Archive
January 2019
Vulnerabilities first published in this month (UTC), newest first.
1,214 results · Feed
-
Unscored —
Incorrect handling of asynchronous methods in Fullscreen in Google Chrome on macOS prior to 66.0.3359.117 allowed a rem…
-
Unscored —
Incorrect enforcement of CSP for <object> tags in Blink in Google Chrome prior to 66.0.3359.117 allowed a remote attack…
-
Unscored —
Lack of secure text entry mode in Browser UI in Google Chrome on Mac prior to 67.0.3396.62 allowed a local attacker to …
-
Unscored —
Insufficient enforcement of file access permission in the activeTab case in Extensions in Google Chrome prior to 68.0.3…
-
Unscored —
Lack of timeout on extension install prompt in Extensions in Google Chrome prior to 68.0.3440.75 allowed a remote attac…
-
Unscored —
An object lifetime issue in the developer tools network handler in Google Chrome prior to 66.0.3359.117 allowed a local…
-
Unscored —
A use after free in Blink in Google Chrome prior to 67.0.3396.62 allowed a remote attacker to potentially exploit heap …
-
Unscored —
Allowing the chrome.debugger API to attach to Web UI pages in DevTools in Google Chrome prior to 67.0.3396.62 allowed a…
-
Unscored —
Insufficiently strict origin checks during JIT payment app installation in Payments in Google Chrome prior to 70.0.3538…
-
Unscored —
Incorrect handling of 304 status codes in Navigation in Google Chrome prior to 71.0.3578.80 allowed a remote attacker t…
-
Unscored —
A renderer initiated back navigation was incorrectly allowed to cancel a browser initiated one in Navigation in Google …
-
Unscored —
Incorrect object lifecycle in Extensions in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to potentiall…
-
Unscored —
Handling of URI action in PDFium in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to initiate potential…
-
Unscored —
Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 71.0.3578.80 allowed a remote at…
-
Unscored —
Failure to prevent navigation to top frame to data URLs in Navigation in Google Chrome on iOS prior to 71.0.3578.80 all…
-
Unscored —
A missing check for whether a property of a JS object is private in V8 in Google Chrome prior to 55.0.2883.75 allowed a…
-
Unscored —
Insufficient data validation on image data in PDFium in Google Chrome prior to 51.0.2704.63 allowed a remote attacker t…
-
Unscored —
Inappropriate symlink handling and a race condition in the stateful recovery feature implementation could lead to a per…
-
Unscored —
Insufficient data validation in V8 builtins string generator could lead to out of bounds read and write access in V8 in…
-
Unscored —
Using an ID that can be controlled by a compromised renderer which allows any frame to overwrite the page_state of any …
-
Unscored —
Insufficient data validation in crosh could lead to a command injection under chronos privileges in Networking in Googl…
-
Unscored —
An ability to process crash dumps under root privileges and inappropriate symlinks handling could lead to a local privi…
-
Unscored —
A memory corruption bug in WebAssembly could lead to out of bounds read and write through V8 in WebAssembly in Google C…
-
Unscored —
Frog CMS 0.9.5 has XSS in the admin/?/page/edit/1 body field.
-
Unscored —
In Traccar Server version 4.2, protocol/SpotProtocolDecoder.java might allow XXE attacks.
-
High 7.5
An issue was discovered in BusyBox before 1.30.0. An out of bounds read in udhcp components (consumed by the DHCP serve…
-
High 7.5
An issue was discovered in BusyBox through 1.30.0. An out of bounds read in udhcp components (consumed by the DHCP clie…
-
High 8.8
xterm vulnerable to remote code execution
A remote code execution vulnerability exists in Xterm.js when the component mishandles special characters, aka "Xterm Remote Code Execution Vulnerability." This affects xterm.js.
-
High 7.5
McAfee Web Gateway denial of service attack due to Improper Input Validation
Improper input validation in the proxy component of McAfee Web Gateway 7.8.2.0 and later allows remote attackers to cause a denial of service via a crafted HTTP request parameter.
-
Medium 6.1
XSS vulnerability that affects bootstrap
In Bootstrap before 3.4.0, XSS is possible in the tooltip data-viewport attribute.
-
Medium 6.1
bootstrap Cross-site Scripting vulnerability
In Bootstrap before 3.4.0, XSS is possible in the affix configuration target property.
-
Medium 6.1CVE-2016-10735 Public exploit
Bootstrap Cross-site Scripting vulnerability
In Bootstrap 3.x before 3.4.0 and 4.x-beta before 4.0.0-beta.2, XSS is possible in the data-target attribute, a different vulnerability than CVE-2018-14041.
-
Unscored —
D-Link DIR-822 C1 before v3.11B01Beta, DIR-822-US C1 before v3.11B01Beta, DIR-850L A* before v1.21B08Beta, DIR-850L B* …
-
Unscored —
D-Link DIR-822 C1 before v3.11B01Beta, DIR-822-US C1 before v3.11B01Beta, DIR-850L A* before v1.21B08Beta, DIR-850L B* …
-
Unscored —
In Wireshark 2.6.0 to 2.6.5, the 6LoWPAN dissector could crash. This was addressed in epan/dissectors/packet-6lowpan.c …
-
Unscored —
qibosoft through V7 allows remote attackers to read arbitrary files via the member/index.php main parameter, as demonst…
-
Unscored —
In Wireshark 2.6.0 to 2.6.5 and 2.4.0 to 2.4.11, the P_MUL dissector could crash. This was addressed in epan/dissectors…
-
Unscored —
In Wireshark 2.4.0 to 2.4.11, the ENIP dissector could crash. This was addressed in epan/dissectors/packet-enip.c by ch…
-
Unscored —
In Wireshark 2.6.0 to 2.6.5 and 2.4.0 to 2.4.11, the RTSE dissector and other ASN.1 dissectors could crash. This was ad…
-
Unscored —
In Wireshark 2.6.0 to 2.6.5 and 2.4.0 to 2.4.11, the ISAKMP dissector could crash. This was addressed in epan/dissector…