CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  Take a third party risk management course for FREE
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Published In June 2018

CVSS Scores Greater Than: 0   1   2   3   4   5   6   7   8   9  
Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1751 CVE-2016-9071 254 2018-06-11 2018-07-30
5.0
 None Remote Low Not required Partial None None
Content Security Policy combined with HTTP to HTTPS redirection can be used by malicious server to verify whether a known site is within a user's browser history. This vulnerability affects Firefox < 50.
1752 CVE-2016-9070 264 2018-06-11 2018-08-01
6.8
 None Remote Medium Not required Partial Partial Partial
A maliciously crafted page loaded to the sidebar through a bookmark can reference a privileged chrome window and engage in limited JavaScript operations violating cross-origin protections. This vulnerability affects Firefox < 50.
1753 CVE-2016-9068 416 2018-06-11 2018-07-30
5.0
 None Remote Low Not required None None Partial
A use-after-free during web animations when working with timelines resulting in a potentially exploitable crash. This vulnerability affects Firefox < 50.
1754 CVE-2016-9067 416 2018-06-11 2018-07-30
5.0
 None Remote Low Not required None None Partial
Two use-after-free errors during DOM operations resulting in potentially exploitable crashes. This vulnerability affects Firefox < 50.
1755 CVE-2016-9066 119 Overflow 2018-06-11 2018-07-30
5.0
 None Remote Low Not required None None Partial
A buffer overflow resulting in a potentially exploitable crash due to memory allocation issues when handling large amounts of incoming data. This vulnerability affects Thunderbird < 45.5, Firefox ESR < 45.5, and Firefox < 50.
1756 CVE-2016-9065 20 2018-06-11 2018-07-30
5.0
 None Remote Low Not required None Partial None
The location bar in Firefox for Android can be spoofed by forcing a user into fullscreen mode, blocking its exiting, and creating of a fake location bar without any user notification. Note: This issue only affects Firefox for Android. Other versions and operating systems are unaffected. This vulnerability affects Firefox < 50.
1757 CVE-2016-9064 295 2018-06-11 2018-08-01
4.3
 None Remote Medium Not required None Partial None
Add-on updates failed to verify that the add-on ID inside the signed package matched the ID of the add-on being updated. An attacker who could perform a man-in-the-middle attack on the user's connection to the update server and defeat the certificate pinning protection could provide a malicious signed add-on instead of a valid update. This vulnerability affects Firefox ESR < 45.5 and Firefox < 50.
1758 CVE-2016-9063 190 Overflow 2018-06-11 2022-06-27
7.5
 None Remote Low Not required Partial Partial Partial
An integer overflow during the parsing of XML using the Expat library. This vulnerability affects Firefox < 50.
1759 CVE-2016-9062 200 +Info 2018-06-11 2018-07-30
2.1
 None Local Low Not required Partial None None
Private browsing mode leaves metadata information, such as URLs, for sites visited in "browser.db" and "browser.db-wal" files within the Firefox profile after the mode is exited. Note: This issue only affects Firefox for Android. Other versions and operating systems are unaffected. This vulnerability affects Firefox < 50.
1760 CVE-2016-9061 275 2018-06-11 2018-07-30
5.0
 None Remote Low Not required Partial None None
A previously installed malicious Android application which defines a specific signature-level permissions used by Firefox can access API keys meant for Firefox only. Note: This issue only affects Firefox for Android. Other versions and operating systems are unaffected. This vulnerability affects Firefox < 50.
1761 CVE-2016-9042 20 DoS 2018-06-04 2022-04-19
4.3
 None Remote Medium Not required None None Partial
An exploitable denial of service vulnerability exists in the origin timestamp check functionality of ntpd 4.2.8p9. A specially crafted unauthenticated network packet can be used to reset the expected origin timestamp for target peers. Legitimate replies from targeted peers will fail the origin timestamp check (TEST2) causing the reply to be dropped and creating a denial of service condition.
1762 CVE-2016-8390 787 2018-06-04 2022-04-19
6.8
 None Remote Medium Not required Partial Partial Partial
An exploitable out of bounds write vulnerability exists in the parsing of ELF Section Headers of Hopper Disassembler 3.11.20. A specially crafted ELF file can cause attacker controlled pointer arithmetic resulting in a partially controlled out of bounds write. An attacker can craft an ELF file with specific section headers to trigger this vulnerability.
1763 CVE-2016-5299 275 2018-06-11 2018-07-30
5.0
 None Remote Low Not required Partial None None
A previously installed malicious Android application with same signature-level permissions as Firefox can intercept AuthTokens meant for Firefox only. Note: This issue only affects Firefox for Android. Other versions and operating systems are unaffected. This vulnerability affects Firefox < 50.
1764 CVE-2016-5298 20 2018-06-11 2018-07-30
4.3
 None Remote Medium Not required None Partial None
A mechanism where disruption of the loading of a new web page can cause the previous page's favicon and SSL indicator to not be reset when the new page is loaded. Note: this issue only affects Firefox for Android. Desktop Firefox is unaffected. This vulnerability affects Firefox < 50.
1765 CVE-2016-5297 190 Overflow 2018-06-11 2018-07-30
7.5
 None Remote Low Not required Partial Partial Partial
An error in argument length checking in JavaScript, leading to potential integer overflows or other bounds checking issues. This vulnerability affects Thunderbird < 45.5, Firefox ESR < 45.5, and Firefox < 50.
1766 CVE-2016-5296 119 Overflow 2018-06-11 2018-07-30
5.0
 None Remote Low Not required None None Partial
A heap-buffer-overflow in Cairo when processing SVG content caused by compiler optimization, resulting in a potentially exploitable crash. This vulnerability affects Thunderbird < 45.5, Firefox ESR < 45.5, and Firefox < 50.
1767 CVE-2016-5295 264 2018-06-11 2018-07-30
4.6
 None Local Low Not required Partial Partial Partial
This vulnerability allows an attacker to use the Mozilla Maintenance Service to escalate privilege by having the Maintenance Service invoke the Mozilla Updater to run malicious local files. This vulnerability requires local system access and is a variant of MFSA2013-44. Note: this issue only affects Windows operating systems. This vulnerability affects Firefox < 50.
1768 CVE-2016-5294 20 2018-06-11 2018-07-30
2.1
 None Local Low Not required None Partial None
The Mozilla Updater can be made to choose an arbitrary target working directory for output files resulting from the update process. This vulnerability requires local system access. Note: this issue only affects Windows operating systems. This vulnerability affects Thunderbird < 45.5, Firefox ESR < 45.5, and Firefox < 50.
1769 CVE-2016-5293 20 2018-06-11 2018-07-30
2.1
 None Local Low Not required None Partial None
When the Mozilla Updater is run, if the Updater's log file in the working directory points to a hardlink, data can be appended to an arbitrary local file. This vulnerability requires local system access. Note: this issue only affects Windows operating systems. This vulnerability affects Firefox ESR < 45.5 and Firefox < 50.
1770 CVE-2016-5292 20 2018-06-11 2018-07-30
4.3
 None Remote Medium Not required None None Partial
During URL parsing, a maliciously crafted URL can cause a potentially exploitable crash. This vulnerability affects Firefox < 50.
1771 CVE-2016-5291 20 Bypass 2018-06-11 2018-07-30
4.9
 None Local Low Not required Complete None None
A same-origin policy bypass with local shortcut files to load arbitrary local content from disk. This vulnerability affects Thunderbird < 45.5, Firefox ESR < 45.5, and Firefox < 50.
1772 CVE-2016-5290 119 Overflow Mem. Corr. 2018-06-11 2018-07-30
7.5
 None Remote Low Not required Partial Partial Partial
Memory safety bugs were reported in Firefox 49 and Firefox ESR 45.4. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Thunderbird < 45.5, Firefox ESR < 45.5, and Firefox < 50.
1773 CVE-2016-5289 119 Overflow Mem. Corr. 2018-06-11 2018-07-30
7.5
 None Remote Low Not required Partial Partial Partial
Memory safety bugs were reported in Firefox 49. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 50.
1774 CVE-2016-5288 200 +Info 2018-06-11 2018-07-30
4.3
 None Remote Medium Not required Partial None None
Web content could access information in the HTTP cache if e10s is disabled. This can reveal some visited URLs and the contents of those pages. This issue affects Firefox 48 and 49. This vulnerability affects Firefox < 49.0.2.
1775 CVE-2016-5287 416 2018-06-11 2018-07-30
7.5
 None Remote Low Not required Partial Partial Partial
A potentially exploitable use-after-free crash during actor destruction with service workers. This issue does not affect releases earlier than Firefox 49. This vulnerability affects Firefox < 49.0.2.
1776 CVE-2015-4664 20 Exec Code 2018-06-18 2021-04-12
7.5
 None Remote Low Not required Partial Partial Partial
An improper input validation vulnerability in CA Privileged Access Manager 2.4.4.4 and earlier allows remote attackers to execute arbitrary commands.
1777 CVE-2015-4043 89 Exec Code Sql 2018-06-19 2018-08-14
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in ConnX ESP HR Management 4.4.0 allows remote attackers to execute arbitrary SQL commands via the ctl00$cphMainContent$txtUserName parameter to frmLogin.aspx.
1778 CVE-2014-5220 77 Exec Code 2018-06-08 2019-07-16
7.2
 None Local Low Not required Complete Complete Complete
The mdcheck script of the mdadm package for openSUSE 13.2 prior to version 3.3.1-5.14.1 does not properly sanitize device names, which allows local attackers to execute arbitrary commands as root.
1779 CVE-2014-0594 352 CSRF 2018-06-08 2019-10-09
6.8
 None Remote Medium Not required Partial Partial Partial
In the Open Build Service (OBS) before version 2.4.6 the CSRF protection is incorrectly disabled in the web interface, allowing for requests without the user's consent.
1780 CVE-2014-0593 20 Exec Code 2018-06-08 2019-10-09
10.0
 None Remote Low Not required Complete Complete Complete
The set_version script as shipped with obs-service-set_version is a source validator for the Open Build Service (OBS). In versions prior to 0.5.3-1.1 this script did not properly sanitize the input provided by the user, allowing for code execution on the executing server.
1781 CVE-2013-3703 275 2018-06-08 2019-10-09
4.0
 None Remote Low ??? None Partial None
The controller of the Open Build Service API prior to version 2.4.4 is missing a write permission check, allowing an authenticated attacker to add or remove user roles from packages and/or project meta data.
1782 CVE-2012-0433 200 +Info 2018-06-08 2019-10-09
2.1
 None Local Low Not required Partial None None
The install-chef-suse.sh script shipped with crowbar before 2012-10-02 is creating files containing confidential data with insecure permissions, allowing local users to read confidential data.
1783 CVE-2011-4190 310 +Info 2018-06-08 2019-10-09
3.5
 None Remote Medium ??? Partial None None
The kdump implementation is missing the host key verification in the kdump and mkdumprd OpenSSH integration of kdump prior to version 2012-01-20. This is similar to CVE-2011-3588, but different in that the kdump implementation is specific to SUSE. A remote malicious kdump server could use this flaw to impersonate the correct kdump server to obtain security sensitive information (kdump core files).
1784 CVE-2011-4183 434 2018-06-13 2019-10-09
7.5
 None Remote Low Not required Partial Partial Partial
A vulnerability in open build service allows remote attackers to upload arbitrary RPM files. Affected releases are SUSE open build service prior to 2.1.16.
1785 CVE-2011-4182 20 Exec Code 2018-06-12 2019-10-09
6.8
 None Remote Medium Not required Partial Partial Partial
Missing escaping of ESSID values in sysconfig of SUSE Linux Enterprise allows attackers controlling an access point to cause execute arbitrary code. Affected releases are sysconfig prior to 0.83.7-2.1.
1786 CVE-2011-4181 20 2018-06-11 2019-10-09
5.0
 None Remote Low Not required Partial None None
A vulnerability in open build service allows remote attackers to gain access to source files even though source access is disabled. Affected releases are SUSE open build service up to and including version 2.1.15 (for 2.1) and before version 2.3.
1787 CVE-2011-3172 264 2018-06-08 2020-01-24
10.0
 None Remote Low Not required Complete Complete Complete
A vulnerability in pam_modules of SUSE Linux Enterprise allows attackers to log into accounts that should have been disabled. Affected releases are SUSE Linux Enterprise: versions prior to 12.
1788 CVE-2011-0467 89 Sql 2018-06-07 2020-01-24
6.5
 None Remote Low ??? Partial Partial Partial
A vulnerability in the listing of available software of SUSE Studio Onsite, SUSE Studio Onsite 1.1 Appliance allows authenticated users to execute arbitrary SQL statements via SQL injection. Affected releases are SUSE Studio Onsite: versions prior to 1.0.3-0.18.1, SUSE Studio Onsite 1.1 Appliance: versions prior to 1.1.2-0.25.1.
Total number of vulnerabilities : 1788   Page : 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 (This Page)
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.