Archive
2 June 2023
Vulnerabilities first published on this day (UTC), newest first.
143 results · Feed
-
High 8.8
When encoding data from an <code>inputStream</code> in <code>xpcom</code> the size of the input being encoded was not c…
-
Unscored —
Sometimes, when invalidating JIT code while following an iterator, the newly generated code could be overwritten incorr…
-
High 8.8
Module load requests that failed were not being checked as to whether or not they were cancelled causing a use-after-fr…
-
Medium 5.4
A background script invoking <code>requestFullscreen</code> and then blocking the main thread could force the browser i…
-
High 8.8
Memory safety bugs present in Firefox 109. Some of these bugs showed evidence of memory corruption and we presume that …
-
High 8.8
Cross-compartment wrappers wrapping a scripted proxy could have caused objects from other compartments to be stored in …
-
Unscored —
When accessing throttled streams, the count of available bytes needed to be checked in the calling function to be withi…
-
Medium 6.5
When dragging and dropping an image cross-origin, the image's size could potentially be leaked. This behavior was shipp…
-
Medium 6.5
Members of the <code>DEVMODEW</code> struct set by the printer device driver weren't being validated and could have res…
-
High 8.8
Memory safety bugs present in Firefox ESR 102.7. Some of these bugs showed evidence of memory corruption and we presume…
-
Medium 4.3
By displaying a prompt with a long description, the fullscreen notification could have been hidden, resulting in potent…
-
High 8.8
Due to URL previews in the network panel of developer tools improperly storing URLs, query parameters could potentially…
-
Medium 4.3
Under certain circumstances, a ServiceWorker's offline cache may have leaked to the file system when using private brow…
-
High 8.8
After downloading a Windows <code>.scf</code> script from the local filesystem, an attacker could supply a remote path …
-
Unscored —
A lack of in app notification for entering fullscreen mode could have lead to a malicious website spoofing browser chro…
-
High 8.1
After downloading a Windows <code>.url</code> shortcut from the local filesystem, an attacker could supply a remote pat…
-
Medium 6.5
The <code>Content-Security-Policy-Report-Only</code> header could allow an attacker to leak a child iframe's unredacted…
-
Medium 4.3
Bluetooth Classic in Bluetooth Core Specification through 5.3 does not properly conceal device information for Bluetoot…
-
High 8.8
SGUDA U-Lock - Broken Access Control
SGUDA U-Lock central lock control service’s user management function has incorrect authorization. A remote attacker with general user privilege can exploit this vulnerability to call privileged APIs to access, modify and delete user information.
-
High 8.8
SGUDA U-Lock - Broken Access Control
SGUDA U-Lock central lock control service’s lock management function has incorrect authorization. A remote attacker with general privilege can exploit this vulnerability to call privileged APIs to acquire information, manipulate or disrupt the functionality o…
-
High 8.0CVE-2022-45938 EPSS 45%
An issue was discovered in Comcast Defined Technologies microeisbss through 2021. An attacker can inject a stored XSS p…
-
High 7.2
Hitron Technologies Inc. CODA-5310 - Hard-coded Cryptographic Key
Hitron CODA-5310 has hard-coded encryption/decryption keys in the program code. A remote attacker authenticated as an administrator can decrypt system files using the hard-coded keys for file access, modification, and cause service disruption.
-
High 7.2
Hitron Technologies Inc. CODA-5310 - Remote Command Execution
Hitron CODA-5310 has insufficient filtering for specific parameters in the connection test function. A remote attacker authenticated as an administrator, can use the management page to perform command injection attacks, to execute arbitrary system command, ma…