GHSA-4W88-RJJ3-X7WP Chromium Remote Code Execution in electron

Affected versions of ElectronJS are susceptible to a remote code execution vulnerability that occurs when an affected application access remote content, even if the sandbox option is enabled. Recommendation Update to electron version 1.7.8 or later...

CVE-2018-12713

GIMP through 2.10.2 makes ggettmpdir calls to establish temporary filenames, which may result in a filename that already exists, as demonstrated by the gimpwriteandreadfile function in app/tests/test-xcf.c. This might be leveraged by attackers to overwrite files or read file content that was...

CVE-2016-5288

Web content could access information in the HTTP cache if e10s is disabled. This can reveal some visited URLs and the contents of those pages. This issue affects Firefox 48 and 49. This vulnerability affects Firefox 49.0.2...

CVE-2017-16151

Based on details posted by the ElectronJS team; A remote code execution vulnerability has been discovered in Google Chromium that affects all recent versions of Electron. Any Electron app that accesses remote content is vulnerable to this exploit, regardless of whether the sandbox option is enabl...

Multiple TIBCO Product Information Disclosure Vulnerabilities (CNVD-2018-10558)

TIBCO JasperReports Server and so on are the products of the United States TIBCO Software Corporation.TIBCO JasperReports Server is a report generation and editing tools for the server version of the TIBCO JasperReports Server Community Edition is the community version of it. A security...

Mozilla Firefox WebExtensions Host Privilege Bypass Vulnerability

Mozilla Firefox browser Firefox is a free and open source browser for Windows, Linux and MacOSX platforms. Mozilla Firefox suffers from a WebExtensions host privilege bypass vulnerability. An attacker can exploit this vulnerability to bypass host privilege settings via request redirection and...

CVE-2018-5166

WebExtensions can use request redirection and a "filterReponseData" filter to bypass host permission settings to redirect network traffic and access content from a host for which they do not have explicit user permission. This vulnerability affects Firefox 60...

Information Disclosure Through Authorization Bypass

undertow-core is vulnerable to information disclosure attacks through authorization bypass. The vulnerability exists as undertow-core does not validate the uri attribute in the Authorization header, allowing a man-in-the-middle MitM attacker to provide a bogus uri and accessing other content on t...

Google Patches 11 Critical Bugs in March Android Security Bulletin

Google patched 11 critical vulnerabilities in its Android operating system this week, seven of which are remote code execution bugs. In total, 37 flaws were patched, with 26 rated as high severity. The most severe of the bugs is a critical security vulnerability found in the Media Framework...

Mozilla Firefox Unauthorized Access Vulnerability (CNVD-2018-02220)

Mozilla Firefox is an open source web browser developed by the Mozilla Foundation in the United States. A security vulnerability exists in previous versions of Mozilla Firefox 58, which stems from the program being able to display cross-origin content when the CORS packet header is set to prohibi...

Mozilla Firefox Security Advisories (MFSA2018-02, MFSA2018-03) - Windows

Mozilla Firefox is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mozilla:firefox";...

Mozilla Firefox Security Advisories (MFSA2018-02, MFSA2018-03) - Mac OS X

Mozilla Firefox is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mozilla:firefox";...

DRUPAL-CONTRIB-2018-002

The Node view permissions module enables the "View own content" and "View any content" permissions for each content type on the permissions page. This module has a vulnerability that allows users with these permissions to view unpublished content that they are not otherwise authorized to view. Th...

Plone Information Disclosure Vulnerability (CNVD-2018-02150)

Plone is the U.S. Plone Foundation's set of free and open source content management system CMS built on an application server Zope. The system is developed in Python language , suitable for web portals , internal and external corporate websites , document publishing systems and so on. An...

OpenAM Authentication Bypass Vulnerability

ForgeRock OpenAM Open Source Edition is the United States ForgeRock company's set of open source single sign-on framework SSO, which provides core identity services Core Server to achieve a transparent single sign-on in a network architecture such as centralized, distributed single sign-on. A...

Oracle OIT ImageExport libvs_bmp BMP BI_RLE8 Width Code Execution Vulnerability(CVE-2016-3596)

Description When parsing a specially crafted BMP file, an erroneous memory copy operation can cause a heap buffer overflow leading to arbitrary code execution. Tested Versions Oracle Outside In Technology Content Access SDK 8.5.1. Product URLs...

Remote Code Execution

Electron is vulnerable to remote code execution RCE attacks. These attacks affect all Electron apps which access remote content, this includes applications using the sandbox option...

Microsoft SharePoint Cross-Site Scripting Vulnerability (CNVD-2017-13139)

Microsoft SharePoint is an enterprise business collaboration platform from Microsoft. The platform is used to consolidate business information and enable sharing of work, collaborating with others, organizing projects and workgroups, and searching for people and information. A cross-site scriptin...

Insecure Cross-Domain Policy (allow-access-from)

The browser security model normally prevents web content from one domain from accessing data from another domain. This is commonly known as the "same origin policy". URL policy files grant cross-domain permissions for reading data. They permit operations that are not permitted by default. The URL...

PT-2017-3747

Name of the Vulnerable Software and Affected Versions: libxml2 affected versions not specified Description: A flaw in libxml2 allows remote XML entity inclusion with default parser flags. This may expose a higher-risk attack surface, allowing access to content from local files, HTTP, or FTP...