Every advisory below is enriched with the Vulnetix VDB exploit-intelligence chip (hover a CVE ID in the interactive page to see CVSS, EPSS, KEV status, and PoC maturity). 4 are already weaponised in the wild.
The advisories below are ordered by the Vulnetix risk prioritization strategy: exploitation evidence first, scores second. On the interactive page you can switch to three other lenses.
Updated chromium-browser-stable packages fix security vulnerabilities
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| chromium-browser-stable | affected | Mageia:6 | chromium-browser-stable | — |
Adobe Flash Player versions 29.0.0.171 and earlier have a Stack-based buffer overflow vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.
CVEs:CVE-2018-5002
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| enterprise_linux_desktop | affected | redhat | — | — |
| enterprise_linux_server | affected | redhat | — | — |
| enterprise_linux_workstation | affected | redhat | — | — |
| flash_player | affected | adobe | — | — |
| flash_player_desktop_runtime | affected | adobe | — | — |
Adobe Flash Player versions 29.0.0.171 and earlier have a Stack-based buffer overflow vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.
CVEs:CVE-2018-5002
CVEs:CVE-2018-5002
chromium-browser - security update
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| chromium-browser | affected | Debian:9 | chromium-browser | — |
CVEs:CVE-2018-9373
In TdlsexRxFrameHandle of the MTK WLAN driver, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for e...
CVEs:CVE-2018-9373
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
In bnep_data_ind of bnep_main.c, there is a possible remote code execution due to a double free. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android ...
CVEs:CVE-2018-9356
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
CVEs:CVE-2018-9356
In bta_dm_sdp_result of bta_dm_act.cc, there is a possible out of bounds stack write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation...
CVEs:CVE-2018-9355
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
CVEs:CVE-2018-9355
In process_l2cap_cmd of l2c_main.cc, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation....
CVEs:CVE-2018-9360
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
CVEs:CVE-2018-9360
In process_l2cap_cmd of l2c_main.cc, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation....
CVEs:CVE-2018-9359
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
CVEs:CVE-2018-9359
In process_l2cap_cmd of l2c_main.cc, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation....
CVEs:CVE-2018-9361
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
CVEs:CVE-2018-9361
CVEs:CVE-2018-9358
In gatts_process_attribute_req of gatt_sc.cc, there is a possible read of uninitialized data due to a missing bounds check. This could lead to remote information disclosure in the Bluetooth process with no additional execution privileges needed. User i...
CVEs:CVE-2018-9358
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
In processMessagePart of InboundSmsHandler.java, there is a possible remote denial of service due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed f...
CVEs:CVE-2018-9362
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
CVEs:CVE-2018-9362
Path Traversal in angular-http-server
CVEs:CVE-2018-3713
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| angular-http-server | affected | npm | angular-http-server | — |
Path Traversal in angular-http-server
CVEs:CVE-2018-3713
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| angular-http-server | affected | npm | angular-http-server | — |
angular-http-server node module suffers from a Path Traversal vulnerability due to lack of validation of possibleFilename, which allows a malicious user to read content of any file with known path.
CVEs:CVE-2018-3713
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| angular-http-server | affected | angular-http-server_project | — | — |
protobufjs is vulnerable to ReDoS when parsing crafted invalid .proto files.
CVEs:CVE-2018-3738
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| protobufjs | affected | protobufjs_project | — | — |
Denial of Service in protobufjs
CVEs:CVE-2018-3738
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| protobufjs | affected | npm | protobufjs | — |
Denial of Service in protobufjs
CVEs:CVE-2018-3738
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| protobufjs | affected | npm | protobufjs | — |
In wlan_hdd_cfg80211_set_privacy_ibss() in Android releases from CAF using the linux kernel (Android for MSM, Firefox OS for MSM, QRD Android) before security patch level 2018-06-05, a buffer over-read can potentially occur.
CVEs:CVE-2018-5829
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
CVEs:CVE-2018-5829
In function SMF_ParseMetaEvent of file eas_smf.c there is incorrect input validation causing an infinite loop. This could lead to a remote temporary DoS with no additional execution privileges needed. User interaction is needed for exploitation. Produc...
CVEs:CVE-2018-9347
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
CVEs:CVE-2018-9347
In the hidp_process_report in bluetooth, there is an integer overflow. This could lead to an out of bounds write with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android kernel ...
CVEs:CVE-2018-9363
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — | |
| debian_linux | affected | debian | — | — |
| linux_kernel | affected | linux | — | — |
| ubuntu_linux | affected | canonical | — | — |
CVEs:CVE-2018-9363
CVEs:CVE-2018-9341
In impeg2d_mc_fullx_fully of impeg2d_mc.c there is a possible out of bound write due to missing bounds check. This could lead to remote arbitrary code execution with no additional execution privileges needed. User interaction is needed for exploitation.
CVEs:CVE-2018-9341
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
CVEs:CVE-2018-9348
In SMF_ParseMetaEvent of eas_smf.c, there is a possible integer overflow. This could lead to remote denial of service due to resource exhaustion with no additional execution privileges needed. User interaction is needed for exploitation.
CVEs:CVE-2018-9348
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
CVEs:CVE-2017-18159
In Android releases from CAF using the linux kernel (Android for MSM, Firefox OS for MSM, QRD Android) before security patch level 2018-06-05, while processing a StrHwPlatform with length smaller than EFICHIPINFO_MAX_ID_LENGTH, an array out of bounds a...
CVEs:CVE-2017-18159
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
While processing the HTT_T2H_MSG_TYPE_MGMT_TX_COMPL_IND message, a buffer overflow can potentially occur in Android releases from CAF using the linux kernel (Android for MSM, Firefox OS for MSM, QRD Android) before security patch level 2018-06-05.
CVEs:CVE-2018-5830
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
CVEs:CVE-2018-5830
In the LG LAF component, there is a special command that allowed modification of certain partitions. This could lead to bypass of secure boot. User interaction is not needed for exploitation.
CVEs:CVE-2018-9364
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
CVEs:CVE-2018-9364
In BNEP_Write of bnep_api.cc, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation. Product: An...
CVEs:CVE-2018-9357
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
CVEs:CVE-2018-9357
If the seq_len is greater then CSR_MAX_RSC_LEN, a buffer overflow in __wlan_hdd_cfg80211_add_key() may occur when copying keyRSC in Android releases from CAF using the linux kernel (Android for MSM, Firefox OS for MSM, QRD Android) before security patc...
CVEs:CVE-2018-5835
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
CVEs:CVE-2018-5835
CVEs:CVE-2018-5834
In __wlan_hdd_cfg80211_vendor_scan(), a buffer overwrite can potentially occur in Android releases from CAF using the linux kernel (Android for MSM, Firefox OS for MSM, QRD Android) before security patch level 2018-06-05.
CVEs:CVE-2018-5834
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
CVEs:CVE-2017-6290
In Android before the 2018-06-05 security patch level, NVIDIA TLK TrustZone contains a possible out of bounds write due to an integer overflow which could lead to local escalation of privilege with no additional execution privileges needed. User intera...
CVEs:CVE-2017-6290
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
In Android before the 2018-06-05 security patch level, NVIDIA TLZ TrustZone contains a possible out of bounds write due to integer overflow which could lead to local escalation of privilege in the TrustZone with no additional execution privileges neede...
CVEs:CVE-2017-6292
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
CVEs:CVE-2017-6292
A stack-based buffer overflow can occur in fastboot from all Android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the Linux kernel.
CVEs:CVE-2018-5854
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
CVEs:CVE-2018-5854
CVEs:CVE-2018-5896
In Android releases from CAF using the linux kernel (Android for MSM, Firefox OS for MSM, QRD Android) before security patch level 2018-06-05, kernel panic may happen due to out-of-bound read, caused by not checking source buffer length against length ...
CVEs:CVE-2018-5896
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
In Android before the 2018-06-05 security patch level, NVIDIA Tegra X1 TZ contains a possible out of bounds write due to missing bounds check which could lead to escalation of privilege from the kernel to the TZ. User interaction is not needed for expl...
CVEs:CVE-2017-6294
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
CVEs:CVE-2017-6294
CVEs:CVE-2018-9340
In ResStringPool::setTo of ResourceTypes.cpp, it's possible for an attacker to control the value of mStringPoolSize to be out of bounds, causing information disclosure.
CVEs:CVE-2018-9340
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
In ResStringPool::setTo of ResourceTypes.cpp, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exp...
CVEs:CVE-2018-9338
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
CVEs:CVE-2018-9338
CVEs:CVE-2018-9371
In the Mediatek Preloader, there are out of bounds reads and writes due to an exposed interface that allows arbitrary peripheral memory mapping with insufficient blacklisting/whitelisting. This could lead to local elevation of privilege, given physical...
CVEs:CVE-2018-9371
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
In writeTypedArrayList and readTypedArrayList of Parcel.java, there is a possible escalation of privilege due to type confusion. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not ne...
CVEs:CVE-2018-9339
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
CVEs:CVE-2018-9339
CVEs:CVE-2018-9366
In IMSA_Recv_Thread and VT_IMCB_Thread of ImsaClient.cpp and VideoTelephony.c, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User int...
CVEs:CVE-2018-9366
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
In FT_ACDK_CCT_V2_OP_ISP_SET_TUNING_PARAS of Meta_CCAP_Para.cpp, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction...
CVEs:CVE-2018-9367
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
CVEs:CVE-2018-9367
In mtkscoaudio debugfs there is a possible arbitrary kernel memory write due to missing bounds check and weakened SELinux policies. This could lead to local escalation of privilege with system execution privileges needed. User interaction is not need...
CVEs:CVE-2018-9368
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
CVEs:CVE-2018-9368
CVEs:CVE-2018-9372
In cmd_flash_mmc_sparse_img of dl_commands.c, there is a possible out of bounds write due to a missing bounds check. This could lead to a local escalation of privilege in the bootloader with no additional execution privileges needed. User interaction i...
CVEs:CVE-2018-9372
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
In HWCSession::SetColorModeById of hwc_session.cpp, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed f...
CVEs:CVE-2018-9409
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
CVEs:CVE-2018-9409
CVEs:CVE-2017-13227
In the autofill service, the package name that is provided by the app process is trusted inappropriately. This could lead to information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CVEs:CVE-2017-13227
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
In BnAudioPolicyService::onTransact of AudioPolicyService.cpp, there is a possible information disclosure due to uninitialized data. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not...
CVEs:CVE-2018-9345
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
CVEs:CVE-2018-9345
In BnAudioPolicyService::onTransact of AudioPolicyService.cpp, there is a possible information disclosure due to uninitialized data. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not...
CVEs:CVE-2018-9346
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
CVEs:CVE-2018-9346
In bootloader there is fastboot command allowing user specified kernel command line arguments. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.
CVEs:CVE-2018-9369
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
CVEs:CVE-2018-9369
CVEs:CVE-2018-9344
In several functions of DescramblerImpl.cpp, there is a possible use after free due to improper locking. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVEs:CVE-2018-9344
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
Type confusion in JavaScript in Google Chrome prior to 67.0.3396.87 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page.
CVEs:CVE-2018-6149
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| chrome | affected | — | — |
CVEs:CVE-2018-6149
Incorrect implementation in Content Security Policy in Google Chrome prior to 67.0.3396.79 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.
CVEs:CVE-2018-6148
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| chrome | affected | — | — |
CVEs:CVE-2018-6148
In the WCD CPE codec, a Use After Free condition can occur in all Android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the Linux kernel.
CVEs:CVE-2018-5857
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
CVEs:CVE-2018-5857
CVEs:CVE-2018-5863
If userspace provides a too-large WPA RSN IE length in wlan_hdd_cfg80211_set_ie(), a buffer overflow occurs in all Android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the Linux kernel.
CVEs:CVE-2018-5863
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
In the MDSS driver in all Android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the Linux kernel, a data structure may be used without being initialized correctly.
CVEs:CVE-2018-5860
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
CVEs:CVE-2018-5860
Security update for SUSE Manager Server 3.1
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| cobbler | affected | SUSE:Manager Server 3.1 | cobbler | — |
| google-gson | affected | SUSE:Manager Server 3.1 | google-gson | — |
| patterns-suse-manager | affected | SUSE:Manager Server 3.1 | patterns-suse-manager | — |
| prometheus-client-java | affected | SUSE:Manager Server 3.1 | prometheus-client-java | — |
| py26-compat-salt | affected | SUSE:Manager Server 3.1 | py26-compat-salt | — |
| salt-netapi-client | affected | SUSE:Manager Server 3.1 | salt-netapi-client | — |
| spacewalk-backend | affected | SUSE:Manager Server 3.1 | spacewalk-backend | — |
| spacewalk-branding | affected | SUSE:Manager Server 3.1 | spacewalk-branding | — |
| spacewalk-certs-tools | affected | SUSE:Manager Server 3.1 | spacewalk-certs-tools | — |
| spacewalk-java | affected | SUSE:Manager Server 3.1 | spacewalk-java | — |
| spacewalk-utils | affected | SUSE:Manager Server 3.1 | spacewalk-utils | — |
| spacewalk-web | affected | SUSE:Manager Server 3.1 | spacewalk-web | — |
| susemanager | affected | SUSE:Manager Server 3.1 | susemanager | — |
| susemanager-docs_en | affected | SUSE:Manager Server 3.1 | susemanager-docs_en | — |
| susemanager-frontend-libs | affected | SUSE:Manager Server 3.1 | susemanager-frontend-libs | — |
| susemanager-schema | affected | SUSE:Manager Server 3.1 | susemanager-schema | — |
| susemanager-sls | affected | SUSE:Manager Server 3.1 | susemanager-sls | — |
| susemanager-sync-data | affected | SUSE:Manager Server 3.1 | susemanager-sync-data | — |
| susemanager-tftpsync | affected | SUSE:Manager Server 3.1 | susemanager-tftpsync | — |
Downloads Resources over HTTP in google-closure-tools-latest
CVEs:CVE-2016-10677
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| google-closure-tools-latest | affected | npm | google-closure-tools-latest | — |
Downloads Resources over HTTP in google-closure-tools-latest
CVEs:CVE-2016-10677
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| google-closure-tools-latest | affected | npm | google-closure-tools-latest | — |
google-closure-tools-latest is a Node.js module wrapper for downloading the latest version of the Google Closure tools google-closure-tools-latest downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to c...
CVEs:CVE-2016-10677
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| google-closure-tools-latest | affected | google-closure-tools-latest_project | — | — |
DEBIAN-CVE-2018-1002100
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| kubernetes | affected | Debian:11 | kubernetes | — |
| kubernetes | affected | Debian:12 | kubernetes | — |
| kubernetes | affected | Debian:13 | kubernetes | — |
| kubernetes | affected | Debian:14 | kubernetes | — |
Kubernetes arbitrary file overwrite
CVEs:CVE-2018-1002100
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| kubernetes | affected | k8s.io | k8s.io/kubernetes | — |
Kubernetes arbitrary file overwrite
CVEs:CVE-2018-1002100
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| kubernetes | affected | k8s.io | k8s.io/kubernetes | — |
In Kubernetes versions 1.5.x, 1.6.x, 1.7.x, 1.8.x, and prior to version 1.9.6, the kubectl cp command insecurely handles tar data returned from the container, and can be caused to overwrite arbitrary local files.
CVEs:CVE-2018-1002100
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| kubernetes | affected | kubernetes | — | — |
A exposure of sensitive information vulnerability exists in Jenkins Kubernetes Plugin 1.7.0 and older in ContainerExecDecorator.java that results in sensitive variables such as passwords being written to logs.
CVEs:CVE-2018-1000187
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| kubernetes | affected | jenkins | — | — |
Exposure of Sensitive Information in Jenkins Kubernetes Plugin
CVEs:CVE-2018-1000187
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| org.csanchez.jenkins.plugins:kubernetes | affected | Maven | org.csanchez.jenkins.plugins:kubernetes | — |
Auth0 angular-jwt before 0.1.10 treats whiteListedDomains entries as regular expressions, which allows remote attackers with knowledge of the jwtInterceptorProvider.whiteListedDomains setting to bypass the domain whitelist filter via a crafted domain.
CVEs:CVE-2018-11537
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| angular-jwt | affected | auth0 | — | — |
Auth0 angular-jwt misinterprets allowlist as regex
CVEs:CVE-2018-11537
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| angular-jwt | affected | npm | angular-jwt | — |
Auth0 angular-jwt misinterprets allowlist as regex
CVEs:CVE-2018-11537
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| angular-jwt | affected | npm | angular-jwt | — |
CVEs:CVE-2018-12716
The API service on Google Home and Chromecast devices before mid-July 2018 does not prevent DNS rebinding attacks from reading the scan_results JSON data, which allows remote attackers to determine the physical location of most web browsers by leveragi...
CVEs:CVE-2018-12716
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| chromecast_firmware | affected | — | — | |
| home_firmware | affected | — | — |
Downloads Resources over HTTP in node-bsdiff-android
CVEs:CVE-2016-10641
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| node-bsdiff-android | affected | npm | node-bsdiff-android | — |
node-bsdiff-android downloads resources over HTTP, which leaves it vulnerable to MITM attacks.
CVEs:CVE-2016-10641
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| node-bsdiff-android | affected | node-bsdiff-android_project | — | — |
Downloads Resources over HTTP in node-bsdiff-android
CVEs:CVE-2016-10641
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| node-bsdiff-android | affected | npm | node-bsdiff-android | — |
An issue was discovered in Google Santa and molcodesignchecker. A maliciously crafted Universal/fat binary can evade third-party code signing checks. By not completing full inspection of the Universal/fat binary, the user of the third-party tool will b...
CVEs:CVE-2018-10405
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| santa | affected | — | — |
CVEs:CVE-2018-10405
CVEs:CVE-2017-18169
User process can perform the kernel DOS in ashmem when doing cache maintenance operation in all Android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the Linux kernel.
CVEs:CVE-2017-18169
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| android | affected | — | — |
CVEs:CVE-2018-12440
BoringSSL through 2018-06-14 allows a memory-cache side-channel attack on DSA signatures, aka the Return Of the Hidden Number Problem or ROHNP. To discover a DSA key, the attacker needs access to either the local machine or a different virtual machine ...
CVEs:CVE-2018-12440
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| boringssl | affected | — | — |
Every CVE above is indexed in the Vulnetix VDB with KEV, EPSS, and PoC maturity. The interactive page surfaces that on hover.