CVEs published June 4, 2018
136 CVEs were published on June 4, 2018: 0 critical, 3 high. Browse them by severity, product and exploitation status.
- Published
- 136
- Critical
- 0
- High
- 3
- Medium
- 1
- Low
- 2
- Unrated
- 130
- Now in CISA KEV
- 0
- Fix available
- 35
Most affected products
- org.bouncycastle:bcprov-jdk14 · org.bouncycastle:bcprov-… +1
- 9
- GE MDS PulseNET and MDS PulseNET Enterprise
- 3
- HackerOne html-janitor node module · html-janitor
- 2
- HackerOne sanitize-html node module · sanitize-html
- 2
- HackerOne ag-grid node module · ag-grid
- 1
- HackerOne alto-saxophone node module · alto-saxophone
- 1
- HackerOne arcanist node module · arcanist
- 1
- HackerOne augustine node module · augustine
- 1
- HackerOne badjs-sourcemap-server node module · badjs-source…
- 1
- HackerOne clang-extra node module · clang-extra
- 1
High 3
- CVE-2018-3853An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Software Foxit PDF Reader version 9.0.1.1049.Talos Foxit
- CVE-2016-8390An exploitable out of bounds write vulnerability exists in the parsing of ELF Section Headers of Hopper Disassembler 3.11.20.Talos Hopper
- CVE-2018-1600IBM BigFix Platform 9.2 and 9.5 transmits sensitive or security-critical data in clear text in a communication channel that can be sniffed…IBM BigFix Platform
Medium, low and unrated 133
- CVE-2016-1000344In the Bouncy Castle JCE Provider version 1.55 and earlier the DHIES implementation allowed the use of ECB mode.org.bouncycastle:bcprov-jdk14 · org.bouncycastle:bcprov-… +1
- CVE-2016-1000345In the Bouncy Castle JCE Provider version 1.55 and earlier the DHIES/ECIES CBC mode vulnerable to padding oracle attack.org.bouncycastle:bcprov-jdk14 · org.bouncycastle:bcprov-… +1
- CVE-2016-1000346In the Bouncy Castle JCE Provider version 1.55 and earlier the other party DH public key is not fully validated.org.bouncycastle:bcprov-jdk14 · org.bouncycastle:bcprov-… +1
- CVE-2016-1000352In the Bouncy Castle JCE Provider version 1.55 and earlier the ECIES implementation allowed the use of ECB mode.org.bouncycastle:bcprov-jdk14 · org.bouncycastle:bcprov-… +1
- CVE-2016-9042An exploitable denial of service vulnerability exists in the origin timestamp check functionality of ntpd 4.2.8p9.Talos Network Time Protocol
- CVE-2017-12092An exploitable file write vulnerability exists in the memory module functionality of Allen Bradley Micrologix 1400 Series B FRN 21.2 and…Talos Allen Bradley
- CVE-2016-10695The npm-test-sqlite3-trunk module provides asynchronous, non-blocking SQLite3 bindings.HackerOne npm-test-sqlite3-trunk node module · npm-test-sql…
- CVE-2016-10696windows-latestchromedriver downloads the latest version of chromedriver.exe.HackerOne windows-latestchromedriver node module · windows-…
- CVE-2016-10697react-native-baidu-voice-synthesizer is a baidu voice speech synthesizer for react native.HackerOne react-native-baidu-voice-synthesizer node module…
- CVE-2017-0928html-janitor node module suffers from an External Control of Critical State Data vulnerability via user-control of the '_sanitized'…HackerOne html-janitor node module · html-janitor
- CVE-2017-0930augustine node module suffers from a Path Traversal vulnerability due to lack of validation of url, which allows a malicious user to read…HackerOne augustine node module · augustine
- CVE-2017-0931html-janitor node module suffers from a Cross-Site Scripting (XSS) vulnerability via clean() accepting user-controlled values.HackerOne html-janitor node module · html-janitor
- CVE-2017-16005Http-signature is a "Reference implementation of Joyent's HTTP Signature Scheme".HackerOne http-signature node module · http-signature
- CVE-2017-16006Remarkable is a markdown parser.HackerOne remarkable node module · remarkable
- CVE-2017-16007node-jose is a JavaScript implementation of the JSON Object Signing and Encryption (JOSE) for current web browsers and node.js-based…HackerOne node-jose node module · node-jose
- CVE-2017-16008i18next is a language translation framework.HackerOne i18next node module · i18next
- CVE-2017-16009ag-grid is an advanced data grid that is library agnostic.HackerOne ag-grid node module · ag-grid
- CVE-2017-16013hapi is a web and services application framework.HackerOne hapi node module · hapi
- CVE-2017-16014Http-proxy is a proxying library.HackerOne http-proxy node module · http-proxy
- CVE-2017-16015Forms is a library for easily creating HTML forms.HackerOne forms node module · forms
- CVE-2017-16016Sanitize-html is a library for scrubbing html input of malicious values.HackerOne sanitize-html node module · sanitize-html
- CVE-2017-16017sanitize-html is a library for scrubbing html input for malicious values Versions 1.2.2 and below have a cross site scripting vulnerability.HackerOne sanitize-html node module · sanitize-html
- CVE-2017-16018Restify is a framework for building REST APIs.HackerOne restify node module · restify
- CVE-2017-16019GitBook is a command line tool (and Node.js library) for building beautiful books using GitHub/Git and Markdown (or AsciiDoc).HackerOne gitbook node module · gitbook
- CVE-2017-16020Summit is a node web framework.HackerOne summit node module · summit
Show all 133 entriesShow fewer entries
- CVE-2017-16021uri-js is a module that tries to fully implement RFC 3986.HackerOne uri-js node module · uri-js
- CVE-2017-16022Morris.js creates an svg graph, with labels that appear when hovering over a point.HackerOne Morris.js node module · morris.js
- CVE-2017-16023Decamelize is used to convert a dash/dot/underscore/space separated string to camelCase.HackerOne decamelize node module · decamelize
- CVE-2017-16024The sync-exec module is used to simulate child_process.execSync in node versions <0.11.9.HackerOne sync-exec node module · sync-exec
- CVE-2017-16025Nes is a websocket extension library for hapi.HackerOne nes node module · nes
- CVE-2017-16026Request is an http client.HackerOne request node module · request
- CVE-2017-16028react-native-meteor-oauth is a library for Oauth2 login to a Meteor server in React Native.HackerOne react-native-meteor-oauth node module · randomatic
- CVE-2017-16029hostr is a simple web server that serves up the contents of the current directory.HackerOne hostr node module · hostr
- CVE-2017-16030Useragent is used to parse useragent headers.HackerOne useragent node module · useragent
- CVE-2017-16031Socket.io is a realtime application framework that provides communication via websockets.HackerOne socket.io node module · socket.io
- CVE-2017-16035The hubl-server module is a wrapper for the HubL Development Server.HackerOne hubl-server node module · hubl-server
- CVE-2017-16036`badjs-sourcemap-server` receives files sent by `badjs-sourcemap`.HackerOne badjs-sourcemap-server node module · badjs-source…
- CVE-2017-16037`gomeplus-h5-proxy` is vulnerable to a directory traversal issue, allowing attackers to access any file in the system by placing '../' in…HackerOne gomeplus-h5-proxy node module · gomeplus-h5-proxy
- CVE-2017-16038`f2e-server` 1.12.11 and earlier is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing…HackerOne f2e-server node module · f2e-server
- CVE-2017-16039`hftp` is a static http or ftp server `hftp` is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by…HackerOne hftp node module · hftp
- CVE-2017-16040gfe-sass is a library for promises (CommonJS/Promises/A,B,D) gfe-sass downloads resources over HTTP, which leaves it vulnerable to MITM…HackerOne gfe-sass node module · gfe-sass
- CVE-2017-16041ikst versions before 1.1.2 download resources over HTTP, which leaves it vulnerable to MITM attacks.HackerOne ikst node module · ikst
- CVE-2017-16042Growl adds growl notification support to nodejs.HackerOne growl node module · growl
- CVE-2017-16043Shout is an IRC client.HackerOne shout node module · shout
- CVE-2017-16044`d3.js` was a malicious module published with the intent to hijack environment variables.HackerOne d3.js node module · d3.js
- CVE-2017-16045`jquery.js` was a malicious module published with the intent to hijack environment variables.HackerOne jquery.js node module · jquery.js
- CVE-2017-16046`mariadb` was a malicious module published with the intent to hijack environment variables.HackerOne mariadb node module
- CVE-2017-16048`node-sqlite` was a malicious module published with the intent to hijack environment variables.HackerOne node-sqlite node module · node-sqlite
- CVE-2017-16049`nodesqlite` was a malicious module published with the intent to hijack environment variables.HackerOne nodesqlite node module · nodesqlite
- CVE-2017-16050`sqlite.js` was a malicious module published with the intent to hijack environment variables.HackerOne sqlite.js node module · sqlite.js
- CVE-2017-16051`sqliter` was a malicious module published with the intent to hijack environment variables.HackerOne sqliter node module · sqliter
- CVE-2017-16052`node-fabric` was a malicious module published with the intent to hijack environment variables.HackerOne node-fabric node module · node-fabric
- CVE-2017-16053`fabric-js` was a malicious module published with the intent to hijack environment variables.HackerOne fabric-js node module · fabric-js
- CVE-2017-16054`nodefabric` was a malicious module published with the intent to hijack environment variables.HackerOne nodefabric node module · nodefabric
- CVE-2017-16055`sqlserver` was a malicious module published with the intent to hijack environment variables.HackerOne sqlserver node module · sqlserver
- CVE-2017-1748IBM Connections 5.0, 5.5, and 6.0 could allow a remote attacker to conduct phishing attacks, using an open redirect attack.IBM Connections
- CVE-2018-11715The Recent Threads plugin before 1.1 for MyBB allows XSS via a thread subject.
- CVE-2016-10636grunt-ccompiler is a Closure Compiler Grunt Plugin.HackerOne grunt-ccompiler node module · grunt-ccompiler
- CVE-2016-10637haxe-dev is a cross-platform toolkit.HackerOne haxe-dev node module · haxe-dev
- CVE-2016-10638js-given is a JavaScript frontend to jgiven.HackerOne js-given node module · js-given
- CVE-2016-10639redis-srvr is a npm wrapper for redis-server.HackerOne redis-srvr node module · redis-srvr
- CVE-2016-10640node-thulac is a node binding for thulac.HackerOne node-thulac node module · node-thulac
- CVE-2016-10641node-bsdiff-android downloads resources over HTTP, which leaves it vulnerable to MITM attacks.HackerOne node-bsdiff-android node module · node-bsdiff-and…
- CVE-2016-10642cmake installs the cmake x86 linux binaries.HackerOne cmake node module · cmake
- CVE-2016-10643jstestdriver is a wrapper for Google's jstestdriver.HackerOne jstestdriver node module · jstestdriver
- CVE-2016-10644slimerjs-edge is a npm wrapper for installing the bleeding edge version of slimerjs.HackerOne slimerjs-edge node module · slimerjs-edge
- CVE-2016-10645grunt-images is a grunt plugin for processing images.HackerOne grunt-images node module · grunt-images
- CVE-2016-10646resourcehacker is a Node wrapper of Resource Hacker (windows executable resource editor).HackerOne resourcehacker node module · resourcehacker
- CVE-2016-10647node-air-sdk is an AIR SDK for nodejs.HackerOne node-air-sdk node module · node-air-sdk
- CVE-2016-10648marionette-socket-host is a marionette-js-runner host for sending actions over a socket.HackerOne marionette-socket-host node module · marionette-s…
- CVE-2016-10649frames-compiler downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks.HackerOne frames-compiler node module · frames-compiler
- CVE-2016-10651webdriver-launcher is a Node.js Selenium Webdriver Launcher.HackerOne webdriver-launcher node module · webdriver-launch…
- CVE-2016-10652prebuild-lwip is a module for comprehensive, fast, and simple image processing and manipulation.HackerOne prebuild-lwip node module · prebuild-lwip
- CVE-2016-10653xd-testing is a testing library for cross-device (XD) web applications.HackerOne xd-testing node module · xd-testing
- CVE-2016-10654sfml downloads resources over HTTP, which leaves it vulnerable to MITM attacks.HackerOne sfml node module · sfml
- CVE-2016-10655The clang-extra module installs LLVM's clang-extra tools.HackerOne clang-extra node module · clang-extra
- CVE-2016-10656qbs is a build tool that helps simplify the build process for developing projects across multiple platforms.HackerOne qbs node module · qbs
- CVE-2016-10657co-cli-installer downloads the co-cli module as part of the install process, but does so over HTTP, which leaves it vulnerable to MITM…HackerOne co-cli-installer node module · co-cli-installer
- CVE-2016-10660fis-parser-sass-bin a plugin for fis to compile sass using node-sass-binaries.HackerOne fis-parser-sass-bin node module · fis-parser-sass…
- CVE-2016-10661phantomjs-cheniu is a Headless WebKit with JS API phantomjs-cheniu downloads binary resources over HTTP, which leaves it vulnerable to…HackerOne phantomjs-cheniu node module · phantomjs-cheniu
- CVE-2016-10662tomita is a node wrapper for Yandex Tomita Parser tomita downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks.HackerOne tomita node module · tomita
- CVE-2016-10663wixtoolset is a Node module wrapper around the wixtoolset binaries wixtoolset downloads binary resources over HTTP, which leaves it…HackerOne wixtoolset node module · wixtoolset
- CVE-2016-10664mystem is a Node.js wrapper for MyStem morphology text analyzer by Yandex.ru mystem downloads binary resources over HTTP, which leaves it…HackerOne mystem node module · mystem
- CVE-2016-10665herbivore is a packet sniffing and crafting library.HackerOne herbivore node module · herbivore
- CVE-2016-10667selenium-portal is a Selenium Testing Framework selenium-portal downloads binary resources over HTTP, which leaves it vulnerable to MITM…HackerOne selenium-portal node module · selenium-portal
- CVE-2016-10668libsbml is a module that installs Linux binaries for libSBML libsbml downloads resources over HTTP, which leaves it vulnerable to MITM…HackerOne libsbml node module · libsbml
- CVE-2016-10669soci downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks.HackerOne soci node module · soci
- CVE-2016-10670windows-seleniumjar-mirror downloads the Selenium Jar file windows-seleniumjar-mirror downloads binary resources over HTTP, which leaves…HackerOne windows-seleniumjar-mirror node module · windows-…
- CVE-2016-10671mystem-wrapper is a Yandex mystem app wrapper module.HackerOne mystem-wrapper node module · mystem-wrapper
- CVE-2016-10672cloudpub-redis is a module for CloudPub: Redis Backend cloudpub-redis downloads binary resources over HTTP, which leaves it vulnerable to…HackerOne cloudpub-redis node module · cloudpub-redis
- CVE-2016-10673ipip-coffee queries geolocation information from IP ipip-coffee downloads geolocation resources over HTTP, which leaves it vulnerable to…HackerOne ipip-coffee node module · ipip-coffee
- CVE-2016-10675libsbmlsim is a module that installs linux binaries for libsbmlsim libsbmlsim downloads binary resources over HTTP, which leaves it…HackerOne libsbmlsim node module · libsbmlsim
- CVE-2016-10676rs-brightcove is a wrapper around brightcove's web api rs-brightcove downloads source file resources over HTTP, which leaves it vulnerable…HackerOne rs-brightcove node module · rs-brightcove
- CVE-2016-10677google-closure-tools-latest is a Node.js module wrapper for downloading the latest version of the Google Closure tools…HackerOne google-closure-tools-latest node module · google-…
- CVE-2016-10678serc.js is a Selenium RC process wrapper serc.js downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks.HackerOne serc.js node module · serc.js
- CVE-2016-10683arcanist downloads resources over HTTP, which leaves it vulnerable to MITM attacks.HackerOne arcanist node module · arcanist
- CVE-2016-10684healthcenter - IBM Monitoring and Diagnostic Tools health Center agent healthcenter downloads binary resources over HTTP, which leaves it…HackerOne healthcenter node module · healthcenter
- CVE-2016-10685pk-app-wonderbox is an integration with wonderbox pk-app-wonderbox downloads binary resources over HTTP, which leaves it vulnerable to…HackerOne pk-app-wonderbox node module · pk-app-wonderbox
- CVE-2016-10686fis-sass-all is another libsass wrapper for node.HackerOne fis-sass-all node module · fis-sass-all
- CVE-2016-10687windows-selenium-chromedriver is a module that downloads the Selenium Jar file.HackerOne windows-selenium-chromedriver node module · windo…
- CVE-2016-10688Haxe 3 : The Cross-Platform Toolkit (a fork from David Mouton's damoebius/haxe-npm) haxe3 downloads resources over HTTP, which leaves it…HackerOne haxe3 node module · haxe3
- CVE-2016-10689The windows-iedriver module downloads fixed version of iedriverserver.exe windows-iedriver downloads binary resources over HTTP, which…HackerOne windows-iedriver node module · windows-iedriver
- CVE-2016-10690openframe-ascii-image module is an openframe plugin which adds support for ascii images via fim.HackerOne openframe-ascii-image node module · openframe-asc…
- CVE-2016-10691windows-seleniumjar is a module that downloads the Selenium Jar file windows-seleniumjar downloads binary resources over HTTP, which…HackerOne windows-seleniumjar node module · windows-seleniu…
- CVE-2016-10692haxeshim haxe shim to deal with coexisting versions.haxeshim
- CVE-2016-10693pm2-kafka is a PM2 module that installs and runs a kafka server pm2-kafka downloads binary resources over HTTP, which leaves it vulnerable…HackerOne pm2-kafka node module · pm2-kafka
- CVE-2016-10694alto-saxophone is a module to install and launch Chromedriver for Mac, Linux or Windows.HackerOne alto-saxophone node module · alto-saxophone
- CVE-2018-10611Java remote method invocation (RMI) input port in GE MDS PulseNET and MDS PulseNET Enterprise version 3.2.1 and prior may be exploited to…GE MDS PulseNET and MDS PulseNET Enterprise
- CVE-2018-10613Multiple variants of XML External Entity (XXE) attacks may be used to exfiltrate data from the host Windows platform in GE MDS PulseNET…GE MDS PulseNET and MDS PulseNET Enterprise
- CVE-2018-10615Directory traversal may lead to files being exfiltrated or deleted on the GE MDS PulseNET and MDS PulseNET Enterprise version 3.2.1 and…GE MDS PulseNET and MDS PulseNET Enterprise
- CVE-2018-11712WebCore/platform/network/soup/SocketStreamHandleImplSoup.cpp in the libsoup network backend of WebKit, as used in WebKitGTK+ versions…
- CVE-2018-11713WebCore/platform/network/soup/SocketStreamHandleImplSoup.cpp in the libsoup network backend of WebKit, as used in WebKitGTK+ prior to…
- CVE-2018-11714An issue was discovered on TP-Link TL-WR840N v5 00000005 0.9.1 3.16 v0001.0 Build 170608 Rel.58696n and TL-WR841N v13 00000013 0.9.1 4.16…
- CVE-2016-1000339In the Bouncy Castle JCE Provider version 1.55 and earlier the primary engine class used for AES was AESFastEngine.org.bouncycastle:bcprov-jdk14 · org.bouncycastle:bcprov-… +1
- CVE-2016-1000340In the Bouncy Castle JCE Provider versions 1.51 to 1.55, a carry propagation bug was introduced in the implementation of squaring for…org.bouncycastle:bcprov-jdk14 · org.bouncycastle:bcprov-… +1
- CVE-2016-1000341In the Bouncy Castle JCE Provider version 1.55 and earlier DSA signature generation is vulnerable to timing attack.org.bouncycastle:bcprov-jdk14 · org.bouncycastle:bcprov-… +1
- CVE-2016-1000342In the Bouncy Castle JCE Provider version 1.55 and earlier ECDSA does not fully validate ASN.1 encoding of signature on verification.org.bouncycastle:bcprov-jdk14 · org.bouncycastle:bcprov-… +1
- CVE-2016-1000343In the Bouncy Castle JCE Provider version 1.55 and earlier the DSA key pair generator generates a weak private key if used with default…org.bouncycastle:bcprov-jdk14 · org.bouncycastle:bcprov-… +1
- CVE-2018-11709wpforo_get_request_uri in wpf-includes/functions.php in the wpForo Forum plugin before 1.4.12 for WordPress allows Unauthenticated…
- CVE-2018-11710soundlib/pattern.h in libopenmpt before 0.3.9 allows remote attackers to cause a denial of service (application crash) or possibly have…
- CVE-2018-11711A remote attacker can bypass the System Manager Mode on the Canon MF210 and MF220 web interface without knowing the PIN for /login.html…
- CVE-2017-18284The Gentoo app-backup/burp package before 2.1.32 sets the ownership of the PID file directory to the burp account, which might allow local…
- CVE-2017-18285The Gentoo app-backup/burp package before 2.1.32 has incorrect group ownership of the /etc/burp directory, which might allow local users…
- CVE-2018-11683Liblouis 3.5.0 has a stack-based Buffer Overflow in the function parseChars in compileTranslationTable.c, a different vulnerability than…
- CVE-2018-11684Liblouis 3.5.0 has a stack-based Buffer Overflow in the function includeFile in compileTranslationTable.c.
- CVE-2018-11685Liblouis 3.5.0 has a stack-based Buffer Overflow in the function compileHyphenation in compileTranslationTable.c.
- CVE-2018-11692An issue was discovered on Canon LBP6650, LBP3370, LBP3460, and LBP7750C devices.
- CVE-2018-11693An issue was discovered in LibSass through 3.5.4.
- CVE-2018-11694An issue was discovered in LibSass through 3.5.4.
- CVE-2018-11695An issue was discovered in LibSass <3.5.3.
- CVE-2018-11696An issue was discovered in LibSass through 3.5.4.
- CVE-2018-11697An issue was discovered in LibSass through 3.5.4.
- CVE-2018-11698An issue was discovered in LibSass through 3.5.4.