Self Service Password before 1.3 allows a change to a user password (without knowing the old password) via a crafted POST request, because the ldap_bind return value is mishandled and the PHP data type is not constrained to be a string.

5.0
2018-06-13 CVE-2018-12019 Enigmail Improper Verification of Cryptographic Signature vulnerability in Enigmail

The signature verification routine in Enigmail before 2.0.7 interprets user ids as status/control messages and does not correctly keep track of the status of multiple signatures, which allows remote attackers to spoof arbitrary email signatures via public keys containing crafted primary user ids.

5.0
2018-06-13 CVE-2018-10363 Wpdevart Improper Input Validation vulnerability in Wpdevart Booking Calendar 2.2.2

An issue was discovered in the WpDevArt "Booking calendar, Appointment Booking System" plugin 2.2.2 for WordPress.

5.0
2018-06-13 CVE-2018-7167 Nodejs Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in Nodejs Node.Js

Calling Buffer.fill() or Buffer.alloc() with some parameters can lead to a hang which could result in a Denial of Service.

5.0
2018-06-13 CVE-2018-7164 Nodejs Resource Exhaustion vulnerability in Nodejs Node.Js

Node.js versions 9.7.0 and later and 10.x are vulnerable and the severity is MEDIUM.

5.0
2018-06-13 CVE-2018-12291 Matrix Unspecified vulnerability in Matrix Synapse

The on_get_missing_events function in handlers/federation.py in Matrix Synapse before 0.31.1 has a security bug in the get_missing_events federation API where event visibility rules were not applied correctly.

5.0
2018-06-12 CVE-2018-10470 Objective Development
Apple
Improper Verification of Cryptographic Signature vulnerability in Objective Development Little Snitch

Little Snitch versions 4.0 to 4.0.6 use the SecStaticCodeCheckValidityWithErrors() function without the kSecCSCheckAllArchitectures flag and therefore do not validate all architectures stored in a fat binary.

5.0
2018-06-12 CVE-2018-2428 SAP Unspecified vulnerability in SAP Infrastructure and UI

Under certain conditions SAP UI5 Handler allows an attacker to access information which would otherwise be restricted.

5.0
2018-06-12 CVE-2018-2424 SAP Improper Input Validation vulnerability in SAP products

SAP UI5 did not validate user input before adding it to the DOM structure.

5.0
2018-06-12 CVE-2018-12249 Mruby Null Pointer Dereference vulnerability in Mruby 1.4.1

An issue was discovered in mruby 1.4.1.

5.0
2018-06-12 CVE-2018-12248 Mruby Out-Of-Bounds Read vulnerability in Mruby 1.4.1

An issue was discovered in mruby 1.4.1.

5.0
2018-06-12 CVE-2018-12247 Mruby Null Pointer Dereference vulnerability in Mruby 1.4.1

An issue was discovered in mruby 1.4.1.

5.0
2018-06-12 CVE-2017-3962 Mcafee USE of Password Hash With Insufficient Computational Effort vulnerability in Mcafee Network Security Manager

Password recovery exploitation vulnerability in the non-certificate-based authentication mechanism in McAfee Network Security Management (NSM) before 8.2.7.42.2 allows attackers to crack user passwords via unsalted hashes.

5.0
2018-06-12 CVE-2018-1070 Redhat Improper Input Validation vulnerability in Redhat Openshift Container Platform

routing before version 3.10 is vulnerable to an improper input validation of the Openshift Routing configuration which can cause an entire shard to be brought down.

5.0
2018-06-12 CVE-2018-0732 Openssl
Canonical
Debian
KEY Management Errors vulnerability in multiple products

During key agreement in a TLS handshake using a DH(E) based ciphersuite a malicious server can send a very large prime value to the client.

5.0
2018-06-12 CVE-2018-12227 Digium
Debian
Information Exposure vulnerability in multiple products

An issue was discovered in Asterisk Open Source 13.x before 13.21.1, 14.x before 14.7.7, and 15.x before 15.4.1 and Certified Asterisk 13.18-cert before 13.18-cert4 and 13.21-cert before 13.21-cert2.

5.0
2018-06-11 CVE-2018-5184 Debian
Mozilla
Canonical
Redhat
Inadequate Encryption Strength vulnerability in multiple products

Using remote content in encrypted messages can lead to the disclosure of plaintext.

5.0
2018-06-11 CVE-2018-5182 Canonical
Mozilla
Information Exposure vulnerability in multiple products

If a text string that happens to be a filename in the operating system's native format is dragged and dropped onto the addressbar the specified local file will be opened.

5.0
2018-06-11 CVE-2018-5181 Canonical
Mozilla
Information Exposure vulnerability in multiple products

If a URL using the "file:" protocol is dragged and dropped onto an open tab that is running in a different child process the tab will open a local file corresponding to the dropped URL, contrary to policy.

5.0
2018-06-11 CVE-2018-5180 Mozilla
Canonical
USE After Free vulnerability in multiple products

A use-after-free vulnerability can occur during WebGL operations.

5.0
2018-06-11 CVE-2018-5177 Canonical
Mozilla
Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in multiple products

A vulnerability exists in XSLT during number formatting where a negative buffer size may be allocated in some instances, leading to a buffer overflow and crash if it occurs.

5.0
2018-06-11 CVE-2018-5174 Mozilla
Microsoft
Unspecified vulnerability in Mozilla Firefox, Firefox ESR and Thunderbird

In the Windows 10 April 2018 Update, Windows Defender SmartScreen honors the "SEE_MASK_FLAG_NO_UI" flag associated with downloaded files and will not show any UI.

5.0
2018-06-11 CVE-2018-5173 Canonical
Mozilla
Improper Input Validation vulnerability in multiple products

The filename appearing in the "Downloads" panel improperly renders some Unicode characters, allowing for the file name to be spoofed.

5.0
2018-06-11 CVE-2018-5168 Debian
Mozilla
Canonical
Redhat
Sites can bypass security checks on permissions to install lightweight themes by manipulating the "baseURI" property of the theme element.
5.0
2018-06-11 CVE-2018-5166 Canonical
Mozilla
Improper Privilege Management vulnerability in multiple products

WebExtensions can use request redirection and a "filterReponseData" filter to bypass host permission settings to redirect network traffic and access content from a host for which they do not have explicit user permission.

5.0
2018-06-11 CVE-2018-5165 Mozilla Unspecified vulnerability in Mozilla Firefox

In 32-bit versions of Firefox, the Adobe Flash plugin setting for "Enable Adobe Flash protected mode" is unchecked by default even though the Adobe Flash sandbox is actually enabled.

5.0
2018-06-11 CVE-2018-5162 Redhat
Debian
Canonical
Mozilla
Missing Encryption of Sensitive Data vulnerability in multiple products

Plaintext of decrypted emails can leak through the src attribute of remote images, or links.

5.0
2018-06-11 CVE-2018-5160 Canonical
Mozilla
USE After Free vulnerability in multiple products

WebRTC can use a "WrappedI420Buffer" pixel buffer but the owning image object can be freed while it is still in use.

5.0
2018-06-11 CVE-2018-5157 Redhat
Debian
Canonical
Mozilla
Information Exposure vulnerability in multiple products

Same-origin protections for the PDF viewer can be bypassed, allowing a malicious site to intercept messages meant for the viewer.

5.0
2018-06-11 CVE-2018-5153 Mozilla
Canonical
Out-Of-Bounds Read vulnerability in multiple products

If websocket data is sent with mixed text and binary in a single message, the binary data can be corrupted.

5.0
2018-06-11 CVE-2018-5142 Mozilla
Canonical
If Media Capture and Streams API permission is requested from documents with "data:" or "blob:" URLs, the permission notifications do not properly display the originating domain.
5.0
2018-06-11 CVE-2018-5140 Mozilla
Canonical
Information Exposure vulnerability in multiple products

Image for moz-icons can be accessed through the "moz-icon:" protocol through script in web content even when otherwise prohibited.

5.0
2018-06-11 CVE-2018-5138 Mozilla
Google
Improper Input Validation vulnerability in Mozilla Firefox

A spoofing vulnerability can occur when a malicious site with an extremely long domain name is opened in an Android Custom Tab (a browser panel inside another app) and the default browser is Firefox for Android.

5.0
2018-06-11 CVE-2018-5137 Mozilla
Canonical
Information Exposure vulnerability in multiple products

A legacy extension's non-contentaccessible, defined resources can be loaded by an arbitrary web page through script.

5.0
2018-06-11 CVE-2018-5136 Canonical
Mozilla
Improper Input Validation vulnerability in multiple products

A shared worker created from a "data:" URL in one tab can be shared by another tab with a different origin, bypassing the same-origin policy.

5.0
2018-06-11 CVE-2018-5135 Mozilla Missing Authorization vulnerability in Mozilla Firefox

WebExtensions can bypass normal restrictions in some circumstances and use "browser.tabs.executeScript" to inject scripts into contexts where this should not be allowed, such as pages from other WebExtensions or unprivileged "about:" pages.

5.0
2018-06-11 CVE-2018-5134 Mozilla Information Exposure vulnerability in Mozilla Firefox

WebExtensions may use "view-source:" URLs to view local "file:" URL content, as well as content stored in "about:cache", bypassing restrictions that only allow WebExtensions to view specific content.

5.0
2018-06-11 CVE-2018-5129 Debian
Mozilla
Redhat
Canonical
Out-Of-Bounds Write vulnerability in multiple products

A lack of parameter validation on IPC messages results in a potential out-of-bounds write through malformed IPC messages.

5.0
2018-06-11 CVE-2018-5121 Mozilla
Apple
Improper Input Validation vulnerability in Mozilla Firefox

Low descenders on some Tibetan characters in several fonts on OS X are clipped when rendered in the addressbar.

5.0
2018-06-11 CVE-2018-5119 Mozilla
Canonical
Information Exposure vulnerability in multiple products

The reader view will display cross-origin content when CORS headers are set to prohibit the loading of cross-origin content by a site.

5.0
2018-06-11 CVE-2018-5118 Mozilla
Canonical
Information Exposure vulnerability in multiple products

The screenshot images displayed in the Activity Stream page displayed when a new tab is opened is created from the meta tags of websites.

5.0
2018-06-11 CVE-2018-5117 Debian
Redhat
Mozilla
Canonical
If right-to-left text is used in the addressbar with left-to-right alignment, it is possible in some circumstances to scroll this text to spoof the displayed URL.
5.0
2018-06-11 CVE-2018-5115 Mozilla
Canonical
Information Exposure vulnerability in multiple products

If an HTTP authentication prompt is triggered by a background network request from a page or extension, it is displayed over the currently loaded foreground page.

5.0
2018-06-11 CVE-2018-5114 Mozilla
Canonical
Information Exposure vulnerability in multiple products

If an existing cookie is changed to be "HttpOnly" while a document is open, the original value remains accessible through script until that document is closed.

5.0
2018-06-11 CVE-2018-5113 Mozilla
Canonical
Missing Authorization vulnerability in multiple products

The "browser.identity.launchWebAuthFlow" function of WebExtensions is only allowed to load content over "https:" but this requirement was not properly enforced.

5.0
2018-06-11 CVE-2018-5112 Mozilla
Canonical
Files OR Directories Accessible TO External Parties vulnerability in multiple products

Development Tools panels of an extension are required to load URLs for the panels as relative URLs from the extension manifest file but this requirement was not enforced in all instances.

5.0
2018-06-11 CVE-2018-5110 Mozilla
Apple
Improper Input Validation vulnerability in Mozilla Firefox

If cursor visibility is toggled by script using from 'none' to an image and back through script, the cursor will be rendered temporarily invisible within Firefox.

5.0
2018-06-11 CVE-2018-5109 Mozilla
Canonical
Origin Validation Error vulnerability in multiple products

An audio capture session can started under an incorrect origin from the site making the capture request.

5.0
2018-06-11 CVE-2018-5107 Mozilla
Canonical
Link Following vulnerability in multiple products

The printing process can bypass local access protections to read files available through symlinks, bypassing local file restrictions.

5.0
2018-06-11 CVE-2018-5106 Mozilla
Canonical
Information Exposure vulnerability in multiple products

Style editor traffic in the Developer Tools can be routed through a service worker hosted on a third party website if a user selects error links when these tools are open.

5.0
2018-06-11 CVE-2018-5101 Mozilla
Canonical
USE After Free vulnerability in multiple products

A use-after-free vulnerability can occur when manipulating floating "first-letter" style elements, resulting in a potentially exploitable crash.

5.0
2018-06-11 CVE-2018-5100 Mozilla
Canonical
USE After Free vulnerability in multiple products

A use-after-free vulnerability can occur when arguments passed to the "IsPotentiallyScrollable" function are freed while still in use by scripts.

5.0
2018-06-11 CVE-2018-5094 Mozilla
Canonical
Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in multiple products

A heap buffer overflow vulnerability may occur in WebAssembly when "shrinkElements" is called followed by garbage collection on memory that is now uninitialized.

5.0
2018-06-11 CVE-2018-5093 Mozilla
Canonical
Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in multiple products

A heap buffer overflow vulnerability may occur in WebAssembly during Memory/Table resizing, resulting in a potentially exploitable crash.

5.0
2018-06-11 CVE-2017-7848 Mozilla
Redhat
Debian
Injection vulnerability in multiple products

RSS fields can inject new lines into the created email structure, modifying the message body.

5.0
2018-06-11 CVE-2017-7843 Debian
Mozilla
Redhat
Information Exposure vulnerability in multiple products

When Private Browsing mode is used, it is possible for a web worker to write persistent data to IndexedDB and fingerprint a user uniquely.

5.0
2018-06-11 CVE-2017-7842 Mozilla Information Exposure vulnerability in Mozilla Firefox

If a document's Referrer Policy attribute is set to "no-referrer" sometimes two network requests are made for "<link>" elements instead of one.

5.0
2018-06-11 CVE-2017-7838 Mozilla Improper Input Validation vulnerability in Mozilla Firefox

Punycode format text will be displayed for entire qualified international domain names in some instances when a sub-domain triggers the punycode display instead of the primary domain being displayed in native script and the sub-domain only displaying as punycode.

5.0
2018-06-11 CVE-2017-7837 Mozilla Improper Input Validation vulnerability in Mozilla Firefox

SVG loaded through "<img>" tags can use "<meta>" tags within the SVG data to set cookies for that page.

5.0
2018-06-11 CVE-2017-7833 Mozilla Improper Input Validation vulnerability in Mozilla Firefox

Some Arabic and Indic vowel marker characters can be combined with Latin characters in a domain name to eclipse the non-Latin character with some font sets on the addressbar.

5.0
2018-06-11 CVE-2017-7832 Mozilla Improper Input Validation vulnerability in Mozilla Firefox

The combined, single character, version of the letter 'i' with any of the potential accents in unicode, such as acute or grave, can be spoofed in the addressbar by the dotless version of 'i' followed by the same accent as a second character with most font sets.

5.0
2018-06-11 CVE-2017-7831 Mozilla Information Exposure vulnerability in Mozilla Firefox

A vulnerability where the security wrapper does not deny access to some exposed properties using the deprecated "_exposedProps_" mechanism on proxy objects.

5.0
2018-06-11 CVE-2017-7829 Mozilla
Redhat
Debian
Canonical
Improper Input Validation vulnerability in multiple products

It is possible to spoof the sender's email address and display an arbitrary sender address to the email recipient.

5.0
2018-06-11 CVE-2017-7825 Debian
Mozilla
Apple
Improper Input Validation vulnerability in multiple products

Several fonts on OS X display some Tibetan and Arabic characters as whitespace.

5.0
2018-06-11 CVE-2017-7822 Mozilla Unspecified vulnerability in Mozilla Firefox

The AES-GCM implementation in WebCrypto API accepts 0-length IV when it should require a length of 1 according to the NIST Special Publication 800-38D specification.

5.0
2018-06-11 CVE-2017-7820 Mozilla Unspecified vulnerability in Mozilla Firefox

The "instanceof" operator can bypass the Xray wrapper mechanism.

5.0
2018-06-11 CVE-2017-7817 Mozilla
Google
Improper Input Validation vulnerability in Mozilla Firefox

A spoofing vulnerability can occur when a page switches to fullscreen mode without user notification, allowing a fake address bar to be displayed.

5.0
2018-06-11 CVE-2017-7816 Mozilla Improper Input Validation vulnerability in Mozilla Firefox

WebExtensions could use popups and panels in the extension UI to load an "about:" privileged URL, violating security checks that disallow this behavior.

5.0
2018-06-11 CVE-2017-7815 Mozilla Improper Input Validation vulnerability in Mozilla Firefox

On pages containing an iframe, the "data:" protocol can be used to create a modal dialog through Javascript that will have an arbitrary domains as the dialog's location, spoofing of the origin of the modal dialog from the user view.

5.0
2018-06-11 CVE-2017-7812 Mozilla Information Exposure vulnerability in Mozilla Firefox

If web content on a page is dragged onto portions of the browser UI, such as the tab bar, links can be opened that otherwise would not be allowed to open.

5.0
2018-06-11 CVE-2017-7808 Mozilla Information Exposure vulnerability in Mozilla Firefox

A content security policy (CSP) "frame-ancestors" directive containing origins with paths allows for comparisons against those paths instead of the origin.

5.0
2018-06-11 CVE-2017-7806 Mozilla USE After Free vulnerability in Mozilla Firefox

A use-after-free vulnerability can occur when the layer manager is freed too early when rendering specific SVG content, resulting in a potentially exploitable crash.

5.0
2018-06-11 CVE-2017-7805 Mozilla
Debian
USE After Free vulnerability in multiple products

During TLS 1.2 exchanges, handshake hashes are generated which point to a message buffer.

5.0
2018-06-11 CVE-2017-7804 Mozilla
Microsoft
Improper Input Validation vulnerability in Mozilla Firefox, Firefox ESR and Thunderbird

The destructor function for the "WindowsDllDetourPatcher" class can be re-purposed by malicious code in concert with another vulnerability to write arbitrary data to an attacker controlled location in memory.

5.0
2018-06-11 CVE-2017-7803 Redhat
Debian
Mozilla
Improper Privilege Management vulnerability in multiple products

When a page's content security policy (CSP) header contains a "sandbox" directive, other directives are ignored.

5.0
2018-06-11 CVE-2017-7797 Mozilla Origin Validation Error vulnerability in Mozilla Firefox

Response header name interning does not have same-origin protections and these headers are stored in a global registry.

5.0
2018-06-11 CVE-2017-7791 Debian
Redhat
Mozilla
Improper Input Validation vulnerability in multiple products

On pages containing an iframe, the "data:" protocol can be used to create a modal alert that will render over arbitrary domains following page navigation, spoofing of the origin of the modal alert from the iframe content.

5.0
2018-06-11 CVE-2017-7790 Mozilla
Microsoft
Unspecified vulnerability in Mozilla Firefox

On Windows systems, if non-null-terminated strings are copied into the crash reporter for some specific registry keys, stack memory data can be copied until a null is found.

5.0
2018-06-11 CVE-2017-7789 Mozilla Unspecified vulnerability in Mozilla Firefox

If a server sends two Strict-Transport-Security (STS) headers for a single connection, they will be rejected as invalid and HTTP Strict Transport Security (HSTS) will not be enabled for the connection.

5.0
2018-06-11 CVE-2017-7787 Debian
Redhat
Mozilla
Information Exposure vulnerability in multiple products

Same-origin policy protections can be bypassed on pages with embedded iframes during page reloads, allowing the iframes to access content on the top level page, leading to information disclosure.

5.0
2018-06-11 CVE-2017-7783 Mozilla Improper Input Validation vulnerability in Mozilla Firefox

If a long user name is used in a username/password combination in a site URL (such as " http://UserName:Password@example.com"), the resulting modal prompt will hang in a non-responsive state or crash, causing a denial of service.

5.0
2018-06-11 CVE-2017-7782 Mozilla
Microsoft
Improper Privilege Management vulnerability in Mozilla Firefox, Firefox ESR and Thunderbird

An error in the "WindowsDllDetourPatcher" where a RWX ("Read/Write/Execute") 4k block is allocated but never protected, violating DEP protections.

5.0
2018-06-11 CVE-2017-7765 Mozilla
Microsoft
Improper Input Validation vulnerability in Mozilla Firefox, Firefox ESR and Thunderbird

The "Mark of the Web" was not correctly saved on Windows when files with very long names were downloaded from the Internet.

5.0
2018-06-11 CVE-2017-7764 Mozilla
Debian
Improper Input Validation vulnerability in Mozilla Firefox, Firefox ESR and Thunderbird

Characters from the "Canadian Syllabics" unicode block can be mixed with characters from other unicode blocks in the addressbar instead of being rendered as their raw "punycode" form, allowing for domain name spoofing attacks through character confusion.

5.0
2018-06-11 CVE-2017-7763 Mozilla
Apple
Debian
Improper Input Validation vulnerability in Mozilla Firefox, Firefox ESR and Thunderbird

Default fonts on OS X display some Tibetan characters as whitespace.

5.0
2018-06-11 CVE-2017-7762 Redhat
Mozilla
Improper Input Validation vulnerability in multiple products

When entered directly, Reader Mode did not strip the username and password section of URLs displayed in the addressbar.

5.0
2018-06-11 CVE-2017-7759 Mozilla
Google
Information Exposure vulnerability in multiple products

Android intent URLs given to Firefox for Android can be used to navigate from HTTP or HTTPS URLs to local "file:" URLs, allowing for the reading of local data through a violation of same-origin policy.

5.0
2018-06-11 CVE-2017-7754 Debian
Redhat
Mozilla
Out-Of-Bounds Read vulnerability in multiple products

An out-of-bounds read in WebGL with a maliciously crafted "ImageInfo" object during WebGL operations.

5.0
2018-06-11 CVE-2017-5467 Redhat
Mozilla
Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in multiple products

A potential memory corruption and crash when using Skia content when drawing content outside of the bounds of a clipping region.

5.0
2018-06-11 CVE-2017-5463 Mozilla
Google
Improper Input Validation vulnerability in Mozilla Firefox

Android intents can be used to launch Firefox for Android in reader mode with a user specified URL.

5.0
2018-06-11 CVE-2017-5462 Debian
Mozilla
Incorrect Calculation vulnerability in multiple products

A flaw in DRBG number generation within the Network Security Services (NSS) library where the internal state V does not correctly carry bits over.

5.0
2018-06-11 CVE-2017-5455 Redhat
Mozilla
Multiple Security vulnerability in Mozilla Firefox

The internal feed reader APIs that crossed the sandbox barrier allowed for a sandbox escape and escalation of privilege if combined with another vulnerability that resulted in remote code execution inside the sandboxed process.

5.0
2018-06-11 CVE-2017-5454 Redhat
Mozilla
Information Exposure vulnerability in multiple products

A mechanism to bypass file system access protections in the sandbox to use the file picker to access different files than those selected in the file picker through the use of relative paths.

5.0
2018-06-11 CVE-2017-5450 Mozilla Improper Input Validation vulnerability in Mozilla Firefox

A mechanism to spoof the Firefox for Android addressbar using a "javascript:" URI.

5.0
2018-06-11 CVE-2017-5449 Redhat
Mozilla
Improper Input Validation vulnerability in multiple products

A possibly exploitable crash triggered during layout and manipulation of bidirectional unicode text in concert with CSS animations.

5.0
2018-06-11 CVE-2017-5445 Debian
Redhat
Mozilla
Improper Validation of Array Index vulnerability in multiple products

A vulnerability while parsing "application/http-index-format" format content where uninitialized values are used to create an array.

5.0
2018-06-11 CVE-2017-5444 Debian
Redhat
Mozilla
Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in multiple products

A buffer overflow vulnerability while parsing "application/http-index-format" format content when the header contains improperly formatted data.

5.0
2018-06-11 CVE-2017-5426 Mozilla
Linux
Incorrect Permission Assignment for Critical Resource vulnerability in Mozilla Firefox and Thunderbird

On Linux, if the secure computing mode BPF (seccomp-bpf) filter is running when the Gecko Media Plugin sandbox is started, the sandbox fails to be applied and items that would run within the sandbox are run protected only by the running filter which is typically weak compared to the sandbox.

5.0
2018-06-11 CVE-2017-5425 Mozilla
Apple
Information Exposure vulnerability in Mozilla Firefox and Thunderbird

The Gecko Media Plugin sandbox allows access to local files that match specific regular expressions.

5.0
2018-06-11 CVE-2017-5422 Mozilla Improper Input Validation vulnerability in Mozilla Firefox and Thunderbird

If a malicious site uses the "view-source:" protocol in a series within a single hyperlink, it can trigger a non-exploitable browser crash when the hyperlink is selected.

5.0
2018-06-11 CVE-2017-5421 Mozilla Improper Input Validation vulnerability in Mozilla Firefox and Thunderbird

A malicious site could spoof the contents of the print preview window if popup windows are enabled, resulting in user confusion of what site is currently loaded.

5.0
2018-06-11 CVE-2017-5418 Mozilla Out-Of-Bounds Read vulnerability in Mozilla Firefox and Thunderbird

An out of bounds read error occurs when parsing some HTTP digest authorization responses, resulting in information leakage through the reading of random memory containing matches to specifically set patterns.

5.0
2018-06-11 CVE-2017-5417 Mozilla Improper Input Validation vulnerability in Mozilla Firefox

When dragging content from the primary browser pane to the addressbar on a malicious site, it is possible to change the addressbar so that the displayed location following navigation does not match the URL of the newly loaded page.

5.0
2018-06-11 CVE-2017-5416 Mozilla Null Pointer Dereference vulnerability in Mozilla Firefox and Thunderbird

In certain circumstances a networking event listener can be prematurely released.

5.0
2018-06-11 CVE-2017-5415 Mozilla Improper Input Validation vulnerability in Mozilla Firefox

An attack can use a blob URL and script to spoof an arbitrary addressbar URL prefaced by "blob:" as the protocol, leading to user confusion and further spoofing attacks.

5.0
2018-06-11 CVE-2017-5412 Mozilla Buffer Errors vulnerability in Mozilla Firefox and Thunderbird

A buffer overflow read during SVG filter color value operations, resulting in data exposure.

5.0
2018-06-11 CVE-2017-5411 Mozilla
Microsoft
USE After Free vulnerability in Mozilla Firefox and Thunderbird

A use-after-free can occur during buffer storage operations within the ANGLE graphics library, used for WebGL content.

5.0
2018-06-11 CVE-2017-5408 Debian
Redhat
Mozilla
Information Exposure vulnerability in multiple products

Video files loaded video captions cross-origin without checking for the presence of CORS headers permitting such cross-origin use, leading to potential information disclosure for video captions.

5.0
2018-06-11 CVE-2017-5406 Mozilla Buffer Errors vulnerability in Mozilla Firefox and Thunderbird

A segmentation fault can occur in the Skia graphics library during some canvas operations due to issues with mask/clip intersection and empty masks.

5.0
2018-06-11 CVE-2017-5405 Debian
Redhat
Mozilla
USE of Uninitialized Resource vulnerability in multiple products

Certain response codes in FTP connections can result in the use of uninitialized values for ports in FTP operations.

5.0
2018-06-11 CVE-2017-5388 Mozilla Allocation of Resources Without Limits OR Throttling vulnerability in Mozilla Firefox

A STUN server in conjunction with a large number of "webkitRTCPeerConnection" objects can be used to send large STUN packets in a short period of time due to a lack of rate limiting being applied on e10s systems, allowing for a denial of service attack.

5.0
2018-06-11 CVE-2017-5385 Mozilla Information Exposure vulnerability in Mozilla Firefox

Data sent with in multipart channels, such as the multipart/x-mixed-replace MIME type, will ignore the referrer-policy response header, leading to potential information disclosure for sites using this header.

5.0
2018-06-11 CVE-2017-5383 Debian
Redhat
Mozilla
Improper Input Validation vulnerability in multiple products

URLs containing certain unicode glyphs for alternative hyphens and quotes do not properly trigger punycode display, allowing for domain name spoofing attacks in the location bar.

5.0
2018-06-11 CVE-2017-5382 Mozilla Information Exposure vulnerability in Mozilla Firefox

Feed preview for RSS feeds can be used to capture errors and exceptions generated by privileged content, allowing for the exposure of internal information not meant to be seen by web content.

5.0
2018-06-11 CVE-2017-5381 Mozilla Path Traversal vulnerability in Mozilla Firefox

The "export" function in the Certificate Viewer can force local filesystem navigation when the "common name" in a certificate contains slashes, allowing certificate content to be saved in unsafe locations with an arbitrary filename.

5.0
2018-06-11 CVE-2017-5379 Mozilla USE After Free vulnerability in Mozilla Firefox

Use-after-free vulnerability in Web Animations when interacting with cycle collection found through fuzzing.

5.0
2018-06-11 CVE-2017-5378 Debian
Redhat
Mozilla
Information Exposure vulnerability in multiple products

Hashed codes of JavaScript objects are shared between pages.

5.0
2018-06-11 CVE-2016-9904 Redhat
Debian
Mozilla
Information Exposure vulnerability in multiple products

An attacker could use a JavaScript Map/Set timing attack to determine whether an atom is used by another compartment/zone in specific contexts.

5.0
2018-06-11 CVE-2016-9902 Redhat
Mozilla
Origin Validation Error vulnerability in multiple products

The Pocket toolbar button, once activated, listens for events fired from it's own pages but does not verify the origin of incoming events.

5.0
2018-06-11 CVE-2016-9900 Debian
Redhat
Mozilla
7PK - Security Features vulnerability in multiple products

External resources that should be blocked when loaded by SVG images can bypass security restrictions through the use of "data:" URLs.

5.0
2018-06-11 CVE-2016-9897 Redhat
Debian
Mozilla
Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in multiple products

Memory corruption resulting in a potentially exploitable crash during WebGL functions using a vector constructor with a varying array within libGLES.

5.0
2018-06-11 CVE-2016-9894 Mozilla Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in Mozilla Firefox

A buffer overflow in SkiaGl caused when a GrGLBuffer is truncated during allocation.

5.0
2018-06-11 CVE-2016-9079 Debian
Redhat
Mozilla
Microsoft
Torproject
USE After Free vulnerability in multiple products

A use-after-free vulnerability in SVG Animation has been discovered.

5.0
2018-06-11 CVE-2016-9073 Mozilla Permissions, Privileges, and Access Controls vulnerability in Mozilla Firefox

WebExtensions can bypass security checks to load privileged URLs and potentially escape the WebExtension sandbox.

5.0
2018-06-11 CVE-2016-9072 Mozilla
Microsoft
7PK - Security Features vulnerability in Mozilla Firefox

When a new Firefox profile is created on 64-bit Windows installations, the sandbox for 64-bit NPAPI plugins is not enabled by default.

5.0
2018-06-11 CVE-2016-9071 Mozilla 7PK - Security Features vulnerability in Mozilla Firefox

Content Security Policy combined with HTTP to HTTPS redirection can be used by malicious server to verify whether a known site is within a user's browser history.

5.0
2018-06-11 CVE-2016-9068 Mozilla USE After Free vulnerability in Mozilla Firefox

A use-after-free during web animations when working with timelines resulting in a potentially exploitable crash.

5.0
2018-06-11 CVE-2016-9067 Mozilla USE After Free vulnerability in Mozilla Firefox

Two use-after-free errors during DOM operations resulting in potentially exploitable crashes.

5.0
2018-06-11 CVE-2016-9066 Mozilla
Debian
Buffer Errors vulnerability in Mozilla Firefox, Firefox ESR and Thunderbird

A buffer overflow resulting in a potentially exploitable crash due to memory allocation issues when handling large amounts of incoming data.

5.0
2018-06-11 CVE-2016-9065 Mozilla
Google
Improper Input Validation vulnerability in Mozilla Firefox

The location bar in Firefox for Android can be spoofed by forcing a user into fullscreen mode, blocking its exiting, and creating of a fake location bar without any user notification.

5.0
2018-06-11 CVE-2016-9061 Mozilla
Google
Permission Issues vulnerability in Mozilla Firefox

A previously installed malicious Android application which defines a specific signature-level permissions used by Firefox can access API keys meant for Firefox only.

5.0
2018-06-11 CVE-2016-5299 Mozilla
Google
Permission Issues vulnerability in Mozilla Firefox

A previously installed malicious Android application with same signature-level permissions as Firefox can intercept AuthTokens meant for Firefox only.

5.0
2018-06-11 CVE-2016-5296 Mozilla
Debian
Buffer Errors vulnerability in Mozilla Firefox, Firefox ESR and Thunderbird

A heap-buffer-overflow in Cairo when processing SVG content caused by compiler optimization, resulting in a potentially exploitable crash.

5.0
2018-06-11 CVE-2011-4181 Opensuse Improper Input Validation vulnerability in Opensuse Open Build Service

A vulnerability in open build service allows remote attackers to gain access to source files even though source access is disabled.

5.0
2018-06-11 CVE-2018-12093 Tinyexr Project Missing Release of Resource After Effective Lifetime vulnerability in Tinyexr Project Tinyexr 0.9.5

tinyexr 0.9.5 has a memory leak in ParseEXRHeaderFromMemory in tinyexr.h.

5.0
2018-06-11 CVE-2018-12025 Futurxe Improper Input Validation vulnerability in Futurxe

The transferFrom function of a smart contract implementation for FuturXE (FXE), an Ethereum ERC20 token, allows attackers to accomplish an unauthorized transfer of digital assets because of a logic error.

5.0
2018-06-15 CVE-2018-5860 Google Access of Uninitialized Pointer vulnerability in Google Android

In the MDSS driver in all Android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the Linux kernel, a data structure may be used without being initialized correctly.

4.9
2018-06-15 CVE-2017-18169 Google Reachable Assertion vulnerability in Google Android

User process can perform the kernel DOS in ashmem when doing cache maintenance operation in all Android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the Linux kernel.

4.9
2018-06-14 CVE-2018-8205 Microsoft Unspecified vulnerability in Microsoft products

A denial of service vulnerability exists when Windows improperly handles objects in memory, aka "Windows Denial of Service Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers.

4.9
2018-06-12 CVE-2018-5803 Linux
Debian
Redhat
Improper Input Validation vulnerability in Linux Kernel

In the Linux Kernel before version 4.15.8, 4.14.25, 4.9.87, 4.4.121, 4.1.51, and 3.2.102, an error in the "_sctp_make_chunk()" function (net/sctp/sm_make_chunk.c) when handling SCTP packets length can be exploited to cause a kernel crash.

4.9
2018-06-11 CVE-2017-5414 Mozilla Information Exposure vulnerability in Mozilla Firefox and Thunderbird

The file picker dialog can choose and display the wrong local default directory when instantiated.

4.9
2018-06-11 CVE-2016-5291 Mozilla
Debian
Improper Input Validation vulnerability in Mozilla Firefox, Firefox ESR and Thunderbird

A same-origin policy bypass with local shortcut files to load arbitrary local content from disk.

4.9
2018-06-17 CVE-2018-12326 Redislabs Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in Redislabs Redis

Buffer overflow in redis-cli of Redis before 4.0.10 and 5.x before 5.0 RC3 allows an attacker to achieve code execution and escalate to higher privileges via a crafted command line.

4.6
2018-06-15 CVE-2018-5863 Google Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in Google Android

If userspace provides a too-large WPA RSN IE length in wlan_hdd_cfg80211_set_ie(), a buffer overflow occurs in all Android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the Linux kernel.

4.6
2018-06-15 CVE-2018-5857 Google USE After Free vulnerability in Google Android

In the WCD CPE codec, a Use After Free condition can occur in all Android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the Linux kernel.

4.6
2018-06-15 CVE-2018-5854 Google Out-Of-Bounds Write vulnerability in Google Android

A stack-based buffer overflow can occur in fastboot from all Android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the Linux kernel.

4.6
2018-06-14 CVE-2018-8221 Microsoft Unspecified vulnerability in Microsoft Windows 10 and Windows Server 2016

A security feature bypass vulnerability exists in Device Guard that could allow an attacker to inject malicious code into a Windows PowerShell session, aka "Device Guard Code Integrity Policy Security Feature Bypass Vulnerability." This affects Windows Server 2016, Windows 10, Windows 10 Servers.

4.6
2018-06-14 CVE-2018-8219 Microsoft Unspecified vulnerability in Microsoft Windows 10 and Windows Server 2016

An elevation of privilege vulnerability exists when Windows Hyper-V instruction emulation fails to properly enforce privilege levels, aka "Hypervisor Code Integrity Elevation of Privilege Vulnerability." This affects Windows Server 2016, Windows 10, Windows 10 Servers.

4.6
2018-06-14 CVE-2018-8217 Microsoft Unspecified vulnerability in Microsoft Windows 10 and Windows Server 2016

A security feature bypass vulnerability exists in Device Guard that could allow an attacker to inject malicious code into a Windows PowerShell session, aka "Device Guard Code Integrity Policy Security Feature Bypass Vulnerability." This affects Windows Server 2016, Windows 10.

4.6
2018-06-14 CVE-2018-8216 Microsoft Unspecified vulnerability in Microsoft Windows 10 and Windows Server 2016

A security feature bypass vulnerability exists in Device Guard that could allow an attacker to inject malicious code into a Windows PowerShell session, aka "Device Guard Code Integrity Policy Security Feature Bypass Vulnerability." This affects Windows Server 2016, Windows 10.

4.6
2018-06-14 CVE-2018-8215 Microsoft Unspecified vulnerability in Microsoft Windows 10 and Windows Server 2016

A security feature bypass vulnerability exists in Device Guard that could allow an attacker to inject malicious code into a Windows PowerShell session, aka "Device Guard Code Integrity Policy Security Feature Bypass Vulnerability." This affects Windows Server 2016, Windows 10, Windows 10 Servers.

4.6
2018-06-14 CVE-2018-8212 Microsoft Unspecified vulnerability in Microsoft Windows 10 and Windows Server 2016

A security feature bypass vulnerability exists in Device Guard that could allow an attacker to inject malicious code into a Windows PowerShell session, aka "Device Guard Code Integrity Policy Security Feature Bypass Vulnerability." This affects Windows Server 2016, Windows 10, Windows 10 Servers.

4.6
2018-06-14 CVE-2018-8211 Microsoft Unspecified vulnerability in Microsoft Windows 10 and Windows Server 2016

A security feature bypass vulnerability exists in Device Guard that could allow an attacker to inject malicious code into a Windows PowerShell session, aka "Device Guard Code Integrity Policy Security Feature Bypass Vulnerability." This affects Windows 10 Servers, Windows 10.

4.6
2018-06-14 CVE-2018-8140 Microsoft Unspecified vulnerability in Microsoft products

An Elevation of Privilege vulnerability exists when Cortana retrieves data from user input services without consideration for status, aka "Cortana Elevation of Privilege Vulnerability." This affects Windows 10 Servers, Windows 10.

4.6
2018-06-13 CVE-2018-1431 IBM Unspecified vulnerability in IBM General Parallel File System and Spectrum Scale

A vulnerability in GSKit affects IBM Spectrum Scale 4.1.1, 4.2.0, 4.2.1, 4.2.3, and 5.0.0 that could allow a local attacker to obtain control of the Spectrum Scale daemon and to access and modify files in the Spectrum Scale file system, and possibly to obtain administrator privileges on the node.

4.6
2018-06-12 CVE-2018-5851 Google Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in Google Android

Buffer over flow can occur while processing a HTT_T2H_MSG_TYPE_TX_COMPL_IND message with an out-of-range num_msdus value in all Android releases from CAF (Android for MSM, Firefox OS for MSM, QRD Android) using the Linux Kernel.

4.6
2018-06-12 CVE-2018-5848 Google
Redhat
Debian
Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in multiple products

In the function wmi_set_ie(), the length validation code does not handle unsigned integer overflow properly.

4.6
2018-06-12 CVE-2018-5847 Google USE After Free vulnerability in Google Android

Early or late retirement of rotation requests can result in a Use After Free condition in all Android releases from CAF (Android for MSM, Firefox OS for MSM, QRD Android) using the Linux Kernel.

4.6
2018-06-12 CVE-2018-5844 Google USE After Free vulnerability in Google Android

In the video driver function set_output_buffers(), binfo can be accessed after being freed in a failure scenario in all Android releases from CAF (Android for MSM, Firefox OS for MSM, QRD Android) using the Linux Kernel.

4.6
2018-06-12 CVE-2018-5843 Google Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in Google Android

In the function wma_pdev_div_info_evt_handler() in all Android releases from CAF (Android for MSM, Firefox OS for MSM, QRD Android) using the Linux Kernel, there is no upper bound check on the value event->num_chains_valid received from firmware which can lead to a buffer overwrite of the fixed size chain_rssi_result structure.

4.6
2018-06-12 CVE-2018-5842 Google Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in Google Android

An arbitrary address write can occur if a compromised WLAN firmware sends incorrect data to WLAN driver in all Android releases from CAF (Android for MSM, Firefox OS for MSM, QRD Android) using the Linux Kernel.

4.6
2018-06-12 CVE-2018-3582 Google Improper Input Validation vulnerability in Google Android

Buffer overflow can occur due to improper input validation in multiple WMA event handler functions in all Android releases from CAF (Android for MSM, Firefox OS for MSM, QRD Android) using the Linux Kernel.

4.6
2018-06-12 CVE-2018-3581 Google Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in Google Android

In the WLAN driver in all Android releases from CAF (Android for MSM, Firefox OS for MSM, QRD Android) using the Linux Kernel, a buffer overwrite can occur if the vdev_id received from firmware is larger than max_bssid.

4.6
2018-06-12 CVE-2018-3576 Google Improper Validation of Array Index vulnerability in Google Android

improper validation of array index in WiFi driver function sapInterferenceRssiCount() leads to array out-of-bounds access in all Android releases from CAF (Android for MSM, Firefox OS for MSM, QRD Android) using the Linux Kernel.

4.6
2018-06-12 CVE-2018-3572 Google Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in Google Android

While processing a DSP buffer in an audio driver's event handler, an index of a buffer is not checked before accessing the buffer in all Android releases from CAF (Android for MSM, Firefox OS for MSM, QRD Android) using the Linux Kernel.

4.6
2018-06-12 CVE-2018-3571 Google USE After Free vulnerability in Google Android

In the KGSL driver in all Android releases from CAF (Android for MSM, Firefox OS for MSM, QRD Android) using the Linux Kernel, a Use After Free condition can occur when printing information about sparse memory allocations

4.6
2018-06-12 CVE-2017-18070 Google Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in Google Android

In wma_ndp_end_response_event_handler(), the variable len_end_rsp is a uint32 which can be overflowed if the value of variable "event->num_ndp_end_rsp_per_ndi_list" is very large which can then lead to a heap overwrite of the heap object end_rsp in all Android releases from CAF (Android for MSM, Firefox OS for MSM, QRD Android) using the Linux Kernel.

4.6
2018-06-12 CVE-2017-15857 Google Improper Validation of Array Index vulnerability in Google Android

In the camera driver, an out-of-bounds access can occur due to an error in copying region params from user space in all Android releases from CAF (Android for MSM, Firefox OS for MSM, QRD Android) using the Linux Kernel.

4.6
2018-06-12 CVE-2017-15854 Google Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in Google Android

The value of fix_param->num_chans is received from firmware and if it is too large, an integer overflow can occur in wma_radio_chan_stats_event_handler() for the derived length len leading to a subsequent buffer overflow in all Android releases from CAF (Android for MSM, Firefox OS for MSM, QRD Android) using the Linux Kernel.

4.6
2018-06-12 CVE-2017-15842 Google USE After Free vulnerability in Google Android

Buffer might get used after it gets freed due to unlocking the mutex before freeing the buffer in all Android releases from CAF (Android for MSM, Firefox OS for MSM, QRD Android) using the Linux Kernel.

4.6
2018-06-11 CVE-2017-7836 Mozilla
Apple
Linux
Uncontrolled Search Path Element vulnerability in Mozilla Firefox

The "pingsender" executable used by the Firefox Health Report dynamically loads a system copy of libcurl, which an attacker could replace.

4.6
2018-06-11 CVE-2017-7794 Mozilla
Linux
Incorrect Default Permissions vulnerability in Mozilla Firefox

On Linux systems, if the content process is compromised, the sandbox broker will allow files to be truncated even though the sandbox explicitly only has read access to the local file system and no write permissions.

4.6
2018-06-11 CVE-2017-7766 Mozilla
Microsoft
Multiple Security vulnerability in Mozilla Firefox and Firefox ESR

An attack using manipulation of "updater.ini" contents, used by the Mozilla Windows Updater, and privilege escalation through the Mozilla Maintenance Service to allow for arbitrary file execution and deletion by the Maintenance Service, which has privileged access.

4.6
2018-06-11 CVE-2017-7760 Mozilla
Microsoft
Channel and Path Errors vulnerability in Mozilla Firefox and Firefox ESR

The Mozilla Windows updater modifies some files to be updated by reading the original file and applying changes to it.

4.6
2018-06-11 CVE-2016-5295 Mozilla
Microsoft
Permissions, Privileges, and Access Controls vulnerability in Mozilla Firefox

This vulnerability allows an attacker to use the Mozilla Maintenance Service to escalate privilege by having the Maintenance Service invoke the Mozilla Updater to run malicious local files.

4.6
2018-06-17 CVE-2018-12029 Phusion
Debian
Race Condition vulnerability in multiple products

A race condition in the nginx module in Phusion Passenger 3.x through 5.x before 5.3.2 allows local escalation of privileges when a non-standard passenger_instance_registry_dir with insufficiently strict permissions is configured.

4.4
2018-06-14 CVE-2017-17172 Huawei Improper Handling of Exceptional Conditions vulnerability in Huawei Lyo-L21

Huawei smart phones LYO-L21 with software LYO-L21C479B107, LYO-L21C479B107 have a privilege escalation vulnerability.

4.4
2018-06-14 CVE-2018-8201 Microsoft Unspecified vulnerability in Microsoft Windows 10 and Windows Server 2016

A security feature bypass vulnerability exists in Device Guard that could allow an attacker to inject malicious code into a Windows PowerShell session, aka "Device Guard Code Integrity Policy Security Feature Bypass Vulnerability." This affects Windows Server 2016, Windows 10, Windows 10 Servers.

4.4
2018-06-12 CVE-2018-5849 Google USE After Free vulnerability in Google Android

Due to a race condition in the QTEECOM driver in all Android releases from CAF (Android for MSM, Firefox OS for MSM, QRD Android) using the Linux Kernel, when more than one HLOS client loads the same TA, a Use After Free condition can occur.

4.4
2018-06-12 CVE-2017-15843 Google Race Condition vulnerability in Google Android

Due to a race condition in a bus driver, a double free in msm_bus_floor_vote_context() can potentially occur in all Android releases from CAF (Android for MSM, Firefox OS for MSM, QRD Android) using the Linux Kernel.

4.4
2018-06-17 CVE-2018-12104 Airbnb Cross-Site Scripting vulnerability in Airbnb Knowledge Repo 0.7.4

Cross-site scripting (XSS) vulnerability in Airbnb Knowledge Repo 0.7.4 allows remote attackers to inject arbitrary web scripts or HTML via the post comments functionality, as demonstrated by the post/posts/new_report.kp URI.

4.3
2018-06-17 CVE-2018-12329 Ecos Information Exposure vulnerability in Ecos Secure Boot Stick Firmware 5.6.5

Protection Mechanism Failure in ECOS Secure Boot Stick (aka SBS) 5.6.5 allows a local attacker to duplicate an authentication factor via cloning.

4.3
2018-06-17 CVE-2018-11647 Oauth2Orize Fprm Project Cross-Site Scripting vulnerability in Oauth2Orize-Fprm Project Oauth2Orize-Fprm

index.js in oauth2orize-fprm before 0.2.1 has XSS via a crafted URL.

4.3
2018-06-17 CVE-2018-10377 Portswigger Improper Certificate Validation vulnerability in Portswigger Burp Suite

PortSwigger Burp Suite before 1.7.34 has Improper Certificate Validation of the Collaborator server certificate, which might allow man-in-the-middle attackers to obtain interaction data.

4.3
2018-06-16 CVE-2018-12501 Nagios Cross-Site Scripting vulnerability in Nagios Fusion

Nagios Fusion before 4.1.4 has XSS, aka TPS#13332-13335.

4.3
2018-06-15 CVE-2018-12495 Discount Project
Debian
Out-Of-Bounds Read vulnerability in multiple products

The quoteblock function in markdown.c in libmarkdown.a in DISCOUNT 2.2.3a allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted file.

4.3
2018-06-15 CVE-2018-12460 Ffmpeg Null Pointer Dereference vulnerability in Ffmpeg 4.0

libavcodec in FFmpeg 4.0 may trigger a NULL pointer dereference if the studio profile is incorrectly detected while converting a crafted AVI file to MPEG4, leading to a denial of service, related to idctdsp.c and mpegvideo.c.

4.3
2018-06-15 CVE-2018-12459 Ffmpeg Improper Input Validation vulnerability in Ffmpeg 4.0

An inconsistent bits-per-sample value in the ff_mpeg4_decode_picture_header function in libavcodec/mpeg4videodec.c in FFmpeg 4.0 may trigger an assertion violation while converting a crafted AVI file to MPEG4, leading to a denial of service.

4.3
2018-06-15 CVE-2018-12458 Ffmpeg
Debian
Improper Input Validation vulnerability in multiple products

An improper integer type in the mpeg4_encode_gop_header function in libavcodec/mpeg4videoenc.c in FFmpeg 2.8 and 4.0 may trigger an assertion violation while converting a crafted AVI file to MPEG4, leading to a denial of service.

4.3
2018-06-14 CVE-2018-12432 Javamelody Project Cross-Site Scripting vulnerability in Javamelody Project Javamelody

JavaMelody through 1.60.0 has XSS via the counter parameter in a clear_counter action to the /monitoring URI.

4.3
2018-06-14 CVE-2018-11690 Balbooa Cross-Site Scripting vulnerability in Balbooa Gridbox

The Balbooa Gridbox extension version 2.4.0 and previous versions for Joomla! is vulnerable to cross-site scripting, caused by improper validation of user-supplied input.

4.3
2018-06-14 CVE-2018-11689 Samsung Cross-Site Scripting vulnerability in Samsung Smartviewer

Smart Viewer in Samsung Web Viewer for Samsung DVR is vulnerable to cross-site scripting, caused by improper validation of user-supplied input.

4.3
2018-06-14 CVE-2018-4848 Siemens Cross-Site Scripting vulnerability in Siemens products

A vulnerability has been identified in SCALANCE X-200 switch family (incl.

4.3
2018-06-14 CVE-2018-12418 Junrar Project Infinite Loop vulnerability in Junrar Project Junrar 0.6/0.7/1.0.0

Archive.java in Junrar before 1.0.1, as used in Apache Tika and other products, is affected by a denial of service vulnerability due to an infinite loop when handling corrupt RAR files.

4.3
2018-06-14 CVE-2018-8246 Microsoft Information Exposure vulnerability in Microsoft products

An information disclosure vulnerability exists when Microsoft Excel improperly discloses the contents of its memory, aka "Microsoft Excel Information Disclosure Vulnerability." This affects Microsoft Excel Viewer, Microsoft Office, Microsoft Excel.

4.3
2018-06-14 CVE-2018-8244 Microsoft Improper Input Validation vulnerability in Microsoft Office, Outlook and Outlook RT

An elevation of privilege vulnerability exists when Microsoft Outlook does not validate attachment headers properly, aka "Microsoft Outlook Elevation of Privilege Vulnerability." This affects Microsoft Office, Microsoft Outlook.

4.3
2018-06-14 CVE-2018-8239 Microsoft Information Exposure vulnerability in Microsoft products

An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka "Windows GDI Information Disclosure Vulnerability." This affects Windows Server 2016, Windows 10, Windows 10 Servers.

4.3
2018-06-14 CVE-2018-8235 Microsoft Origin Validation Error vulnerability in Microsoft Edge

A security feature bypass vulnerability exists when Microsoft Edge improperly handles requests of different origins, aka "Microsoft Edge Security Feature Bypass Vulnerability." This affects Microsoft Edge.

4.3
2018-06-14 CVE-2018-8234 Microsoft Information Exposure vulnerability in Microsoft Edge

An information disclosure vulnerability exists when Microsoft Edge improperly handles objects in memory, aka "Microsoft Edge Information Disclosure Vulnerability." This affects Microsoft Edge.

4.3
2018-06-14 CVE-2018-8113 Microsoft Unspecified vulnerability in Microsoft Internet Explorer 11

A security feature bypass vulnerability exists in Internet Explorer that allows for bypassing Mark of the Web Tagging (MOTW), aka "Internet Explorer Security Feature Bypass Vulnerability." This affects Internet Explorer 11.

4.3
2018-06-14 CVE-2018-0871 Microsoft Information Exposure vulnerability in Microsoft Edge

An information disclosure vulnerability exists when Edge improperly marks files, aka "Microsoft Edge Information Disclosure Vulnerability." This affects Microsoft Edge.

4.3
2018-06-13 CVE-2018-12355 Knowage Suite Cross-Site Scripting vulnerability in ENG Knowage 6.1.1

Knowage (formerly SpagoBI) 6.1.1 allows XSS via the name or description field to the "Olap Schemas' Catalogue" catalogue.

4.3
2018-06-13 CVE-2018-12353 Knowage Suite Cross-Site Scripting vulnerability in Knowage-Suite Knowage 6.1.1

Knowage (formerly SpagoBI) 6.1.1 allows XSS via the name field to the "Business Model's Catalogue" catalogue.

4.3
2018-06-13 CVE-2018-12040 Sensiolabs Cross-Site Scripting vulnerability in Sensiolabs Symfony 3.3.6

** DISPUTED ** Reflected Cross-site scripting (XSS) vulnerability in the web profiler in SensioLabs Symfony 3.3.6 allows remote attackers to inject arbitrary web script or HTML via the "file" parameter, aka an _profiler/open?file= URI.

4.3
2018-06-13 CVE-2018-10407 Carbonblack Improper Verification of Cryptographic Signature vulnerability in Carbonblack Carbon Black CB

An issue was discovered in Carbon Black Cb Response.

4.3
2018-06-13 CVE-2018-1121 Procps Project Race Condition vulnerability in Procps Project Procps

procps-ng, procps is vulnerable to a process hiding through race condition.

4.3
2018-06-13 CVE-2018-12322 Radare Out-Of-Bounds Read vulnerability in Radare Radare2 2.6.0

There is a heap out of bounds read in radare2 2.6.0 in _6502_op() in libr/anal/p/anal_6502.c via a crafted iNES ROM binary file.

4.3
2018-06-13 CVE-2018-11688 Igniterealtime Cross-Site Scripting vulnerability in Igniterealtime Openfire 3.7.1

Ignite Realtime Openfire before 3.9.2 is vulnerable to cross-site scripting, caused by improper validation of user-supplied input.

4.3
2018-06-13 CVE-2018-11386 Sensiolabs
Debian
Insufficient Session Expiration vulnerability in multiple products

An issue was discovered in the HttpFoundation component in Symfony 2.7.x before 2.7.48, 2.8.x before 2.8.41, 3.3.x before 3.3.17, 3.4.x before 3.4.11, and 4.0.x before 4.0.11.

4.3
2018-06-13 CVE-2018-3759 Private Address Check Project Race Condition vulnerability in Private Address Check Project Private Address Check

private_address_check ruby gem before 0.5.0 is vulnerable to a time-of-check time-of-use (TOCTOU) race condition due to the address the socket uses not being checked.

4.3
2018-06-13 CVE-2018-12290 Yii2 Statemachine Cross-Site Scripting vulnerability in Yii2-Statemachine 2.X.X

The Yii2-StateMachine extension v2.x.x for Yii2 has XSS.

4.3
2018-06-13 CVE-2018-12273 Ximdex Cross-Site Scripting vulnerability in Ximdex 4.0

The /edit URI in the DMS component in Ximdex 4.0 has XSS via the Ciudad or Nombre parameter.

4.3
2018-06-13 CVE-2018-12272 Ximdex Cross-Site Scripting vulnerability in Ximdex 4.0

xowl/request.php in Ximdex 4.0 has XSS via the content parameter.

4.3
2018-06-13 CVE-2018-12266 Hongcms Project Cross-Site Scripting vulnerability in Hongcms Project Hongcms 3.0.0

system\errors\404.php in HongCMS 3.0.0 has XSS via crafted input that triggers a 404 HTTP status code.

4.3
2018-06-12 CVE-2018-1103 Redhat Improper Input Validation vulnerability in Redhat Source-To-Image

Openshift Enterprise source-to-image before version 1.1.10 is vulnerable to an improper validation of user input.

4.3
2018-06-12 CVE-2018-12229 SFU Cross-Site Scripting vulnerability in SFU Open Journal System

Cross-site scripting (XSS) vulnerability in Public Knowledge Project (PKP) Open Journal System (OJS) 3.0.0 to 3.1.1-1 allows remote attackers to inject arbitrary web script or HTML via the templates/frontend/pages/search.tpl parameter (aka the By Author field).

4.3
2018-06-11 CVE-2018-5185 Redhat
Debian
Canonical
Mozilla
Missing Encryption of Sensitive Data vulnerability in multiple products

Plaintext of decrypted emails can leak through by user submitting an embedded form.

4.3
2018-06-11 CVE-2018-5176 Canonical
Mozilla
Improper Input Validation vulnerability in multiple products

The JSON Viewer displays clickable hyperlinks for strings that are parseable as URLs, including "javascript:" links.

4.3
2018-06-11 CVE-2018-5175 Canonical
Mozilla
Cross-Site Scripting vulnerability in multiple products

A mechanism to bypass Content Security Policy (CSP) protections on sites that have a "script-src" policy of "'strict-dynamic'".

4.3
2018-06-11 CVE-2018-5172 Canonical
Mozilla
Cross-Site Scripting vulnerability in multiple products

The Live Bookmarks page and the PDF viewer can run injected script content if a user pastes script from the clipboard into them while viewing RSS feeds or PDF files.

4.3
2018-06-11 CVE-2018-5170 Redhat
Mozilla
Debian
Canonical
Improper Input Validation vulnerability in multiple products

It is possible to spoof the filename of an attachment and display an arbitrary attachment name.

4.3
2018-06-11 CVE-2018-5169 Canonical
Mozilla
Improper Input Validation vulnerability in multiple products

If manipulated hyperlinked text with "chrome:" URL contained in it is dragged and dropped on the "home" icon, the home page can be reset to include a normally-unlinkable chrome page as one of the home page tabs.

4.3
2018-06-11 CVE-2018-5167 Canonical
Mozilla
Improper Input Validation vulnerability in multiple products

The web console and JavaScript debugger do not sanitize all output that can be hyperlinked.

4.3
2018-06-11 CVE-2018-5164 Mozilla
Canonical
Cross-Site Scripting vulnerability in multiple products

Content Security Policy (CSP) is not applied correctly to all parts of multipart content sent with the "multipart/x-mixed-replace" MIME type.

4.3
2018-06-11 CVE-2018-5161 Redhat
Debian
Canonical
Mozilla
Improper Input Validation vulnerability in multiple products

Crafted message headers can cause a Thunderbird process to hang on receiving the message.

4.3
2018-06-11 CVE-2018-5152 Mozilla
Canonical
USE of A Broken OR Risky Cryptographic Algorithm vulnerability in multiple products

WebExtensions with the appropriate permissions can attach content scripts to Mozilla sites such as accounts.firefox.com and listen to network traffic to the site through the "webRequest" API.

4.3
2018-06-11 CVE-2018-5143 Mozilla
Canonical
Cross-Site Scripting vulnerability in multiple products

URLs using "javascript:" have the protocol removed when pasted into the addressbar to protect users from cross-site scripting (XSS) attacks, but if a tab character is embedded in the "javascript:" URL the protocol is not removed and the script will execute.

4.3
2018-06-11 CVE-2018-5133 Mozilla
Canonical
Information Exposure vulnerability in multiple products

If the "app.support.baseURL" preference is changed by a malicious local program to contain HTML and script content, this content is not sanitized.

4.3
2018-06-11 CVE-2018-5132 Mozilla
Canonical
Information Exposure vulnerability in multiple products

The Find API for WebExtensions can search some privileged pages, such as "about:debugging", if these pages are open in a tab.

4.3
2018-06-11 CVE-2018-5131 Debian
Mozilla
Redhat
Canonical
Information Exposure vulnerability in multiple products

Under certain circumstances the "fetch()" API can return transient local copies of resources that were sent with a "no-store" or "no-cache" cache header instead of downloading a copy from the network as it should.

4.3
2018-06-11 CVE-2018-5111 Mozilla
Canonical
Improper Input Validation vulnerability in multiple products

When the text of a specially formatted URL is dragged to the addressbar from page content, the displayed URL can be spoofed to show a different site than the one loaded.

4.3
2018-06-11 CVE-2018-5108 Mozilla
Canonical
Information Exposure vulnerability in multiple products

A Blob URL can violate origin attribute segregation, allowing it to be accessed from a private browsing tab and for data to be passed between the private browsing tab and a normal tab.

4.3
2018-06-11 CVE-2017-7847 Debian
Redhat
Mozilla
Information Exposure vulnerability in multiple products

Crafted CSS in an RSS feed can leak and reveal local path strings, which may contain user name.

4.3
2018-06-11 CVE-2017-7844 Mozilla Information Exposure vulnerability in Mozilla Firefox

A combination of an external SVG image referenced on a page and the coloring of anchor links stored within this image can be used to determine which pages a user has in their history.

4.3
2018-06-11 CVE-2017-7840 Mozilla Cross-Site Scripting vulnerability in Mozilla Firefox

JavaScript can be injected into an exported bookmarks file by placing JavaScript code into user-supplied tags in saved bookmarks.

4.3
2018-06-11 CVE-2017-7839 Mozilla Cross-Site Scripting vulnerability in Mozilla Firefox

Control characters prepended before "javascript:" URLs pasted in the addressbar can cause the leading characters to be ignored and the pasted JavaScript to be executed instead of being blocked.

4.3
2018-06-11 CVE-2017-7834 Mozilla Cross-Site Scripting vulnerability in Mozilla Firefox

A "data:" URL loaded in a new tab did not inherit the Content Security Policy (CSP) of the original page, allowing for bypasses of the policy including the execution of JavaScript.

4.3
2018-06-11 CVE-2017-7830 Debian
Mozilla
Redhat
The Resource Timing API incorrectly revealed navigations in cross-origin iframes.
4.3
2018-06-11 CVE-2017-7823 Redhat
Debian
Mozilla
Cross-Site Scripting vulnerability in multiple products

The content security policy (CSP) "sandbox" directive did not create a unique origin for the document, causing it to behave as if the "allow-same-origin" keyword were always specified.

4.3
2018-06-11 CVE-2017-7799 Mozilla Cross-Site Scripting vulnerability in Mozilla Firefox

JavaScript in the "about:webrtc" page is not sanitized properly being assigned to "innerHTML".

4.3
2018-06-11 CVE-2017-7781 Mozilla Unspecified vulnerability in Mozilla Firefox

An error occurs in the elliptic curve point addition algorithm that uses mixed Jacobian-affine coordinates where it can yield a result "POINT_AT_INFINITY" when it should not.

4.3
2018-06-11 CVE-2017-7770 Mozilla
Google
Improper Input Validation vulnerability in Mozilla Firefox

A mechanism where when a new tab is loaded through JavaScript events, if fullscreen mode is then entered, the addressbar will not be rendered.

4.3
2018-06-11 CVE-2017-5466 Redhat
Mozilla
Cross-Site Scripting vulnerability in multiple products

If a page is loaded from an original site through a hyperlink and contains a redirect to a "data:text/html" URL, triggering a reload will run the reloaded "data:text/html" page with its origin set incorrectly.

4.3
2018-06-11 CVE-2017-5458 Mozilla Cross-Site Scripting vulnerability in Mozilla Firefox

When a "javascript:" URL is drag and dropped by a user into the addressbar, the URL will be processed and executed.

4.3
2018-06-11 CVE-2017-5453 Mozilla Improper Input Validation vulnerability in Mozilla Firefox

A mechanism to inject static HTML into the RSS reader preview page due to a failure to escape characters sent as URL parameters for a feed's "TITLE" element.

4.3
2018-06-11 CVE-2017-5452 Mozilla Improper Input Validation vulnerability in Mozilla Firefox

Malicious sites can display a spoofed addressbar on a page when the existing location bar on the new page is scrolled out of view if an HTML editable page element is user selected.

4.3
2018-06-11 CVE-2017-5451 Redhat
Mozilla
Improper Input Validation vulnerability in multiple products

A mechanism to spoof the addressbar through the user interaction on the addressbar and the "onblur" event.

4.3
2018-06-11 CVE-2017-5420 Mozilla Improper Input Validation vulnerability in Mozilla Firefox

A "javascript:" url loaded by a malicious page can obfuscate its location by blanking the URL displayed in the addressbar, allowing for an attacker to spoof an existing page without the malicious page's address being displayed correctly.

4.3
2018-06-11 CVE-2017-5407 Debian
Redhat
Mozilla
Information Exposure vulnerability in multiple products

Using SVG filters that don't use the fixed point math implementation on a target iframe, a malicious page can extract pixel values from a targeted user.

4.3
2018-06-11 CVE-2017-5395 Mozilla
Google
Improper Input Validation vulnerability in Mozilla Firefox

Malicious sites can display a spoofed location bar on a subsequently loaded page when the existing location bar on the new page is scrolled out of view if navigations between pages can be timed correctly.

4.3
2018-06-11 CVE-2017-5393 Mozilla Cross-Site Scripting vulnerability in Mozilla Firefox

The "mozAddonManager" allows for the installation of extensions from the CDN for addons.mozilla.org, a publicly accessible site.

4.3
2018-06-11 CVE-2017-5384 Mozilla Information Exposure vulnerability in Mozilla Firefox

Proxy Auto-Config (PAC) files can specify a JavaScript function called for all URL requests with the full URL path which exposes more information than would be sent to the proxy itself in the case of HTTPS.

4.3
2018-06-11 CVE-2016-9903 Mozilla Cross-Site Scripting vulnerability in Mozilla Firefox

Mozilla's add-ons SDK had a world-accessible resource with an HTML injection vulnerability.

4.3
2018-06-11 CVE-2016-9895 Debian
Redhat
Mozilla
7PK - Security Features vulnerability in multiple products

Event handlers on "marquee" elements were executed despite a strict Content Security Policy (CSP) that disallowed inline JavaScript.

4.3
2018-06-11 CVE-2016-9076 Mozilla Improper Input Validation vulnerability in Mozilla Firefox

An issue where a "<select>" dropdown menu can be used to cover location bar content, resulting in potential spoofing attacks.

4.3
2018-06-11 CVE-2016-9074 Mozilla
Debian
Information Exposure vulnerability in Mozilla Firefox, Firefox ESR and Thunderbird

An existing mitigation of timing side-channel attacks is insufficient in some circumstances.

4.3
2018-06-11 CVE-2016-9064 Mozilla Improper Certificate Validation vulnerability in Mozilla Firefox and Firefox ESR

Add-on updates failed to verify that the add-on ID inside the signed package matched the ID of the add-on being updated.

4.3
2018-06-11 CVE-2016-5298 Mozilla
Google
Improper Input Validation vulnerability in Mozilla Firefox

A mechanism where disruption of the loading of a new web page can cause the previous page's favicon and SSL indicator to not be reset when the new page is loaded.

4.3
2018-06-11 CVE-2016-5292 Mozilla Improper Input Validation vulnerability in Mozilla Firefox

During URL parsing, a maliciously crafted URL can cause a potentially exploitable crash.

4.3
2018-06-11 CVE-2016-5288 Mozilla Information Exposure vulnerability in Mozilla Firefox

Web content could access information in the HTTP cache if e10s is disabled.

4.3
2018-06-11 CVE-2018-12111 Canon Cross-Site Scripting vulnerability in Canon EFI Printme

Cross-site scripting (XSS) vulnerability in the Canon PrintMe EFI webinterface allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to the /wt3/mydocs.php URI.

4.3
2018-06-11 CVE-2018-12108 Dropbox Improper Input Validation vulnerability in Dropbox Lepton 1.2.1

An issue was discovered in Dropbox Lepton 1.2.1.

4.3
2018-06-11 CVE-2018-12102 Md4C Project Null Pointer Dereference vulnerability in Md4C Project Md4C 0.2.6

md4c 0.2.6 has a NULL pointer dereference in the function md_process_line in md4c.c, related to ctx->current_block.

4.3
2018-06-11 CVE-2018-12099 Grafana
Netapp
Cross-Site Scripting vulnerability in multiple products

Grafana before 5.2.0-beta1 has XSS vulnerabilities in dashboard links.

4.3
2018-06-11 CVE-2018-12090 Lamsfoundation Cross-Site Scripting vulnerability in Lamsfoundation Lams

There is unauthenticated reflected cross-site scripting (XSS) in LAMS before 3.1 that allows a remote attacker to introduce arbitrary JavaScript via manipulation of an unsanitized GET parameter during a forgotPasswordChange.jsp?key= password change.

4.3
2018-06-11 CVE-2018-10360 File Project
Canonical
Opensuse
Out-Of-Bounds Read vulnerability in multiple products

The do_core_note function in readelf.c in libmagic.a in file 5.33 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted ELF file.

4.3
2018-06-17 CVE-2018-12335 Ecos Incorrect Permission Assignment for Critical Resource vulnerability in Ecos System Management Appliance 5.2.68

Incorrect access control in ECOS System Management Appliance (aka SMA) 5.2.68 allows a user to compromise authentication keys, and access and manipulate security relevant configurations, via unrestricted database access during Easy Enrollment.

4.1
2018-06-16 CVE-2018-5756 Open Xchange Improper Privilege Management vulnerability in Open-Xchange Appsuite

The backend component in Open-Xchange OX App Suite before 7.6.3-rev36, 7.8.x before 7.8.2-rev39, 7.8.3 before 7.8.3-rev44, and 7.8.4 before 7.8.4-rev22 does not properly check for folder-to-object association, which allows remote authenticated users to delete arbitrary tasks via the task id in a delete action to api/tasks.

4.0
2018-06-16 CVE-2018-5753 Open Xchange Improper Input Validation vulnerability in Open-Xchange Appsuite

The frontend component in Open-Xchange OX App Suite before 7.6.3-rev31, 7.8.x before 7.8.2-rev31, 7.8.3 before 7.8.3-rev41, and 7.8.4 before 7.8.4-rev20 allows remote attackers to spoof the origin of e-mails via unicode characters in the "personal part" of a (1) From or (2) Sender address.

4.0
2018-06-16 CVE-2018-5751 Open Xchange Information Exposure vulnerability in Open-Xchange Appsuite

The backend component in Open-Xchange OX App Suite before 7.6.3-rev36, 7.8.x before 7.8.2-rev39, 7.8.3 before 7.8.3-rev44, and 7.8.4 before 7.8.4-rev22 allows remote authenticated users to obtain sensitive information about external guest users via vectors related to the "groups" and "users" APIs.

4.0
2018-06-16 CVE-2017-17062 Open Xchange Cross-Site Scripting vulnerability in Open-Xchange Appsuite

The backend component in Open-Xchange OX App Suite before 7.6.3-rev35, 7.8.x before 7.8.2-rev38, 7.8.3 before 7.8.3-rev41, and 7.8.4 before 7.8.4-rev19 allows remote authenticated users to save arbitrary user attributes by leveraging improper privilege management.

4.0
2018-06-15 CVE-2018-12494 Publiccms Path Traversal vulnerability in Publiccms 4.0.20180210

An issue was discovered in PublicCMS V4.0.20180210.

4.0
2018-06-15 CVE-2018-12493 Publiccms Path Traversal vulnerability in Publiccms 4.0.20180210

An issue was discovered in PublicCMS V4.0.20180210.

4.0
2018-06-15 CVE-2018-6672 Mcafee Information Exposure vulnerability in Mcafee Epolicy Orchestrator

Information disclosure vulnerability in McAfee ePolicy Orchestrator (ePO) 5.3.0 through 5.3.3 and 5.9.0 through 5.9.1 allows authenticated users to view sensitive information in plain text format via unspecified vectors.

4.0
2018-06-15 CVE-2018-6671 Mcafee Unspecified vulnerability in Mcafee Epolicy Orchestrator

Application Protection Bypass vulnerability in McAfee ePolicy Orchestrator (ePO) 5.3.0 through 5.3.3 and 5.9.0 through 5.9.1 allows remote authenticated users to bypass localhost only access security protection for some ePO features via a specially crafted HTTP request.

4.0
2018-06-14 CVE-2018-8927 Synology Incorrect Authorization vulnerability in Synology Calendar

Improper authorization vulnerability in SYNO.Cal.Event in Calendar before 2.1.2-0511 allows remote authenticated users to create arbitrary events via the (1) cal_id or (2) original_cal_id parameter.

4.0
2018-06-13 CVE-2017-17443 Opcfoundation Improper Input Validation vulnerability in Opcfoundation Local Discovery Server 1.03.370

OPC Foundation Local Discovery Server (LDS) 1.03.370 required a security update to resolve multiple vulnerabilities that allow attackers to trigger a crash by placing invalid data into the configuration file.

4.0
2018-06-13 CVE-2018-1393 IBM Information Exposure vulnerability in IBM Financial Transaction Manager 3.0.6.0

IBM Financial Transaction Manager for ACH Services for Multi-Platform 3.0.6 could allow an authenticated user to execute a specially crafted command that could obtain sensitive information.

4.0
2018-06-12 CVE-2018-10509 Trendmicro Unspecified vulnerability in Trendmicro Officescan 11.0/Xg

A vulnerability in Trend Micro OfficeScan 11.0 SP1 and XG could allow a attacker to exploit it via a Browser Refresh attack on vulnerable installations.

4.0

48 Low Vulnerabilities

DATE CVE VENDOR VULNERABILITY CVSS
2018-06-11 CVE-2017-7761 Mozilla
Microsoft
Incorrect Default Permissions vulnerability in Mozilla Firefox and Firefox ESR

The Mozilla Maintenance Service "helper.exe" application creates a temporary directory writable by non-privileged users.

3.6
2018-06-11 CVE-2017-5409 Mozilla
Microsoft
Improper Privilege Management vulnerability in Mozilla Firefox and Firefox ESR

The Mozilla Windows updater can be called by a non-privileged user to delete an arbitrary local file by passing a special path to the callback parameter through the Mozilla Maintenance Service, which has privileged access.

3.6
2018-06-16 CVE-2018-5754 Open Xchange Cross-Site Scripting vulnerability in Open-Xchange Appsuite

Cross-site scripting (XSS) vulnerability in the office-web component in Open-Xchange OX App Suite before 7.8.3-rev12 and 7.8.4 before 7.8.4-rev9 allows remote attackers to inject arbitrary web script or HTML via a crafted presentation file, related to copying content to the clipboard.

3.5
2018-06-16 CVE-2018-11223 Pandorafms Cross-Site Scripting vulnerability in Pandorafms Artica Pandora FMS

XSS in Artica Pandora FMS before 7.0 NG 723 allows an attacker to execute arbitrary code via a crafted "refr" parameter in a "/pandora_console/index.php?sec=estado&sec2=operation/agentes/estado_agente&refr=" call.

3.5
2018-06-15 CVE-2018-12030 Chevereto Cross-Site Scripting vulnerability in Chevereto

Chevereto Free before 1.0.13 has XSS.

3.5
2018-06-15 CVE-2018-1419 IBM Unspecified vulnerability in IBM Websphere MQ

IBM WebSphere MQ 8.0 and 9.0, when configured to use a PAM module for authentication, could allow a user to cause a deadlock in the IBM MQ PAM code which could result in a denial of service.

3.5
2018-06-14 CVE-2018-12431 Seacms Cross-Site Scripting vulnerability in Seacms 6.61

SeaCMS V6.61 has XSS via the site name parameter on an adm1n/admin_config.php page (aka a system management page).

3.5
2018-06-14 CVE-2018-4842 Siemens Cross-Site Scripting vulnerability in Siemens products

A vulnerability has been identified in SCALANCE X-200IRT switch family (incl.

3.5
2018-06-14 CVE-2018-10821 Blackcat CMS Cross-Site Scripting vulnerability in Blackcat-Cms Blackcat CMS 1.3

Cross-site scripting (XSS) vulnerability in backend/pages/modify.php in BlackCatCMS 1.3 allows remote authenticated users with the Admin role to inject arbitrary web script or HTML via the search panel.

3.5
2018-06-14 CVE-2018-8254 Microsoft Cross-Site Scripting vulnerability in Microsoft products

An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka "Microsoft SharePoint Elevation of Privilege Vulnerability." This affects Microsoft Project Server, Microsoft SharePoint.

3.5
2018-06-14 CVE-2018-8252 Microsoft Cross-Site Scripting vulnerability in Microsoft Sharepoint Foundation and Sharepoint Server

An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka "Microsoft SharePoint Elevation of Privilege Vulnerability." This affects Microsoft SharePoint.

3.5
2018-06-13 CVE-2018-12339 Articlecms Project Cross-Site Scripting vulnerability in Articlecms Project Articlecms 20170219

ArticleCMS through 2017-02-19 has XSS via an "add an article" action.

3.5
2018-06-13 CVE-2018-7559 Opcfoundation KEY Management Errors vulnerability in Opcfoundation Ua-.Net-Legacy and Ua-.Netstandard

An issue was discovered in OPC UA .NET Standard Stack and Sample Code before GitHub commit 2018-04-12, and OPC UA .NET Legacy Stack and Sample Code before GitHub commit 2018-03-13.

3.5
2018-06-13 CVE-2018-5432 Tibco Cross-Site Scripting vulnerability in Tibco Administrator

The TIBCO Administrator server component of of TIBCO Software Inc.'s TIBCO Administrator - Enterprise Edition, and TIBCO Administrator - Enterprise Edition for z/Linux contains multiple vulnerabilities wherein a malicious user could theoretically perform cross-site scripting (XSS) attacks by way of manipulating artifacts prior to uploading them.

3.5
2018-06-11 CVE-2018-12100 Sonatype Cross-Site Scripting vulnerability in Sonatype Nexus Repository Manager

Sonatype Nexus Repository Manager versions 3.x before 3.12.0 has XSS in multiple areas in the Administration UI.

3.5
2018-06-11 CVE-2018-12095 Oecms Project Cross-Site Scripting vulnerability in Oecms Project Oecms 3.1

A Reflected Cross-Site Scripting web vulnerability has been discovered in the OEcms v3.1 web-application.

3.5
2018-06-11 CVE-2018-12094 Dimofinf Cross-Site Scripting vulnerability in Dimofinf CMS 3.0.0

Cross-site scripting (XSS) vulnerability in news.php in Dimofinf CMS Version 3.0.0 allows remote attackers to inject arbitrary web script or HTML via the id parameter.

3.5
2018-06-11 CVE-2018-12089 Octopus Information Exposure vulnerability in Octopus Deploy

In Octopus Deploy version 2018.5.1 to 2018.5.7, a user with Task View is able to view a password for a Service Fabric Cluster, when the Service Fabric Cluster target is configured in Azure Active Directory security mode and a deployment is executed with OctopusPrintVariables set to True.

3.5
2018-06-11 CVE-2017-7796 Mozilla
Microsoft
Improper Input Validation vulnerability in Mozilla Firefox

On Windows systems, the logger run by the Windows updater deletes the file "update.log" before it runs in order to write a new log of that name.

3.3
2018-06-17 CVE-2018-12073 Eminent Online Cross-Site Scripting vulnerability in Eminent-Online Em4544 9.10

An issue was discovered on Eminent EM4544 9.10 devices.

2.9
2018-06-14 CVE-2018-8209 Microsoft Information Exposure vulnerability in Microsoft Windows 10 and Windows Server 2016

An information disclosure vulnerability exists when Windows allows a normal user to access the Wireless LAN profile of an administrative user, aka "Windows Wireless Network Profile Information Disclosure Vulnerability." This affects Windows Server 2016, Windows 10, Windows 10 Servers.

2.7
2018-06-17 CVE-2018-12337 Ecos Information Exposure vulnerability in Ecos Secure Boot Stick Firmware 5.6.5

Reliance on Security Through Obscurity vulnerability in ECOS Secure Boot Stick (aka SBS) 5.6.5 allows an attacker to partially extract confidential configurations via user-space emulation.

2.1
2018-06-12 CVE-2018-3579 Google Out-Of-Bounds Read vulnerability in Google Android

In the WLAN driver in all Android releases from CAF (Android for MSM, Firefox OS for MSM, QRD Android) using the Linux Kernel, event->num_entries_in_page is a value received from firmware that is not properly validated which can lead to a buffer over-read

2.1
2018-06-12 CVE-2018-12261 Apollotechnologiesinc Improper Privilege Management vulnerability in Apollotechnologiesinc Momentum Axel 720P Firmware 5.1.8

An issue was discovered on Momentum Axel 720P 5.1.8 devices.

2.1
2018-06-12 CVE-2018-12260 Apollotechnologiesinc Insufficiently Protected Credentials vulnerability in Apollotechnologiesinc Momentum Axel 720P Firmware 5.1.8

An issue was discovered on Momentum Axel 720P 5.1.8 devices.

2.1
2018-06-12 CVE-2018-12257 Apollotechnologiesinc Improper Certificate Validation vulnerability in Apollotechnologiesinc Momentum Axel 720P Firmware 5.1.8

An issue was discovered on Momentum Axel 720P 5.1.8 devices.

2.1
2018-06-12 CVE-2018-10507 Trendmicro Unspecified vulnerability in Trendmicro Officescan 11.0/Xg

A vulnerability in Trend Micro OfficeScan 11.0 SP1 and XG could allow a attacker to take a series of steps to bypass or render the OfficeScan Unauthorized Change Prevention inoperable on vulnerable installations.

2.1
2018-06-12 CVE-2018-2425 SAP Unspecified vulnerability in SAP Business ONE 9.2/9.3

Under certain conditions, SAP Business One, 9.2, 9.3, for SAP HANA backup service allows an attacker to access information which would otherwise be restricted.

2.1
2018-06-12 CVE-2018-1075 Ovirt Information Exposure Through LOG Files vulnerability in Ovirt

ovirt-engine up to version 4.2.3 is vulnerable to an unfiltered password when choosing manual db provisioning.

2.1
2018-06-11 CVE-2017-7768 Mozilla
Microsoft
Information Exposure vulnerability in Mozilla Firefox and Firefox ESR

The Mozilla Maintenance Service can be invoked by an unprivileged user to read 32 bytes of any arbitrary file on the local system by convincing the service that it is reading a status file provided by the Mozilla Windows Updater.

2.1
2018-06-11 CVE-2017-7767 Mozilla
Microsoft
Improper Privilege Management vulnerability in Mozilla Firefox and Firefox ESR

The Mozilla Maintenance Service can be invoked by an unprivileged user to overwrite arbitrary files with junk data using the Mozilla Windows Updater, which runs with the Maintenance Service's privileged access.

2.1
2018-06-11 CVE-2017-5387 Mozilla File and Directory Information Exposure vulnerability in Mozilla Firefox

The existence of a specifically requested local file can be found due to the double firing of the "onerror" when the "source" attribute on a "<track>" tag refers to a file that does not exist if the source page is loaded locally.

2.1
2018-06-11 CVE-2016-9062 Mozilla
Google
Information Exposure vulnerability in Mozilla Firefox

Private browsing mode leaves metadata information, such as URLs, for sites visited in "browser.db" and "browser.db-wal" files within the Firefox profile after the mode is exited.

2.1
2018-06-11 CVE-2016-5294 Mozilla
Microsoft
Improper Input Validation vulnerability in Mozilla Firefox, Firefox ESR and Thunderbird

The Mozilla Updater can be made to choose an arbitrary target working directory for output files resulting from the update process.

2.1
2018-06-11 CVE-2016-5293 Mozilla
Microsoft
Debian
Improper Input Validation vulnerability in multiple products

When the Mozilla Updater is run, if the Updater's log file in the working directory points to a hardlink, data can be appended to an arbitrary local file.

2.1
2018-06-17 CVE-2018-12332 Ecos Incomplete Cleanup vulnerability in Ecos Secure Boot Stick Firmware 5.6.5

Incomplete Cleanup vulnerability in ECOS Secure Boot Stick (aka SBS) 5.6.5 allows an attacker to compromise authentication and encryption keys via a compromised host PC after a reset.

1.9
2018-06-15 CVE-2018-12440 Google Information Exposure vulnerability in Google Boringssl

BoringSSL through 2018-06-14 allows a memory-cache side-channel attack on DSA signatures, aka the Return Of the Hidden Number Problem or ROHNP.

1.9
2018-06-15 CVE-2018-12439 Matrixssl Information Exposure vulnerability in Matrixssl

MatrixSSL through 3.9.5 Open allows a memory-cache side-channel attack on ECDSA signatures, aka the Return Of the Hidden Number Problem or ROHNP.

1.9
2018-06-15 CVE-2018-12438 Botan Project
Cryptlib
Gnupg
Google
Libsunec Project
Libtom
Matrixssl
Mozilla
Openbsd
Openssl
Wolfssl
Information Exposure vulnerability in multiple products

The Elliptic Curve Cryptography library (aka sunec or libsunec) allows a memory-cache side-channel attack on ECDSA signatures, aka the Return Of the Hidden Number Problem or ROHNP.

1.9
2018-06-15 CVE-2018-12437 Botan Project
Cryptlib
Gnupg
Google
Libsunec Project
Libtom
Matrixssl
Mozilla
Openbsd
Openssl
Wolfssl
Information Exposure vulnerability in multiple products

LibTomCrypt through 1.18.1 allows a memory-cache side-channel attack on ECDSA signatures, aka the Return Of the Hidden Number Problem or ROHNP.

1.9
2018-06-15 CVE-2018-12436 Wolfssl Information Exposure vulnerability in Wolfssl

wolfcrypt/src/ecc.c in wolfSSL before 3.15.1.patch allows a memory-cache side-channel attack on ECDSA signatures, aka the Return Of the Hidden Number Problem or ROHNP.

1.9
2018-06-15 CVE-2018-12435 Botan Project Information Exposure vulnerability in Botan Project Botan 2.5.0/2.6.0/2.7.0

Botan 2.5.0 through 2.6.0 before 2.7.0 allows a memory-cache side-channel attack on ECDSA signatures, aka the Return Of the Hidden Number Problem or ROHNP, related to dsa/dsa.cpp, ec_group/ec_group.cpp, and ecdsa/ecdsa.cpp.

1.9
2018-06-15 CVE-2018-12434 Openbsd Information Exposure vulnerability in Openbsd Libressl

LibreSSL before 2.6.5 and 2.7.x before 2.7.4 allows a memory-cache side-channel attack on DSA and ECDSA signatures, aka the Return Of the Hidden Number Problem or ROHNP.

1.9
2018-06-15 CVE-2018-12433 Botan Project
Cryptlib
Gnupg
Google
Libsunec Project
Libtom
Matrixssl
Mozilla
Openbsd
Openssl
Wolfssl
Information Exposure vulnerability in multiple products

** DISPUTED ** cryptlib through 3.4.4 allows a memory-cache side-channel attack on DSA and ECDSA signatures, aka the Return Of the Hidden Number Problem or ROHNP.

1.9
2018-06-14 CVE-2018-8207 Microsoft Information Exposure vulnerability in Microsoft products

An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka "Windows Kernel Information Disclosure Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers.

1.9
2018-06-14 CVE-2018-8121 Microsoft Improper Initialization vulnerability in Microsoft Windows 10 and Windows Server 2016

An information disclosure vulnerability exists when the Windows kernel improperly initializes objects in memory, aka "Windows Kernel Information Disclosure Vulnerability." This affects Windows 10 Servers, Windows 10.

1.9
2018-06-13 CVE-2018-0495 Gnupg
Canonical
Debian
Redhat
Oracle
Information Exposure Through Discrepancy vulnerability in multiple products

Libgcrypt before 1.7.10 and 1.8.x before 1.8.3 allows a memory-cache side-channel attack on ECDSA signatures that can be mitigated through the use of blinding during the signing process in the _gcry_ecc_ecdsa_sign function in cipher/ecc-ecdsa.c, aka the Return Of the Hidden Number Problem or ROHNP.

1.9
2018-06-11 CVE-2017-5427 Mozilla Race Condition vulnerability in Mozilla Firefox

A non-existent chrome.manifest file will attempt to be loaded during startup from the primary installation directory.

1.9