CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  Take a third party risk management course for FREE
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Published In June 2018

CVSS Scores Greater Than: 0   1   2   3   4   5   6   7   8   9  
Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2011-0467 89 Sql 2018-06-07 2020-01-24
6.5
 None Remote Low ??? Partial Partial Partial
A vulnerability in the listing of available software of SUSE Studio Onsite, SUSE Studio Onsite 1.1 Appliance allows authenticated users to execute arbitrary SQL statements via SQL injection. Affected releases are SUSE Studio Onsite: versions prior to 1.0.3-0.18.1, SUSE Studio Onsite 1.1 Appliance: versions prior to 1.1.2-0.25.1.
2 CVE-2011-3172 264 2018-06-08 2020-01-24
10.0
 None Remote Low Not required Complete Complete Complete
A vulnerability in pam_modules of SUSE Linux Enterprise allows attackers to log into accounts that should have been disabled. Affected releases are SUSE Linux Enterprise: versions prior to 12.
3 CVE-2011-4181 20 2018-06-11 2019-10-09
5.0
 None Remote Low Not required Partial None None
A vulnerability in open build service allows remote attackers to gain access to source files even though source access is disabled. Affected releases are SUSE open build service up to and including version 2.1.15 (for 2.1) and before version 2.3.
4 CVE-2011-4182 20 Exec Code 2018-06-12 2019-10-09
6.8
 None Remote Medium Not required Partial Partial Partial
Missing escaping of ESSID values in sysconfig of SUSE Linux Enterprise allows attackers controlling an access point to cause execute arbitrary code. Affected releases are sysconfig prior to 0.83.7-2.1.
5 CVE-2011-4183 434 2018-06-13 2019-10-09
7.5
 None Remote Low Not required Partial Partial Partial
A vulnerability in open build service allows remote attackers to upload arbitrary RPM files. Affected releases are SUSE open build service prior to 2.1.16.
6 CVE-2011-4190 310 +Info 2018-06-08 2019-10-09
3.5
 None Remote Medium ??? Partial None None
The kdump implementation is missing the host key verification in the kdump and mkdumprd OpenSSH integration of kdump prior to version 2012-01-20. This is similar to CVE-2011-3588, but different in that the kdump implementation is specific to SUSE. A remote malicious kdump server could use this flaw to impersonate the correct kdump server to obtain security sensitive information (kdump core files).
7 CVE-2012-0433 200 +Info 2018-06-08 2019-10-09
2.1
 None Local Low Not required Partial None None
The install-chef-suse.sh script shipped with crowbar before 2012-10-02 is creating files containing confidential data with insecure permissions, allowing local users to read confidential data.
8 CVE-2013-3703 275 2018-06-08 2019-10-09
4.0
 None Remote Low ??? None Partial None
The controller of the Open Build Service API prior to version 2.4.4 is missing a write permission check, allowing an authenticated attacker to add or remove user roles from packages and/or project meta data.
9 CVE-2014-0593 20 Exec Code 2018-06-08 2019-10-09
10.0
 None Remote Low Not required Complete Complete Complete
The set_version script as shipped with obs-service-set_version is a source validator for the Open Build Service (OBS). In versions prior to 0.5.3-1.1 this script did not properly sanitize the input provided by the user, allowing for code execution on the executing server.
10 CVE-2014-0594 352 CSRF 2018-06-08 2019-10-09
6.8
 None Remote Medium Not required Partial Partial Partial
In the Open Build Service (OBS) before version 2.4.6 the CSRF protection is incorrectly disabled in the web interface, allowing for requests without the user's consent.
11 CVE-2014-5220 77 Exec Code 2018-06-08 2019-07-16
7.2
 None Local Low Not required Complete Complete Complete
The mdcheck script of the mdadm package for openSUSE 13.2 prior to version 3.3.1-5.14.1 does not properly sanitize device names, which allows local attackers to execute arbitrary commands as root.
12 CVE-2015-4043 89 Exec Code Sql 2018-06-19 2018-08-14
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in ConnX ESP HR Management 4.4.0 allows remote attackers to execute arbitrary SQL commands via the ctl00$cphMainContent$txtUserName parameter to frmLogin.aspx.
13 CVE-2015-4664 20 Exec Code 2018-06-18 2021-04-12
7.5
 None Remote Low Not required Partial Partial Partial
An improper input validation vulnerability in CA Privileged Access Manager 2.4.4.4 and earlier allows remote attackers to execute arbitrary commands.
14 CVE-2016-5287 416 2018-06-11 2018-07-30
7.5
 None Remote Low Not required Partial Partial Partial
A potentially exploitable use-after-free crash during actor destruction with service workers. This issue does not affect releases earlier than Firefox 49. This vulnerability affects Firefox < 49.0.2.
15 CVE-2016-5288 200 +Info 2018-06-11 2018-07-30
4.3
 None Remote Medium Not required Partial None None
Web content could access information in the HTTP cache if e10s is disabled. This can reveal some visited URLs and the contents of those pages. This issue affects Firefox 48 and 49. This vulnerability affects Firefox < 49.0.2.
16 CVE-2016-5289 119 Overflow Mem. Corr. 2018-06-11 2018-07-30
7.5
 None Remote Low Not required Partial Partial Partial
Memory safety bugs were reported in Firefox 49. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 50.
17 CVE-2016-5290 119 Overflow Mem. Corr. 2018-06-11 2018-07-30
7.5
 None Remote Low Not required Partial Partial Partial
Memory safety bugs were reported in Firefox 49 and Firefox ESR 45.4. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Thunderbird < 45.5, Firefox ESR < 45.5, and Firefox < 50.
18 CVE-2016-5291 20 Bypass 2018-06-11 2018-07-30
4.9
 None Local Low Not required Complete None None
A same-origin policy bypass with local shortcut files to load arbitrary local content from disk. This vulnerability affects Thunderbird < 45.5, Firefox ESR < 45.5, and Firefox < 50.
19 CVE-2016-5292 20 2018-06-11 2018-07-30
4.3
 None Remote Medium Not required None None Partial
During URL parsing, a maliciously crafted URL can cause a potentially exploitable crash. This vulnerability affects Firefox < 50.
20 CVE-2016-5293 20 2018-06-11 2018-07-30
2.1
 None Local Low Not required None Partial None
When the Mozilla Updater is run, if the Updater's log file in the working directory points to a hardlink, data can be appended to an arbitrary local file. This vulnerability requires local system access. Note: this issue only affects Windows operating systems. This vulnerability affects Firefox ESR < 45.5 and Firefox < 50.
21 CVE-2016-5294 20 2018-06-11 2018-07-30
2.1
 None Local Low Not required None Partial None
The Mozilla Updater can be made to choose an arbitrary target working directory for output files resulting from the update process. This vulnerability requires local system access. Note: this issue only affects Windows operating systems. This vulnerability affects Thunderbird < 45.5, Firefox ESR < 45.5, and Firefox < 50.
22 CVE-2016-5295 264 2018-06-11 2018-07-30
4.6
 None Local Low Not required Partial Partial Partial
This vulnerability allows an attacker to use the Mozilla Maintenance Service to escalate privilege by having the Maintenance Service invoke the Mozilla Updater to run malicious local files. This vulnerability requires local system access and is a variant of MFSA2013-44. Note: this issue only affects Windows operating systems. This vulnerability affects Firefox < 50.
23 CVE-2016-5296 119 Overflow 2018-06-11 2018-07-30
5.0
 None Remote Low Not required None None Partial
A heap-buffer-overflow in Cairo when processing SVG content caused by compiler optimization, resulting in a potentially exploitable crash. This vulnerability affects Thunderbird < 45.5, Firefox ESR < 45.5, and Firefox < 50.
24 CVE-2016-5297 190 Overflow 2018-06-11 2018-07-30
7.5
 None Remote Low Not required Partial Partial Partial
An error in argument length checking in JavaScript, leading to potential integer overflows or other bounds checking issues. This vulnerability affects Thunderbird < 45.5, Firefox ESR < 45.5, and Firefox < 50.
25 CVE-2016-5298 20 2018-06-11 2018-07-30
4.3
 None Remote Medium Not required None Partial None
A mechanism where disruption of the loading of a new web page can cause the previous page's favicon and SSL indicator to not be reset when the new page is loaded. Note: this issue only affects Firefox for Android. Desktop Firefox is unaffected. This vulnerability affects Firefox < 50.
26 CVE-2016-5299 275 2018-06-11 2018-07-30
5.0
 None Remote Low Not required Partial None None
A previously installed malicious Android application with same signature-level permissions as Firefox can intercept AuthTokens meant for Firefox only. Note: This issue only affects Firefox for Android. Other versions and operating systems are unaffected. This vulnerability affects Firefox < 50.
27 CVE-2016-8390 787 2018-06-04 2022-04-19
6.8
 None Remote Medium Not required Partial Partial Partial
An exploitable out of bounds write vulnerability exists in the parsing of ELF Section Headers of Hopper Disassembler 3.11.20. A specially crafted ELF file can cause attacker controlled pointer arithmetic resulting in a partially controlled out of bounds write. An attacker can craft an ELF file with specific section headers to trigger this vulnerability.
28 CVE-2016-9042 20 DoS 2018-06-04 2022-04-19
4.3
 None Remote Medium Not required None None Partial
An exploitable denial of service vulnerability exists in the origin timestamp check functionality of ntpd 4.2.8p9. A specially crafted unauthenticated network packet can be used to reset the expected origin timestamp for target peers. Legitimate replies from targeted peers will fail the origin timestamp check (TEST2) causing the reply to be dropped and creating a denial of service condition.
29 CVE-2016-9061 275 2018-06-11 2018-07-30
5.0
 None Remote Low Not required Partial None None
A previously installed malicious Android application which defines a specific signature-level permissions used by Firefox can access API keys meant for Firefox only. Note: This issue only affects Firefox for Android. Other versions and operating systems are unaffected. This vulnerability affects Firefox < 50.
30 CVE-2016-9062 200 +Info 2018-06-11 2018-07-30
2.1
 None Local Low Not required Partial None None
Private browsing mode leaves metadata information, such as URLs, for sites visited in "browser.db" and "browser.db-wal" files within the Firefox profile after the mode is exited. Note: This issue only affects Firefox for Android. Other versions and operating systems are unaffected. This vulnerability affects Firefox < 50.
31 CVE-2016-9063 190 Overflow 2018-06-11 2018-07-30
7.5
 None Remote Low Not required Partial Partial Partial
An integer overflow during the parsing of XML using the Expat library. This vulnerability affects Firefox < 50.
32 CVE-2016-9064 295 2018-06-11 2018-08-01
4.3
 None Remote Medium Not required None Partial None
Add-on updates failed to verify that the add-on ID inside the signed package matched the ID of the add-on being updated. An attacker who could perform a man-in-the-middle attack on the user's connection to the update server and defeat the certificate pinning protection could provide a malicious signed add-on instead of a valid update. This vulnerability affects Firefox ESR < 45.5 and Firefox < 50.
33 CVE-2016-9065 20 2018-06-11 2018-07-30
5.0
 None Remote Low Not required None Partial None
The location bar in Firefox for Android can be spoofed by forcing a user into fullscreen mode, blocking its exiting, and creating of a fake location bar without any user notification. Note: This issue only affects Firefox for Android. Other versions and operating systems are unaffected. This vulnerability affects Firefox < 50.
34 CVE-2016-9066 119 Overflow 2018-06-11 2018-07-30
5.0
 None Remote Low Not required None None Partial
A buffer overflow resulting in a potentially exploitable crash due to memory allocation issues when handling large amounts of incoming data. This vulnerability affects Thunderbird < 45.5, Firefox ESR < 45.5, and Firefox < 50.
35 CVE-2016-9067 416 2018-06-11 2018-07-30
5.0
 None Remote Low Not required None None Partial
Two use-after-free errors during DOM operations resulting in potentially exploitable crashes. This vulnerability affects Firefox < 50.
36 CVE-2016-9068 416 2018-06-11 2018-07-30
5.0
 None Remote Low Not required None None Partial
A use-after-free during web animations when working with timelines resulting in a potentially exploitable crash. This vulnerability affects Firefox < 50.
37 CVE-2016-9070 264 2018-06-11 2018-08-01
6.8
 None Remote Medium Not required Partial Partial Partial
A maliciously crafted page loaded to the sidebar through a bookmark can reference a privileged chrome window and engage in limited JavaScript operations violating cross-origin protections. This vulnerability affects Firefox < 50.
38 CVE-2016-9071 254 2018-06-11 2018-07-30
5.0
 None Remote Low Not required Partial None None
Content Security Policy combined with HTTP to HTTPS redirection can be used by malicious server to verify whether a known site is within a user's browser history. This vulnerability affects Firefox < 50.
39 CVE-2016-9072 254 2018-06-11 2018-08-01
5.0
 None Remote Low Not required None Partial None
When a new Firefox profile is created on 64-bit Windows installations, the sandbox for 64-bit NPAPI plugins is not enabled by default. Note: This issue only affects 64-bit Windows. 32-bit Windows and other operating systems are unaffected. This vulnerability affects Firefox < 50.
40 CVE-2016-9073 264 Bypass 2018-06-11 2018-07-30
5.0
 None Remote Low Not required None Partial None
WebExtensions can bypass security checks to load privileged URLs and potentially escape the WebExtension sandbox. This vulnerability affects Firefox < 50.
41 CVE-2016-9074 200 +Info 2018-06-11 2018-08-09
4.3
 None Remote Medium Not required Partial None None
An existing mitigation of timing side-channel attacks is insufficient in some circumstances. This issue is addressed in Network Security Services (NSS) 3.26.1. This vulnerability affects Thunderbird < 45.5, Firefox ESR < 45.5, and Firefox < 50.
42 CVE-2016-9075 264 2018-06-11 2018-08-08
7.5
 None Remote Low Not required Partial Partial Partial
An issue where WebExtensions can use the mozAddonManager API to elevate privilege due to privileged pages being allowed in the permissions list. This allows a malicious extension to then install additional extensions without explicit user permission. This vulnerability affects Firefox < 50.
43 CVE-2016-9076 20 2018-06-11 2018-08-08
4.3
 None Remote Medium Not required None Partial None
An issue where a "<select>" dropdown menu can be used to cover location bar content, resulting in potential spoofing attacks. This attack requires e10s to be enabled in order to function. This vulnerability affects Firefox < 50.
44 CVE-2016-9077 362 2018-06-11 2018-08-08
6.8
 None Remote Medium Not required Partial Partial Partial
Canvas allows the use of the "feDisplacementMap" filter on images loaded cross-origin. The rendering by the filter is variable depending on the input pixel, allowing for timing attacks when the images are loaded from third party locations. This vulnerability affects Firefox < 50.
45 CVE-2016-9078 601 2018-06-11 2018-08-01
6.8
 None Remote Medium Not required Partial Partial Partial
Redirection from an HTTP connection to a "data:" URL assigns the referring site's origin to the "data:" URL in some circumstances. This can result in same-origin violations against a domain if it loads resources from malicious sites. Cross-origin setting of cookies has been demonstrated without the ability to read them. Note: This issue only affects Firefox 49 and 50. This vulnerability affects Firefox < 50.0.1.
46 CVE-2016-9079 416 2018-06-11 2018-08-09
5.0
 None Remote Low Not required Partial None None
A use-after-free vulnerability in SVG Animation has been discovered. An exploit built on this vulnerability has been discovered in the wild targeting Firefox and Tor Browser users on Windows. This vulnerability affects Firefox < 50.0.2, Firefox ESR < 45.5.1, and Thunderbird < 45.5.1.
47 CVE-2016-9080 119 Overflow Mem. Corr. 2018-06-11 2018-08-07
7.5
 None Remote Low Not required Partial Partial Partial
Memory safety bugs were reported in Firefox 50.0.2. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 50.1.
48 CVE-2016-9488 89 Exec Code Sql 2018-06-05 2020-07-27
7.5
 None Remote Low Not required Partial Partial Partial
ManageEngine Applications Manager versions 12 and 13 before build 13200 suffer from remote SQL injection vulnerabilities. An unauthenticated attacker is able to access the URL /servlet/MenuHandlerServlet, which is vulnerable to SQL injection. The attacker could extract users' password hashes, which are MD5 hashes without salt, and, depending on the database type and its configuration, could also execute operating system commands using SQL queries.
49 CVE-2016-9490 79 XSS 2018-06-05 2018-08-07
4.3
 None Remote Medium Not required None Partial None
ManageEngine Applications Manager versions 12 and 13 before build 13200 suffer from a Reflected Cross-Site Scripting vulnerability. Applications Manager is prone to a Cross-Site Scripting vulnerability in parameter LIMIT, in URL path /DiagAlertAction.do?REQTYPE=AJAX&LIMIT=1233. The URL is also available without authentication.
50 CVE-2016-9893 119 Overflow Mem. Corr. 2018-06-11 2018-08-03
7.5
 None Remote Low Not required Partial Partial Partial
Memory safety bugs were reported in Thunderbird 45.5. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 50.1, Firefox ESR < 45.6, and Thunderbird < 45.6.
Total number of vulnerabilities : 1788   Page : 1 (This Page)2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.