Total
7971 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2018-12336 | 1 Ecos | 2 Secure Boot Stick, Secure Boot Stick Firmware | 2018-08-10 | 10.0 HIGH | 9.8 CRITICAL |
| Undocumented Factory Backdoor in ECOS Secure Boot Stick (aka SBS) 5.6.5 allows the vendor to extract confidential information via remote root SSH access. | |||||
| CVE-2018-5137 | 2 Canonical, Mozilla | 2 Ubuntu Linux, Firefox | 2018-08-10 | 5.0 MEDIUM | 7.5 HIGH |
| A legacy extension's non-contentaccessible, defined resources can be loaded by an arbitrary web page through script. This script does this by using a maliciously crafted path string to reference the resources. Note: this vulnerability does not affect WebExtensions. This vulnerability affects Firefox < 59. | |||||
| CVE-2018-12684 | 1 Civetweb Project | 1 Civetweb | 2018-08-10 | 5.8 MEDIUM | 7.1 HIGH |
| Out-of-bounds Read in the send_ssi_file function in civetweb.c in CivetWeb through 1.10 allows attackers to cause a Denial of Service or Information Disclosure via a crafted SSI file. | |||||
| CVE-2018-12632 | 1 Redatam | 1 Redatam | 2018-08-10 | 5.0 MEDIUM | 5.3 MEDIUM |
| Redatam7 (formerly Redatam WebServer) allows remote attackers to discover the installation path via an invalid LFN parameter to the /redbin/rpwebutilities.exe/text URI. | |||||
| CVE-2018-12329 | 1 Ecos | 2 Secure Boot Stick, Secure Boot Stick Firmware | 2018-08-09 | 4.3 MEDIUM | 5.9 MEDIUM |
| Protection Mechanism Failure in ECOS Secure Boot Stick (aka SBS) 5.6.5 allows a local attacker to duplicate an authentication factor via cloning. | |||||
| CVE-2017-5425 | 2 Apple, Mozilla | 3 Mac Os X, Firefox, Thunderbird | 2018-08-09 | 5.0 MEDIUM | 7.5 HIGH |
| The Gecko Media Plugin sandbox allows access to local files that match specific regular expressions. On OS OX, this matching allows access to some data in subdirectories of "/private/var" that could expose personal or temporary data. This has been updated to not allow access to "/private/var" and its subdirectories. Note: this issue only affects OS X. Other operating systems are not affected. This vulnerability affects Firefox < 52 and Thunderbird < 52. | |||||
| CVE-2017-5454 | 2 Mozilla, Redhat | 9 Firefox, Firefox Esr, Thunderbird and 6 more | 2018-08-09 | 5.0 MEDIUM | 7.5 HIGH |
| A mechanism to bypass file system access protections in the sandbox to use the file picker to access different files than those selected in the file picker through the use of relative paths. This allows for read only access to the local file system. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 52.1, and Firefox < 53. | |||||
| CVE-2016-9074 | 2 Debian, Mozilla | 4 Debian Linux, Firefox, Firefox Esr and 1 more | 2018-08-09 | 4.3 MEDIUM | 5.9 MEDIUM |
| An existing mitigation of timing side-channel attacks is insufficient in some circumstances. This issue is addressed in Network Security Services (NSS) 3.26.1. This vulnerability affects Thunderbird < 45.5, Firefox ESR < 45.5, and Firefox < 50. | |||||
| CVE-2017-7808 | 1 Mozilla | 1 Firefox | 2018-08-09 | 5.0 MEDIUM | 5.3 MEDIUM |
| A content security policy (CSP) "frame-ancestors" directive containing origins with paths allows for comparisons against those paths instead of the origin. This results in a cross-origin information leak of this path information. This vulnerability affects Firefox < 55. | |||||
| CVE-2018-0528 | 1 Cybozu | 1 Office | 2018-08-09 | 4.0 MEDIUM | 4.3 MEDIUM |
| Cybozu Office 10.0.0 to 10.7.0 allows authenticated attackers to bypass authentication to view the schedules that are not permitted to access via unspecified vectors. | |||||
| CVE-2018-5134 | 1 Mozilla | 1 Firefox | 2018-08-08 | 5.0 MEDIUM | 7.5 HIGH |
| WebExtensions may use "view-source:" URLs to view local "file:" URL content, as well as content stored in "about:cache", bypassing restrictions that only allow WebExtensions to view specific content. This vulnerability affects Firefox < 59. | |||||
| CVE-2018-0526 | 1 Cybozu | 1 Office | 2018-08-08 | 4.3 MEDIUM | 4.3 MEDIUM |
| Cybozu Office 10.0.0 to 10.7.0 allow remote attackers to display an image located in an external server via unspecified vectors. | |||||
| CVE-2013-7458 | 2 Debian, Redislabs | 2 Debian Linux, Redis | 2018-08-08 | 2.1 LOW | 3.3 LOW |
| linenoise, as used in Redis before 3.2.3, uses world-readable permissions for .rediscli_history, which allows local users to obtain sensitive information by reading the file. | |||||
| CVE-2017-5384 | 1 Mozilla | 1 Firefox | 2018-08-07 | 4.3 MEDIUM | 5.9 MEDIUM |
| Proxy Auto-Config (PAC) files can specify a JavaScript function called for all URL requests with the full URL path which exposes more information than would be sent to the proxy itself in the case of HTTPS. Normally the Proxy Auto-Config file is specified by the user or machine owner and presumed to be non-malicious, but if a user has enabled Web Proxy Auto Detect (WPAD) this file can be served remotely. This vulnerability affects Firefox < 51. | |||||
| CVE-2018-5132 | 2 Canonical, Mozilla | 2 Ubuntu Linux, Firefox | 2018-08-07 | 4.3 MEDIUM | 6.5 MEDIUM |
| The Find API for WebExtensions can search some privileged pages, such as "about:debugging", if these pages are open in a tab. This could allow a malicious WebExtension to search for otherwise protected data if a user has it open. This vulnerability affects Firefox < 59. | |||||
| CVE-2017-5382 | 1 Mozilla | 1 Firefox | 2018-08-07 | 5.0 MEDIUM | 7.5 HIGH |
| Feed preview for RSS feeds can be used to capture errors and exceptions generated by privileged content, allowing for the exposure of internal information not meant to be seen by web content. This vulnerability affects Firefox < 51. | |||||
| CVE-2017-5385 | 1 Mozilla | 1 Firefox | 2018-08-07 | 5.0 MEDIUM | 7.5 HIGH |
| Data sent with in multipart channels, such as the multipart/x-mixed-replace MIME type, will ignore the referrer-policy response header, leading to potential information disclosure for sites using this header. This vulnerability affects Firefox < 51. | |||||
| CVE-2017-5408 | 3 Debian, Mozilla, Redhat | 10 Debian Linux, Firefox, Firefox Esr and 7 more | 2018-08-07 | 5.0 MEDIUM | 5.3 MEDIUM |
| Video files loaded video captions cross-origin without checking for the presence of CORS headers permitting such cross-origin use, leading to potential information disclosure for video captions. This vulnerability affects Firefox < 52, Firefox ESR < 45.8, Thunderbird < 52, and Thunderbird < 45.8. | |||||
| CVE-2017-7847 | 3 Debian, Mozilla, Redhat | 7 Debian Linux, Thunderbird, Enterprise Linux Aus and 4 more | 2018-08-07 | 4.3 MEDIUM | 4.3 MEDIUM |
| Crafted CSS in an RSS feed can leak and reveal local path strings, which may contain user name. This vulnerability affects Thunderbird < 52.5.2. | |||||
| CVE-2017-7759 | 2 Google, Mozilla | 2 Android, Firefox | 2018-08-07 | 5.0 MEDIUM | 7.5 HIGH |
| Android intent URLs given to Firefox for Android can be used to navigate from HTTP or HTTPS URLs to local "file:" URLs, allowing for the reading of local data through a violation of same-origin policy. Note: This attack only affects Firefox for Android. Other operating systems are not affected. This vulnerability affects Firefox < 54. | |||||