Archive
19 June 2023
Vulnerabilities first published on this day (UTC), newest first.
116 results · Feed
-
Critical 9.8
An invalid downcast from `nsHTMLDocument` to `nsIContent` could have lead to undefined behavior. This vulnerability aff…
-
High 7.5
The return value from `gfx::SourceSurfaceSkia::Map()` wasn't being verified which could have potentially lead to a null…
-
Unscored —
Memory safety bugs present in Firefox 113, Firefox ESR 102.11, and Thunderbird 102.12. Some of these bugs showed eviden…
-
Unscored —
The error page for sites with invalid TLS certificates was missing the activation-delay Firefox uses to protect prompts…
-
Medium 6.5
When recording the screen while in Private Browsing on Firefox for Android the address bar and keyboard were not hidden…
-
Critical 9.1
Different techniques existed to obscure the fullscreen notification in Firefox and Focus for Android. These could have …
-
High 7.5
A potential use-after-free in libaudio was fixed by disabling the AAudio backend when running on Android API below vers…
-
Medium 6.5
Similar to CVE-2023-28163, this time when choosing 'Save Link As', suggested filenames containing environment variable …
-
Critical 9.8
A newline in a filename could have been used to bypass the file extension security mechanisms that replace malicious fi…
-
Medium 5.5
A local attacker can trick the Mozilla Maintenance Service into applying an unsigned update file by pointing the servic…
-
Critical 9.8
An attacker could have caused an out of bounds memory access using WebGL APIs, leading to memory corruption and a poten…
-
Unscored —
Mozilla developers and community members Ronald Crane, Andrew McCreight, Randell Jesup and the Mozilla Fuzzing Team rep…
-
Unscored —
Protocol handlers `ms-cxh` and `ms-cxh-full` could have been leveraged to trigger a denial of service. *Note: This atta…
-
Unscored —
Documents were incorrectly assuming an ordering of principal objects when ensuring we were loading an appropriately pri…
-
Unscored —
A maliciously crafted favicon could have led to an out of memory crash. This vulnerability affects Firefox < 113.
-
Unscored —
Service workers could reveal script base URL due to dynamic `import()`. This vulnerability affects Firefox < 113.
-
Medium 6.5
Apache Airflow: Information disclosure on configuration view
In Apache Airflow, some potentially sensitive values were being shown to the user in certain situations. This vulnerability is mitigated by the fact configuration is not shown in the UI by default (only if `[webserver] expose_config` is set to `non-sensitive-…
-
High 7.8
KioWare for Windows through v8.33 was discovered to contain an incomplete blacklist filter for blocked dialog boxes on …
-
Medium 5.3
Vulnerability of spoofing trustlists of Huawei desktop.Successful exploitation of this vulnerability can cause third-pa…
-
High 7.8
KioWare for Windows through v8.33 was discovered to contain an incomplete blacklist filter for blocked dialog boxes on …
-
Unscored —
Vulnerability of unauthorized calling on HUAWEI phones and tablets.Successful exploitation of this vulnerability may af…
-
High 7.5
nappropriate authorization vulnerability in the SettingsProvider module.Successful exploitation of this vulnerability m…
-
High 7.5
JeecgBoot vulnerable to SQL injection in queryTableDictItemsByCode
JeecgBoot up to v 3.5.1 was discovered to contain a SQL injection vulnerability via the component queryTableDictItemsByCode at org.jeecg.modules.api.controller.SystemApiController.
-
Medium 5.3
Vulnerability of spoofing trustlists of Huawei desktop.Successful exploitation of this vulnerability can cause third-pa…
-
Medium 4.8
A stored cross-site scripting (XSS) vulnerability in Eyoucms v1.6.2 allows attackers to execute arbitrary web scripts o…
-
Critical 9.8
Improper permission control vulnerability in the Notepad app.Successful exploitation of the vulnerability may lead to p…
-
High 7.5
JeecgBoot vulnerable to SQL injection in queryFilterTableDictInfo
JeecgBoot up to v 3.5.1 was discovered to contain a SQL injection vulnerability via the component queryFilterTableDictInfo at org.jeecg.modules.api.controller.SystemApiController.
-
Unscored —
Vulnerability of services denied by early fingerprint APIs on HarmonyOS products.Successful exploitation of this vulner…
-
High 7.5
Permission control vulnerability in the window management module.Successful exploitation of this vulnerability may caus…
-
High 7.5
Vulnerability of system restart triggered by abnormal callbacks passed to APIs.Successful exploitation of this vulnerab…
-
Medium 5.3
Vulnerability of spoofing trustlists of Huawei desktop.Successful exploitation of this vulnerability can cause third-pa…
-
High 7.5
Version update determination vulnerability in the user profile module.Successful exploitation of this vulnerability may…
-
High 7.5
packages/backend/src/routers in Lightdash before 0.510.3 has insecure file endpoints, e.g., they allow .. directory tra…
-
High 7.5
NocoDB through 0.106.0 (or 0.109.1) has a path traversal vulnerability that allows an unauthenticated attacker to acces…
-
Unscored —
In Suricata before 6.0.13 (when there is an adversary who controls an external source of rules), a dataset filename, th…
-
Critical 9.8
Solon vulnerable to deserialization of untrusted data
A bypass in the component sofa-hessian of Solon before v2.3.3 allows attackers to execute arbitrary code via providing crafted payload.
-
Unscored —
libcoap 4.3.1 contains a buffer over-read via the function coap_parse_oscore_conf_mem at coap_oscore.c.
-
High 7.5
VirtualSquare picoTCP (aka PicoTCP-NG) through 2.1 does not check the transport layer length in a frame before performi…
-
Medium 6.5CVE-2023-35840 Public exploit
elFinder vulnerable to path traversal in LocalVolumeDriver connector
_joinPath in elFinderVolumeLocalFileSystem.class.php in elFinder before 2.1.62 allows path traversal in the PHP LocalVolumeDriver connector.
-
Unscored —
In KeePassXC through 2.7.5, a local attacker can make changes to the Database security settings, including master passw…