CVEs published in June 2018
1,550 vulnerabilities, 195 critical, 3 exploited.
- vmware sd-wan edge, nsx sd-wan by velocloud +1 moreVMware NSX SD-WAN Edge by VeloCloud prior to version 3.1.0 contains a command injection...8.1 High
- mozilla firefoxIn 32-bit versions of Firefox, the Adobe Flash plugin setting for "Enable Adobe Flash protected...5.3 Medium
- mozilla firefoxA spoofing vulnerability can occur when a malicious site with an extremely long domain name is...5.3 Medium
- mozilla firefoxLow descenders on some Tibetan characters in several fonts on OS X are clipped when rendered in...5.3 Medium
- mozilla firefoxIf cursor visibility is toggled by script using from 'none' to an image and back through script,...5.3 Medium
- mozilla firefoxA combination of an external SVG image referenced on a page and the coloring of anchor links...6.5 Medium
- mozilla firefoxThe "pingsender" executable used by the Firefox Health Report dynamically loads a system copy of...7.8 High
- mozilla firefoxA spoofing vulnerability can occur when a page switches to fullscreen mode without user...5.3 Medium
- mozilla firefoxOn Windows systems, the logger run by the Windows updater deletes the file "update.log" before it...4.7 Medium
- mozilla firefoxOn Windows systems, if non-null-terminated strings are copied into the crash reporter for some...7.5 High
- mozilla firefoxA mechanism where when a new tab is loaded through JavaScript events, if fullscreen mode is then...5.9 Medium
- google android, mozilla firefox +1 moreAndroid intent URLs given to Firefox for Android can be used to navigate from HTTP or HTTPS URLs...7.5 High
- mozilla firefoxAndroid intents can be used to launch Firefox for Android in reader mode with a user specified...5.3 Medium
- mozilla firefoxMalicious sites can display a spoofed addressbar on a page when the existing location bar on the...4.3 Medium
- mozilla firefoxA mechanism to spoof the Firefox for Android addressbar using a "javascript:" URI. On Firefox for...7.5 High
- mozilla firefoxThe cache directory on the local file system is set to be world writable. Firefox defaults to...9.8 Critical
- mozilla firefoxMalicious sites can display a spoofed location bar on a subsequently loaded page when the...4.3 Medium
- mozilla firefoxA location bar spoofing attack where the location bar of loaded page will be shown over the...8.8 High
- mozilla firefoxWeak proxy objects have weak references on multiple threads when they should only have them on...9.8 Critical
- mozilla firefoxWhen a new Firefox profile is created on 64-bit Windows installations, the sandbox for 64-bit...7.5 High
- mozilla firefoxThe location bar in Firefox for Android can be spoofed by forcing a user into fullscreen mode,...7.5 High
- mozilla firefoxPrivate browsing mode leaves metadata information, such as URLs, for sites visited in "browser.db...3.3 Low
- mozilla firefoxA previously installed malicious Android application which defines a specific signature-level...7.5 High
- mozilla firefoxA previously installed malicious Android application with same signature-level permissions as...7.5 High
- mozilla firefoxA mechanism where disruption of the loading of a new web page can cause the previous page's...6.5 Medium
- mozilla firefoxThis vulnerability allows an attacker to use the Mozilla Maintenance Service to escalate...7.8 High
- mozilla firefox, firefox esr, debian linux +2 moreWhen the Mozilla Updater is run, if the Updater's log file in the working directory points to a...5.5 Medium
- puppet, puppet agent, puppetpu puppet agent +2 morePuppet Agent 1.10.x prior to 1.10.13, Puppet Agent 5.3.x prior to 5.3.7, and Puppet Agent 5.5.x...7.8 High
- puppet, puppet agent, puppetpu puppet agent +2 moreIn Puppet Agent 1.10.x prior to 1.10.13, Puppet Agent 5.3.x prior to 5.3.7, Puppet Agent 5.5.x...7.8 High
- puppet, puppet enterprise, enterprise and puppet agent +2 morePuppet Enterprise 2016.4.x prior to 2016.4.12, Puppet Enterprise 2017.3.x prior to 2017.3.7,...8.8 High
- puppet pe-razor-server, enterprise, razor-server +1 more +3 moreThe previous version of Puppet Enterprise 2018.1 is vulnerable to unsafe code execution when...9.8 Critical
- themidnightcoders weborb for javaThe Java implementation of AMF3 deserializers used by WebORB for Java by Midnight Coders, version...9.8 Critical
- midnight coders weborb for javaWebORB for Java by Midnight Coders, version 5.1.1.0, Action Message Format (AMF3) Java implementation is vulnerable to insecure deserialization9.8 Critical
- exadel flamingo, flamingo amf-serializer +1 moreThe Action Message Format (AMF3) deserializers used by Flamingo amf-serializer by Exadel, version 2.2.0, allows external entity references (XXEs) from XML documents embedded within AMF3 messages9.8 Critical
- pivotal spring-flexPivotal/Spring Spring-flex's Action Message Format (AMF3) Java implementation is vulnerable to insecure deserialization8.1 High
- exadel flamingo, flamingo amf-serializer +1 moreThe implementation of Action Message Format (AMF3) deserializers in Flamingo amf-serializer by Exadel, version 2.2.0, may allow instantiation of arbitrary classes due to improper code control9.8 Critical
- exadel flamingo amf-serializerFlamingo amf-serializer by Exadel, version 2.2.0, Action Message Format (AMF3) Java implementation is vulnerable to insecure deserialization8.1 High
- graniteds, flarum framework +1 moreThe implementation of Action Message Format (AMF3) deserializers in GraniteDS, version 3.1.1.GA, may allow instantiation of arbitrary classes due to improper code control8.1 High
- graniteds, flarum framework +1 moreGraniteDS, version 3.1.1.GA, Action Message Format (AMF3) Java implementation is vulnerable to insecure deserialization8.1 High
- opensuse open build serviceopen build service information leak via unauthorized source access4.3 Medium
- md4c project md4cmd_build_attribute in md4c.c in md4c 0.2.6 allows remote attackers to cause a denial of service ...7.8 High
- canon efi printmeCross-site scripting (XSS) vulnerability in the Canon PrintMe EFI webinterface allows remote...6.1 Medium
- portfoliocms project portfoliocmsportfolioCMS 1.0.5 has SQL Injection via the admin/portfolio.php preview parameter.7.2 High
- flifAn issue was discovered in Free Lossless Image Format (FLIF) 0.3. The TransformPaletteC<FileIO>:...7.8 High
- dropbox leptonAn issue was discovered in Dropbox Lepton 1.2.1. The validateAndCompress function in validation...5.5 Medium
- md4c project md4cmd4c 0.2.6 has a NULL pointer dereference in the function md_process_line in md4c.c, related to...5.5 Medium
- sonatype nexus repository managerSonatype Nexus Repository Manager versions 3.x before 3.12.0 has XSS in multiple areas in the...4.8 Medium
- grafana, netapp active iq performance analytics services, storagegrid webscale nas bridge +2 moreGrafana Cross-site Scripting (XSS)6.1 Medium
- oecms project oecmsA Reflected Cross-Site Scripting web vulnerability has been discovered in the OEcms v3.1 web...5.4 Medium
- dimofinf cmsCross-site scripting (XSS) vulnerability in news.php in Dimofinf CMS Version 3.0.0 allows remote...5.4 Medium
- Show moreLoading…