CVEs published June 4, 2018
136 CVEs were published on June 4, 2018: 0 critical, 3 high.
- Published
- 136
- Critical
- 0
- High
- 3
- Medium
- 1
- Low
- 2
- Unrated
- 130
- Now in CISA KEV
- 0
- Fix available
- 35
Most affected products
- org.bouncycastle:bcprov-jdk14 · org.bouncycastle:bcprov-… +1
- 9
- GE MDS PulseNET and MDS PulseNET Enterprise
- 3
- HackerOne html-janitor node module · html-janitor
- 2
- HackerOne sanitize-html node module · sanitize-html
- 2
- HackerOne ag-grid node module · ag-grid
- 1
- HackerOne alto-saxophone node module · alto-saxophone
- 1
- HackerOne arcanist node module · arcanist
- 1
- HackerOne augustine node module · augustine
- 1
- HackerOne badjs-sourcemap-server node module · badjs-source…
- 1
- HackerOne clang-extra node module · clang-extra
- 1
High 3
- CVE-2018-3853An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Software Foxit PDF Reader version 9.0.1.1049.Talos Foxit
- CVE-2016-8390An exploitable out of bounds write vulnerability exists in the parsing of ELF Section Headers of Hopper Disassembler 3.11.20.Talos Hopper
- CVE-2018-1600IBM BigFix Platform 9.2 and 9.5 transmits sensitive or security-critical data in clear text in a communication channel that can be sniffed bIBM BigFix Platform
Medium, low and unrated 133
- CVE-2016-1000344In the Bouncy Castle JCE Provider version 1.55 and earlier the DHIES implementation allowed the use of ECB mode.org.bouncycastle:bcprov-jdk14 · org.bouncycastle:bcprov-… +1
- CVE-2016-1000345In the Bouncy Castle JCE Provider version 1.55 and earlier the DHIES/ECIES CBC mode vulnerable to padding oracle attack.org.bouncycastle:bcprov-jdk14 · org.bouncycastle:bcprov-… +1
- CVE-2016-1000346In the Bouncy Castle JCE Provider version 1.55 and earlier the other party DH public key is not fully validated.org.bouncycastle:bcprov-jdk14 · org.bouncycastle:bcprov-… +1
- CVE-2016-1000352In the Bouncy Castle JCE Provider version 1.55 and earlier the ECIES implementation allowed the use of ECB mode.org.bouncycastle:bcprov-jdk14 · org.bouncycastle:bcprov-… +1
- CVE-2016-9042An exploitable denial of service vulnerability exists in the origin timestamp check functionality of ntpd 4.2.8p9.Talos Network Time Protocol
- CVE-2017-12092An exploitable file write vulnerability exists in the memory module functionality of Allen Bradley Micrologix 1400 Series B FRN 21.2 and befTalos Allen Bradley
- CVE-2016-10695The npm-test-sqlite3-trunk module provides asynchronous, non-blocking SQLite3 bindings.HackerOne npm-test-sqlite3-trunk node module · npm-test-sql…
- CVE-2016-10696windows-latestchromedriver downloads the latest version of chromedriver.exe.HackerOne windows-latestchromedriver node module · windows-…
- CVE-2016-10697react-native-baidu-voice-synthesizer is a baidu voice speech synthesizer for react native.HackerOne react-native-baidu-voice-synthesizer node module…
- CVE-2017-0928html-janitor node module suffers from an External Control of Critical State Data vulnerability via user-control of the '_sanitized' variableHackerOne html-janitor node module · html-janitor
- CVE-2017-0930augustine node module suffers from a Path Traversal vulnerability due to lack of validation of url, which allows a malicious user to read coHackerOne augustine node module · augustine
- CVE-2017-0931html-janitor node module suffers from a Cross-Site Scripting (XSS) vulnerability via clean() accepting user-controlled values.HackerOne html-janitor node module · html-janitor
- CVE-2017-16005Http-signature is a "Reference implementation of Joyent's HTTP Signature Scheme".HackerOne http-signature node module · http-signature
- CVE-2017-16006Remarkable is a markdown parser.HackerOne remarkable node module · remarkable
- CVE-2017-16007node-jose is a JavaScript implementation of the JSON Object Signing and Encryption (JOSE) for current web browsers and node.js-based serversHackerOne node-jose node module · node-jose
- CVE-2017-16008i18next is a language translation framework.HackerOne i18next node module · i18next
- CVE-2017-16009ag-grid is an advanced data grid that is library agnostic.HackerOne ag-grid node module · ag-grid
- CVE-2017-16013hapi is a web and services application framework.HackerOne hapi node module · hapi
- CVE-2017-16014Http-proxy is a proxying library.HackerOne http-proxy node module · http-proxy
- CVE-2017-16015Forms is a library for easily creating HTML forms.HackerOne forms node module · forms
- CVE-2017-16016Sanitize-html is a library for scrubbing html input of malicious values.HackerOne sanitize-html node module · sanitize-html
- CVE-2017-16017sanitize-html is a library for scrubbing html input for malicious values Versions 1.2.2 and below have a cross site scripting vulnerability.HackerOne sanitize-html node module · sanitize-html
- CVE-2017-16018Restify is a framework for building REST APIs.HackerOne restify node module · restify
- CVE-2017-16019GitBook is a command line tool (and Node.js library) for building beautiful books using GitHub/Git and Markdown (or AsciiDoc).HackerOne gitbook node module · gitbook
- CVE-2017-16020Summit is a node web framework.HackerOne summit node module · summit
- CVE-2017-16021uri-js is a module that tries to fully implement RFC 3986.HackerOne uri-js node module · uri-js
- CVE-2017-16022Morris.js creates an svg graph, with labels that appear when hovering over a point.HackerOne Morris.js node module · morris.js
- CVE-2017-16023Decamelize is used to convert a dash/dot/underscore/space separated string to camelCase.HackerOne decamelize node module · decamelize
- CVE-2017-16024The sync-exec module is used to simulate child_process.execSync in node versions <0.11.9.HackerOne sync-exec node module · sync-exec
- CVE-2017-16025Nes is a websocket extension library for hapi.HackerOne nes node module · nes
- CVE-2017-16026Request is an http client.HackerOne request node module · request
- CVE-2017-16028react-native-meteor-oauth is a library for Oauth2 login to a Meteor server in React Native.HackerOne react-native-meteor-oauth node module · randomatic
- CVE-2017-16029hostr is a simple web server that serves up the contents of the current directory.HackerOne hostr node module · hostr
- CVE-2017-16030Useragent is used to parse useragent headers.HackerOne useragent node module · useragent
- CVE-2017-16031Socket.io is a realtime application framework that provides communication via websockets.HackerOne socket.io node module · socket.io
- CVE-2017-16035The hubl-server module is a wrapper for the HubL Development Server.HackerOne hubl-server node module · hubl-server
- CVE-2017-16036`badjs-sourcemap-server` receives files sent by `badjs-sourcemap`.HackerOne badjs-sourcemap-server node module · badjs-source…
- CVE-2017-16037`gomeplus-h5-proxy` is vulnerable to a directory traversal issue, allowing attackers to access any file in the system by placing '../' in thHackerOne gomeplus-h5-proxy node module · gomeplus-h5-proxy
- CVE-2017-16038`f2e-server` 1.12.11 and earlier is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" HackerOne f2e-server node module · f2e-server
- CVE-2017-16039`hftp` is a static http or ftp server `hftp` is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by plHackerOne hftp node module · hftp
- CVE-2017-16040gfe-sass is a library for promises (CommonJS/Promises/A,B,D) gfe-sass downloads resources over HTTP, which leaves it vulnerable to MITM attaHackerOne gfe-sass node module · gfe-sass
- CVE-2017-16041ikst versions before 1.1.2 download resources over HTTP, which leaves it vulnerable to MITM attacks.HackerOne ikst node module · ikst
- CVE-2017-16042Growl adds growl notification support to nodejs.HackerOne growl node module · growl
- CVE-2017-16043Shout is an IRC client.HackerOne shout node module · shout
- CVE-2017-16044`d3.js` was a malicious module published with the intent to hijack environment variables.HackerOne d3.js node module · d3.js
- CVE-2017-16045`jquery.js` was a malicious module published with the intent to hijack environment variables.HackerOne jquery.js node module · jquery.js
- CVE-2017-16046`mariadb` was a malicious module published with the intent to hijack environment variables.HackerOne mariadb node module
- CVE-2017-16048`node-sqlite` was a malicious module published with the intent to hijack environment variables.HackerOne node-sqlite node module · node-sqlite
- CVE-2017-16049`nodesqlite` was a malicious module published with the intent to hijack environment variables.HackerOne nodesqlite node module · nodesqlite
- CVE-2017-16050`sqlite.js` was a malicious module published with the intent to hijack environment variables.HackerOne sqlite.js node module · sqlite.js
- CVE-2017-16051`sqliter` was a malicious module published with the intent to hijack environment variables.HackerOne sqliter node module · sqliter
- CVE-2017-16052`node-fabric` was a malicious module published with the intent to hijack environment variables.HackerOne node-fabric node module · node-fabric
- CVE-2017-16053`fabric-js` was a malicious module published with the intent to hijack environment variables.HackerOne fabric-js node module · fabric-js
- CVE-2017-16054`nodefabric` was a malicious module published with the intent to hijack environment variables.HackerOne nodefabric node module · nodefabric
- CVE-2017-16055`sqlserver` was a malicious module published with the intent to hijack environment variables.HackerOne sqlserver node module · sqlserver
- CVE-2017-1748IBM Connections 5.0, 5.5, and 6.0 could allow a remote attacker to conduct phishing attacks, using an open redirect attack.IBM Connections
- CVE-2018-11715The Recent Threads plugin before 1.1 for MyBB allows XSS via a thread subject.
- CVE-2016-10636grunt-ccompiler is a Closure Compiler Grunt Plugin.HackerOne grunt-ccompiler node module · grunt-ccompiler
- CVE-2016-10637haxe-dev is a cross-platform toolkit.HackerOne haxe-dev node module · haxe-dev
- CVE-2016-10638js-given is a JavaScript frontend to jgiven.HackerOne js-given node module · js-given
- CVE-2016-10639redis-srvr is a npm wrapper for redis-server.HackerOne redis-srvr node module · redis-srvr
- CVE-2016-10640node-thulac is a node binding for thulac.HackerOne node-thulac node module · node-thulac
- CVE-2016-10641node-bsdiff-android downloads resources over HTTP, which leaves it vulnerable to MITM attacks.HackerOne node-bsdiff-android node module · node-bsdiff-and…
- CVE-2016-10642cmake installs the cmake x86 linux binaries.HackerOne cmake node module · cmake
- CVE-2016-10643jstestdriver is a wrapper for Google's jstestdriver.HackerOne jstestdriver node module · jstestdriver
- CVE-2016-10644slimerjs-edge is a npm wrapper for installing the bleeding edge version of slimerjs.HackerOne slimerjs-edge node module · slimerjs-edge
- CVE-2016-10645grunt-images is a grunt plugin for processing images.HackerOne grunt-images node module · grunt-images
- CVE-2016-10646resourcehacker is a Node wrapper of Resource Hacker (windows executable resource editor).HackerOne resourcehacker node module · resourcehacker
- CVE-2016-10647node-air-sdk is an AIR SDK for nodejs.HackerOne node-air-sdk node module · node-air-sdk
- CVE-2016-10648marionette-socket-host is a marionette-js-runner host for sending actions over a socket.HackerOne marionette-socket-host node module · marionette-s…
- CVE-2016-10649frames-compiler downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks.HackerOne frames-compiler node module · frames-compiler
- CVE-2016-10651webdriver-launcher is a Node.js Selenium Webdriver Launcher.HackerOne webdriver-launcher node module · webdriver-launch…
- CVE-2016-10652prebuild-lwip is a module for comprehensive, fast, and simple image processing and manipulation.HackerOne prebuild-lwip node module · prebuild-lwip
- CVE-2016-10653xd-testing is a testing library for cross-device (XD) web applications.HackerOne xd-testing node module · xd-testing
- CVE-2016-10654sfml downloads resources over HTTP, which leaves it vulnerable to MITM attacks.HackerOne sfml node module · sfml
- CVE-2016-10655The clang-extra module installs LLVM's clang-extra tools.HackerOne clang-extra node module · clang-extra
- CVE-2016-10656qbs is a build tool that helps simplify the build process for developing projects across multiple platforms.HackerOne qbs node module · qbs
- CVE-2016-10657co-cli-installer downloads the co-cli module as part of the install process, but does so over HTTP, which leaves it vulnerable to MITM attacHackerOne co-cli-installer node module · co-cli-installer
- CVE-2016-10660fis-parser-sass-bin a plugin for fis to compile sass using node-sass-binaries.HackerOne fis-parser-sass-bin node module · fis-parser-sass…
- CVE-2016-10661phantomjs-cheniu is a Headless WebKit with JS API phantomjs-cheniu downloads binary resources over HTTP, which leaves it vulnerable to MITM HackerOne phantomjs-cheniu node module · phantomjs-cheniu
- CVE-2016-10662tomita is a node wrapper for Yandex Tomita Parser tomita downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks.HackerOne tomita node module · tomita
- CVE-2016-10663wixtoolset is a Node module wrapper around the wixtoolset binaries wixtoolset downloads binary resources over HTTP, which leaves it vulnerabHackerOne wixtoolset node module · wixtoolset
- CVE-2016-10664mystem is a Node.js wrapper for MyStem morphology text analyzer by Yandex.ru mystem downloads binary resources over HTTP, which leaves it vuHackerOne mystem node module · mystem
- CVE-2016-10665herbivore is a packet sniffing and crafting library.HackerOne herbivore node module · herbivore
- CVE-2016-10667selenium-portal is a Selenium Testing Framework selenium-portal downloads binary resources over HTTP, which leaves it vulnerable to MITM attHackerOne selenium-portal node module · selenium-portal
- CVE-2016-10668libsbml is a module that installs Linux binaries for libSBML libsbml downloads resources over HTTP, which leaves it vulnerable to MITM attacHackerOne libsbml node module · libsbml
- CVE-2016-10669soci downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks.HackerOne soci node module · soci
- CVE-2016-10670windows-seleniumjar-mirror downloads the Selenium Jar file windows-seleniumjar-mirror downloads binary resources over HTTP, which leaves it HackerOne windows-seleniumjar-mirror node module · windows-…
- CVE-2016-10671mystem-wrapper is a Yandex mystem app wrapper module.HackerOne mystem-wrapper node module · mystem-wrapper
- CVE-2016-10672cloudpub-redis is a module for CloudPub: Redis Backend cloudpub-redis downloads binary resources over HTTP, which leaves it vulnerable to MIHackerOne cloudpub-redis node module · cloudpub-redis
- CVE-2016-10673ipip-coffee queries geolocation information from IP ipip-coffee downloads geolocation resources over HTTP, which leaves it vulnerable to MITHackerOne ipip-coffee node module · ipip-coffee
- CVE-2016-10675libsbmlsim is a module that installs linux binaries for libsbmlsim libsbmlsim downloads binary resources over HTTP, which leaves it vulnerabHackerOne libsbmlsim node module · libsbmlsim
- CVE-2016-10676rs-brightcove is a wrapper around brightcove's web api rs-brightcove downloads source file resources over HTTP, which leaves it vulnerable tHackerOne rs-brightcove node module · rs-brightcove
- CVE-2016-10677google-closure-tools-latest is a Node.js module wrapper for downloading the latest version of the Google Closure tools google-closure-tools-HackerOne google-closure-tools-latest node module · google-…
- CVE-2016-10678serc.js is a Selenium RC process wrapper serc.js downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks.HackerOne serc.js node module · serc.js
- CVE-2016-10683arcanist downloads resources over HTTP, which leaves it vulnerable to MITM attacks.HackerOne arcanist node module · arcanist
- CVE-2016-10684healthcenter - IBM Monitoring and Diagnostic Tools health Center agent healthcenter downloads binary resources over HTTP, which leaves it vuHackerOne healthcenter node module · healthcenter
- CVE-2016-10685pk-app-wonderbox is an integration with wonderbox pk-app-wonderbox downloads binary resources over HTTP, which leaves it vulnerable to MITM HackerOne pk-app-wonderbox node module · pk-app-wonderbox
- CVE-2016-10686fis-sass-all is another libsass wrapper for node.HackerOne fis-sass-all node module · fis-sass-all
- CVE-2016-10687windows-selenium-chromedriver is a module that downloads the Selenium Jar file.HackerOne windows-selenium-chromedriver node module · windo…
- CVE-2016-10688Haxe 3 : The Cross-Platform Toolkit (a fork from David Mouton's damoebius/haxe-npm) haxe3 downloads resources over HTTP, which leaves it vulHackerOne haxe3 node module · haxe3
- CVE-2016-10689The windows-iedriver module downloads fixed version of iedriverserver.exe windows-iedriver downloads binary resources over HTTP, which leaveHackerOne windows-iedriver node module · windows-iedriver
- CVE-2016-10690openframe-ascii-image module is an openframe plugin which adds support for ascii images via fim.HackerOne openframe-ascii-image node module · openframe-asc…
- CVE-2016-10691windows-seleniumjar is a module that downloads the Selenium Jar file windows-seleniumjar downloads binary resources over HTTP, which leaves HackerOne windows-seleniumjar node module · windows-seleniu…
- CVE-2016-10692haxeshim haxe shim to deal with coexisting versions.haxeshim
- CVE-2016-10693pm2-kafka is a PM2 module that installs and runs a kafka server pm2-kafka downloads binary resources over HTTP, which leaves it vulnerable tHackerOne pm2-kafka node module · pm2-kafka
- CVE-2016-10694alto-saxophone is a module to install and launch Chromedriver for Mac, Linux or Windows.HackerOne alto-saxophone node module · alto-saxophone
- CVE-2018-10611Java remote method invocation (RMI) input port in GE MDS PulseNET and MDS PulseNET Enterprise version 3.2.1 and prior may be exploited to alGE MDS PulseNET and MDS PulseNET Enterprise
- CVE-2018-10613Multiple variants of XML External Entity (XXE) attacks may be used to exfiltrate data from the host Windows platform in GE MDS PulseNET and GE MDS PulseNET and MDS PulseNET Enterprise
- CVE-2018-10615Directory traversal may lead to files being exfiltrated or deleted on the GE MDS PulseNET and MDS PulseNET Enterprise version 3.2.1 and prioGE MDS PulseNET and MDS PulseNET Enterprise
- CVE-2018-11712WebCore/platform/network/soup/SocketStreamHandleImplSoup.cpp in the libsoup network backend of WebKit, as used in WebKitGTK+ versions 2.20.0
- CVE-2018-11713WebCore/platform/network/soup/SocketStreamHandleImplSoup.cpp in the libsoup network backend of WebKit, as used in WebKitGTK+ prior to versio
- CVE-2018-11714An issue was discovered on TP-Link TL-WR840N v5 00000005 0.9.1 3.16 v0001.0 Build 170608 Rel.58696n and TL-WR841N v13 00000013 0.9.1 4.16 v0
- CVE-2016-1000339In the Bouncy Castle JCE Provider version 1.55 and earlier the primary engine class used for AES was AESFastEngine.org.bouncycastle:bcprov-jdk14 · org.bouncycastle:bcprov-… +1
- CVE-2016-1000340In the Bouncy Castle JCE Provider versions 1.51 to 1.55, a carry propagation bug was introduced in the implementation of squaring for severaorg.bouncycastle:bcprov-jdk14 · org.bouncycastle:bcprov-… +1
- CVE-2016-1000341In the Bouncy Castle JCE Provider version 1.55 and earlier DSA signature generation is vulnerable to timing attack.org.bouncycastle:bcprov-jdk14 · org.bouncycastle:bcprov-… +1
- CVE-2016-1000342In the Bouncy Castle JCE Provider version 1.55 and earlier ECDSA does not fully validate ASN.1 encoding of signature on verification.org.bouncycastle:bcprov-jdk14 · org.bouncycastle:bcprov-… +1
- CVE-2016-1000343In the Bouncy Castle JCE Provider version 1.55 and earlier the DSA key pair generator generates a weak private key if used with default valuorg.bouncycastle:bcprov-jdk14 · org.bouncycastle:bcprov-… +1
- CVE-2018-11709wpforo_get_request_uri in wpf-includes/functions.php in the wpForo Forum plugin before 1.4.12 for WordPress allows Unauthenticated Reflected
- CVE-2018-11710soundlib/pattern.h in libopenmpt before 0.3.9 allows remote attackers to cause a denial of service (application crash) or possibly have unsp
- CVE-2018-11711A remote attacker can bypass the System Manager Mode on the Canon MF210 and MF220 web interface without knowing the PIN for /login.html via
- CVE-2017-18284The Gentoo app-backup/burp package before 2.1.32 sets the ownership of the PID file directory to the burp account, which might allow local u
- CVE-2017-18285The Gentoo app-backup/burp package before 2.1.32 has incorrect group ownership of the /etc/burp directory, which might allow local users to
- CVE-2018-11683Liblouis 3.5.0 has a stack-based Buffer Overflow in the function parseChars in compileTranslationTable.c, a different vulnerability than CVE
- CVE-2018-11684Liblouis 3.5.0 has a stack-based Buffer Overflow in the function includeFile in compileTranslationTable.c.
- CVE-2018-11685Liblouis 3.5.0 has a stack-based Buffer Overflow in the function compileHyphenation in compileTranslationTable.c.
- CVE-2018-11692An issue was discovered on Canon LBP6650, LBP3370, LBP3460, and LBP7750C devices.
- CVE-2018-11693An issue was discovered in LibSass through 3.5.4.
- CVE-2018-11694An issue was discovered in LibSass through 3.5.4.
- CVE-2018-11695An issue was discovered in LibSass <3.5.3.
- CVE-2018-11696An issue was discovered in LibSass through 3.5.4.
- CVE-2018-11697An issue was discovered in LibSass through 3.5.4.
- CVE-2018-11698An issue was discovered in LibSass through 3.5.4.