CVE-2018-12339

ArticleCMS through 2017-02-19 has XSS via an "add an article" action...

CVE-2018-12339

ArticleCMS through 2017-02-19 has XSS via an "add an article" action...

Description of the security update for Outlook 2013: June 12, 2018

Description of the security update for Outlook 2013: June 12, 2018 Summary This security update resolves vulnerabilities in Microsoft Office that could allow remote code execution if a user opens a specially crafted Office file. To learn more about these vulnerabilities, see Microsoft Common...

DEBIAN-CVE-2016-9905

A potentially exploitable crash in "EnumerateSubDocuments" while adding or removing sub-documents. This vulnerability affects Firefox ESR 45.6 and Thunderbird 45.6...

CVE-2016-9903

Mozilla's add-ons SDK had a world-accessible resource with an HTML injection vulnerability. If an additional vulnerability allowed this resource to be loaded as a document it could allow injecting content and script into an add-on's context. This vulnerability affects Firefox 50.1...

DEBIAN-CVE-2016-9064

Add-on updates failed to verify that the add-on ID inside the signed package matched the ID of the add-on being updated. An attacker who could perform a man-in-the-middle attack on the user's connection to the update server and defeat the certificate pinning protection could provide a malicious...

CVE-2016-9064

Add-on updates failed to verify that the add-on ID inside the signed package matched the ID of the add-on being updated. An attacker who could perform a man-in-the-middle attack on the user's connection to the update server and defeat the certificate pinning protection could provide a malicious...

CVE-2016-9064

Add-on updates failed to verify that the add-on ID inside the signed package matched the ID of the add-on being updated. An attacker who could perform a man-in-the-middle attack on the user's connection to the update server and defeat the certificate pinning protection could provide a malicious...

Design/Logic Flaw

Mozilla's add-ons SDK had a world-accessible resource with an HTML injection vulnerability. If an additional vulnerability allowed this resource to be loaded as a document it could allow injecting content and script into an add-on's context. This vulnerability affects Firefox 50.1...

Code injection

Add-on updates failed to verify that the add-on ID inside the signed package matched the ID of the add-on being updated. An attacker who could perform a man-in-the-middle attack on the user's connection to the update server and defeat the certificate pinning protection could provide a malicious...

CVE-2016-9903

Mozilla's add-ons SDK had a world-accessible resource with an HTML injection vulnerability. If an additional vulnerability allowed this resource to be loaded as a document it could allow injecting content and script into an add-on's context. This vulnerability affects Firefox 50.1...

CVE-2016-9064

CVE-2016-9064 affects Mozilla Firefox and Firefox ESR due to inadequate verification in the addon update mechanism: the add-on ID in the signed package could mismatch the target add-on, enabling a MITM attacker to substitute a malicious signed update. Documents indicate this affects Firefox ESR &...

CVE-2016-9064

Add-on updates failed to verify that the add-on ID inside the signed package matched the ID of the add-on being updated. An attacker who could perform a man-in-the-middle attack on the user's connection to the update server and defeat the certificate pinning protection could provide a malicious...

CVE-2016-9903

Mozilla's add-ons SDK had a world-accessible resource with an HTML injection vulnerability. If an additional vulnerability allowed this resource to be loaded as a document it could allow injecting content and script into an add-on's context. This vulnerability affects Firefox 50.1...

CVE-2016-9903

CVE-2016-9903 is a cross-site scripting (XSS) vulnerability in Mozilla Firefox’s Add-ons SDK. The issue arises from a world-accessible resource that can be loaded as a document due to another vulnerability, enabling an attacker to inject content and script into the add-on context and potentially ...

CVE-2016-9064

Add-on updates failed to verify that the add-on ID inside the signed package matched the ID of the add-on being updated. An attacker who could perform a man-in-the-middle attack on the user's connection to the update server and defeat the certificate pinning protection could provide a malicious...

The vulnerability of the LsaAddAccountRights function in the 7-Zip file archiver allows a hacker to circumvent existing access restrictions.

The vulnerability of the LsaAddAccountRights function in the 7-Zip file archiver is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker to circumvent existing access restrictions by using the SeLockMemoryPrivilege privilege...

PT-2018-2075 · D Link · D-Link Central Wifi Manager

Name of the Vulnerable Software and Affected Versions: D-Link Central WiFi Manager versions prior to 1.03r0100-Beta1 Description: An issue exists due to inadequate protection of the web page structure, allowing a remote attacker to inject arbitrary code into a loaded web page. The username...

Quest DR Series Disk Backup Software Command Injection Vulnerability (CNVD-2018-15880)

The Quest DR Series are disk storage and deduplication appliances. A command injection vulnerability exists in the "Add Storage" method in Quest DR Series Disk Backup Software versions prior to 4.0.3.1. An attacker could exploit this vulnerability to execute commands...

Quest DR Series Disk Backup Software Command Injection Vulnerability (CNVD-2018-15889)

The Quest DR Series are disk storage and deduplication appliances. A command injection vulnerability exists in the "Add Email Alert" method in Quest DR Series Disk Backup Software versions prior to 4.0.3.1. An attacker could exploit this vulnerability to execute system commands...