CVEs published January 9, 2019
196 CVEs were published on January 9, 2019: 0 critical, 3 high.
- Published
- 196
- Critical
- 0
- High
- 3
- Medium
- 0
- Low
- 0
- Unrated
- 193
- Now in CISA KEV
- 0
- Fix available
- 113
Most affected products
- Google Chrome
- 84
- NEC HC100RC
- 8
- NEC Aterm W300P
- 5
- org.jenkins-ci.main:jenkins-core
- 5
- RICOH COMPANY RICOH Interactive Whiteboard
- 5
- Toshiba Lighting & Technology Toshiba Home gateway HEM-GW16…
- 5
- Cybozu Remote Service
- 4
- JPCERT Coordination Center LogonTracer
- 4
- MICRONET INplc-RT
- 4
- NEC Aterm WF1200CR and Aterm WG1200CR
- 4
High 3
Medium, low and unrated 193
- CVE-2016-10736The "Social Pug - Easy Social Share Buttons" plugin before 1.2.6 for WordPress allows XSS via the wp-admin/admin.php?page=dpsp-toolkit dpsp_
- CVE-2018-1000406A path traversal vulnerability exists in Jenkins 2.145 and earlier, LTS 2.138.1 and earlier in core/src/main/java/hudson/model/FileParameterorg.jenkins-ci.main:jenkins-core
- CVE-2018-1000407A cross-site scripting vulnerability exists in Jenkins 2.145 and earlier, LTS 2.138.1 and earlier in core/src/main/java/hudson/model/Api.javorg.jenkins-ci.main:jenkins-core
- CVE-2018-1000408A denial of service vulnerability exists in Jenkins 2.145 and earlier, LTS 2.138.1 and earlier in core/src/main/java/hudson/security/HudsonPorg.jenkins-ci.main:jenkins-core
- CVE-2018-1000409A session fixation vulnerability exists in Jenkins 2.145 and earlier, LTS 2.138.1 and earlier in core/src/main/java/hudson/security/HudsonProrg.jenkins-ci.main:jenkins-core
- CVE-2018-1000410An information exposure vulnerability exists in Jenkins 2.145 and earlier, LTS 2.138.1 and earlier, and the Stapler framework used by these org.jenkins-ci.main:jenkins-core
- CVE-2018-1000411A cross-site request forgery vulnerability exists in Jenkins JUnit Plugin 1.25 and earlier in TestObject.java that allows setting the descriorg.jenkins-ci.plugins:junit
- CVE-2018-1000412An improper authorization vulnerability exists in Jenkins Jira Plugin 3.0.1 and earlier in JiraSite.java that allows attackers with Overall/org.jenkins-ci.plugins:jira
- CVE-2018-1000413A cross-site scripting vulnerability exists in Jenkins Config File Provider Plugin 3.1 and earlier in configfiles.jelly, providerlist.jelly org.jenkins-ci.plugins:config-file-provider
- CVE-2018-1000414A cross-site request forgery vulnerability exists in Jenkins Config File Provider Plugin 3.1 and earlier in ConfigFilesManagement.java, Foldorg.jenkins-ci.plugins:config-file-provider
- CVE-2018-1000415A cross-site scripting vulnerability exists in Jenkins Rebuilder Plugin 1.28 and earlier in RebuildAction/BooleanParameterValue.jelly, Rebuicom.sonyericsson.hudson.plugins.rebuild:rebuild
- CVE-2018-1000416A reflected cross-site scripting vulnerability exists in Jenkins Job Config History Plugin 2.18 and earlier in all Jelly files that shows arorg.jenkins-ci.plugins:jobConfigHistory
- CVE-2018-1000417A cross-site request forgery vulnerability exists in Jenkins Email Extension Template Plugin 1.0 and earlier in ExtEmailTemplateManagement.jorg.jenkins-ci.plugins:email-ext
- CVE-2018-1000418An improper authorization vulnerability exists in Jenkins HipChat Plugin 2.2.0 and earlier in HipChatNotifier.java that allows attackers witorg.jvnet.hudson.plugins:hipchat
- CVE-2018-1000419An improper authorization vulnerability exists in Jenkins HipChat Plugin 2.2.0 and earlier in HipChatNotifier.java that allows attackers witorg.jvnet.hudson.plugins:hipchat
- CVE-2018-1000420An improper authorization vulnerability exists in Jenkins Mesos Plugin 0.17.1 and earlier in MesosCloud.java that allows attackers with Overorg.jenkins-ci.plugins:mesos
- CVE-2018-1000421An improper authorization vulnerability exists in Jenkins Mesos Plugin 0.17.1 and earlier in MesosCloud.java that allows attackers with Overorg.jenkins-ci.plugins:mesos
- CVE-2018-1000422An improper authorization vulnerability exists in Jenkins Crowd 2 Integration Plugin 2.0.0 and earlier in CrowdSecurityRealm.java that alloworg.jenkins-ci.plugins:crowd2
- CVE-2018-1000423An insufficiently protected credentials vulnerability exists in Jenkins Crowd 2 Integration Plugin 2.0.0 and earlier in CrowdSecurityRealm.jorg.jenkins-ci.plugins:crowd2
- CVE-2018-1000424An insufficiently protected credentials vulnerability exists in Jenkins Artifactory Plugin 2.16.1 and earlier in ArtifactoryBuilder.java, Crorg.jenkins-ci.plugins:artifactory
- CVE-2018-1000425An insufficiently protected credentials vulnerability exists in Jenkins SonarQube Scanner Plugin 2.8 and earlier in SonarInstallation.java torg.jenkins-ci.plugins:sonar
- CVE-2018-1000426A cross-site scripting vulnerability exists in Jenkins Git Changelog Plugin 2.6 and earlier in GitChangelogSummaryDecorator/summary.jelly, Gde.wellnerbou.jenkins:git-changelog
- CVE-2018-20681mate-screensaver before 1.20.2 in MATE Desktop Environment allows physically proximate attackers to view screen content and possibly control
- CVE-2018-20682Fork CMS 5.0.6 allows stored XSS via the private/en/settings facebook_admin_ids parameter (aka "Admin ids" input in the Facebook section).forkcms/forkcms
- CVE-2018-0625Aterm WG1200HP firmware Ver1.0.31 and earlier allows attacker with administrator rights to execute arbitrary OS commands via formSysCmd paraNEC WG1200HP
- CVE-2018-0626Aterm WG1200HP firmware Ver1.0.31 and earlier allows attacker with administrator rights to execute arbitrary OS commands via sysCmd in formWNEC WG1200HP
- CVE-2018-0627Aterm WG1200HP firmware Ver1.0.31 and earlier allows attacker with administrator rights to execute arbitrary OS commands via targetAPSsid paNEC WG1200HP
- CVE-2018-0628Aterm WG1200HP firmware Ver1.0.31 and earlier allows attacker with administrator rights to execute arbitrary OS commands via HTTP request anNEC WG1200HP
- CVE-2018-0629Aterm W300P Ver1.0.13 and earlier allows attacker with administrator rights to execute arbitrary OS commands via HTTP request and response.NEC Aterm W300P
- CVE-2018-0630Aterm W300P Ver1.0.13 and earlier allows attacker with administrator rights to execute arbitrary OS commands via sysCmd parameter.NEC Aterm W300P
- CVE-2018-0631Aterm W300P Ver1.0.13 and earlier allows attacker with administrator rights to execute arbitrary OS commands via targetAPSsid parameter.NEC Aterm W300P
- CVE-2018-0632Buffer overflow in Aterm W300P Ver1.0.13 and earlier allows attacker with administrator rights to execute arbitrary code via HTTP request anNEC Aterm W300P
- CVE-2018-0633Buffer overflow in Aterm W300P Ver1.0.13 and earlier allows attacker with administrator rights to execute arbitrary code via submit-url paraNEC Aterm W300P
- CVE-2018-0634Aterm HC100RC Ver1.0.1 and earlier allows attacker with administrator rights to execute arbitrary OS commands via FactoryPassword parameter NEC HC100RC
- CVE-2018-0635Aterm HC100RC Ver1.0.1 and earlier allows attacker with administrator rights to execute arbitrary OS commands via filename parameter.NEC HC100RC
- CVE-2018-0636Aterm HC100RC Ver1.0.1 and earlier allows attacker with administrator rights to execute arbitrary OS commands via FactoryPassword parameter NEC HC100RC
- CVE-2018-0637Aterm HC100RC Ver1.0.1 and earlier allows attacker with administrator rights to execute arbitrary OS commands via export.cgi encKey parameteNEC HC100RC
- CVE-2018-0638Aterm HC100RC Ver1.0.1 and earlier allows attacker with administrator rights to execute arbitrary OS commands via import.cgi encKey parameteNEC HC100RC
- CVE-2018-0639Aterm HC100RC Ver1.0.1 and earlier allows attacker with administrator rights to execute arbitrary OS commands via tools_firmware.cgi date paNEC HC100RC
- CVE-2018-0640Buffer overflow in Aterm HC100RC Ver1.0.1 and earlier allows attacker with administrator rights to execute arbitrary code via netWizard.cgi NEC HC100RC
- CVE-2018-0641Buffer overflow in Aterm HC100RC Ver1.0.1 and earlier allows attacker with administrator rights to execute arbitrary code via tools_system.cNEC HC100RC
- CVE-2018-0651Buffer overflow in the license management function of YOKOGAWA products (iDefine for ProSafe-RS R1.16.3 and earlier, STARDOM VDS R7.50 and eYokogawa Electric The license management function of YOKOGA…
- CVE-2018-0665Yamaha routers RT57i Rev.8.00.95 and earlier, RT58i Rev.9.01.51 and earlier, NVR500 Rev.11.00.36 and earlier, RTX810 Rev.11.01.31 and earlieYamaha Broadband VoIP Router RT57i · Yamaha Broadband Vo… +5
- CVE-2018-0666Yamaha routers RT57i Rev.8.00.95 and earlier, RT58i Rev.9.01.51 and earlier, NVR500 Rev.11.00.36 and earlier, RTX810 Rev.11.01.31 and earlieYamaha Broadband VoIP Router RT57i · Yamaha Broadband Vo… +5
- CVE-2018-0667Untrusted search path vulnerability in Installer of INplc SDK Express 3.08 and earlier and Installer of INplc SDK Pro+ 3.08 and earlier alloMICRONET Installer of INplc SDK Express 3.08 and earlier an…
- CVE-2018-0668Buffer overflow in INplc-RT 3.08 and earlier allows remote attackers to cause denial-of-service (DoS) condition that may result in executingMICRONET INplc-RT
- CVE-2018-0669INplc-RT 3.08 and earlier allows remote attackers to bypass authentication to execute an arbitrary command through the protocol-compliant trMICRONET INplc-RT
- CVE-2018-0670INplc-RT 3.08 and earlier allows remote attackers to bypass authentication to execute an arbitrary command through the protocol-compliant trMICRONET INplc-RT
- CVE-2018-0671Privilege escalation vulnerability in INplc-RT 3.08 and earlier allows an attacker with administrator rights to execute arbitrary code on thMICRONET INplc-RT
- CVE-2018-0676BN-SDWBP3 firmware version 1.0.9 and earlier allows an attacker on the same network segment to bypass authentication to access to the managePanasonic BN-SDWBP3
- CVE-2018-0677BN-SDWBP3 firmware version 1.0.9 and earlier allows attacker with administrator rights on the same network segment to execute arbitrary OS cPanasonic BN-SDWBP3
- CVE-2018-0678Buffer overflow in BN-SDWBP3 firmware version 1.0.9 and earlier allows an attacker on the same network segment to execute arbitrary code viaPanasonic BN-SDWBP3
- CVE-2018-0688Open redirect vulnerability in SEIKO EPSON printers and scanners (DS-570W firmware versions released prior to 2018 March 13, DS-780N firmwarSEIKO EPSON printers and scanners
- CVE-2018-0689HTTP header injection vulnerability in SEIKO EPSON printers and scanners (DS-570W firmware versions released prior to 2018 March 13, DS-780NSEIKO EPSON printers and scanners
- CVE-2018-0698Cross-site scripting vulnerability in GROWI v3.2.3 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecifieWESEEK GROWI
- CVE-2018-0702Directory traversal vulnerability in Cybozu Mailwise 5.0.0 to 5.4.5 allows remote attackers to delete arbitrary files via unspecified vectorCybozu Mailwise
- CVE-2018-0703Directory traversal vulnerability in Cybozu Office 10.0.0 to 10.8.1 allows remote attackers to delete arbitrary files via HTTP requests.Cybozu Office
- CVE-2018-0704Directory traversal vulnerability in Cybozu Office 10.0.0 to 10.8.1 allows remote attackers to delete arbitrary files via Keitai Screen.Cybozu Office
- CVE-2018-0705Directory traversal vulnerability in Cybozu Dezie 8.0.2 to 8.1.2 allows remote attackers to read arbitrary files via HTTP requests.Cybozu Dezie
- CVE-2018-16164Cross-site scripting vulnerability in Event Calendar WD version 1.1.21 and earlier allows remote authenticated attackers to inject arbitraryWeb-Dorado Event Calendar WD version
- CVE-2018-16165Cross-site scripting vulnerability in LogonTracer 1.2.0 and earlier allows remote attackers to inject arbitrary web script or HTML via unspeJPCERT Coordination Center LogonTracer
- CVE-2018-16166LogonTracer 1.2.0 and earlier allows remote attackers to conduct XML External Entity (XXE) attacks via unspecified vectors.JPCERT Coordination Center LogonTracer
- CVE-2018-16167LogonTracer 1.2.0 and earlier allows remote attackers to execute arbitrary OS commands via unspecified vectors.JPCERT Coordination Center LogonTracer
- CVE-2018-16168LogonTracer 1.2.0 and earlier allows remote attackers to conduct Python code injection attacks via unspecified vectors.JPCERT Coordination Center LogonTracer
- CVE-2018-16169Cybozu Remote Service 3.0.0 to 3.1.0 allows remote authenticated attackers to upload and execute Java code file on the server via unspecifieCybozu Remote Service
- CVE-2018-16170Directory traversal vulnerability in Cybozu Remote Service 3.0.0 to 3.1.8 for Windows allows remote authenticated attackers to read arbitrarCybozu Remote Service
- CVE-2018-16171Directory traversal vulnerability in Cybozu Remote Service 3.0.0 to 3.1.8 allows remote attackers to execute Java code file on the server viCybozu Remote Service
- CVE-2018-16172Improper countermeasure against clickjacking attack in client certificates management screen was discovered in Cybozu Remote Service 3.0.0 tCybozu Remote Service
- CVE-2018-16173Cross-site scripting vulnerability in LearnPress prior to version 3.1.0 allows remote attackers to inject arbitrary web script or HTML via uThimPress LearnPress
- CVE-2018-16174Open redirect vulnerability in LearnPress prior to version 3.1.0 allows remote attackers to redirect users to arbitrary web sites and conducThimPress LearnPress
- CVE-2018-16175SQL injection vulnerability in the LearnPress prior to version 3.1.0 allows attacker with administrator rights to execute arbitrary SQL commThimPress LearnPress
- CVE-2018-16176Untrusted search path vulnerability in Installer of Mapping Tool 2.0.1.6 and 2.0.1.7 allows remote attackers to gain privileges via a TrojanJapan Atomic Energy Agency Installer of Mapping Tool
- CVE-2018-16177Untrusted search path vulnerability in The installer of Windows 10 Fall Creators Update Modify module for Security Measures tool allows an aNIPPON TELEGRAPH AND TELEPHONE WEST The installer of Window…
- CVE-2018-16178Cybozu Garoon 3.0.0 to 4.10.0 allows remote attackers to bypass access restriction to view information available only for a sign-on user viaCybozu Garoon
- CVE-2018-16179The Mizuho Direct App for Android version 3.13.0 and earlier does not verify server certificates, which allows man-in-the-middle attackers tMizuho Bank Mizuho Direct App for Android
- CVE-2018-16180Cross-site scripting vulnerability in i-FILTER Ver.9.50R05 and earlier allows remote attackers to inject arbitrary web script or HTML via unDigital Arts i-FILTER
- CVE-2018-16181HTTP header injection vulnerability in i-FILTER Ver.9.50R05 and earlier may allow remote attackers to inject arbitrary HTTP headers and condDigital Arts i-FILTER
- CVE-2018-16182Untrusted search path vulnerability in the installer of MARKET SPEED Ver.16.4 and earlier allows an attacker to gain privileges via a TrojanRakuten Securities The installer of MARKET SPEED
- CVE-2018-16183An unquoted search path vulnerability in some pre-installed applications on Panasonic PC run on Windows 7 (32bit), Windows 7 (64bit), WindowSome pre-installed applications on Panasonic PC
- CVE-2018-16184RICOH Interactive Whiteboard D2200 V1.6 to V2.2, D5500 V1.6 to V2.2, D5510 V1.6 to V2.2, and the display versions with RICOH Interactive WhiRICOH COMPANY RICOH Interactive Whiteboard
- CVE-2018-16185RICOH Interactive Whiteboard D2200 V1.1 to V2.2, D5500 V1.1 to V2.2, D5510 V1.1 to V2.2, the display versions with RICOH Interactive WhiteboRICOH COMPANY RICOH Interactive Whiteboard
- CVE-2018-16186RICOH Interactive Whiteboard D2200 V1.1 to V2.2, D5500 V1.1 to V2.2, D5510 V1.1 to V2.2, the display versions with RICOH Interactive WhiteboRICOH COMPANY RICOH Interactive Whiteboard
- CVE-2018-16187The RICOH Interactive Whiteboard D2200 V1.3 to V2.2, D5500 V1.3 to V2.2, D5510 V1.3 to V2.2, the display versions with RICOH Interactive WhiRICOH COMPANY RICOH Interactive Whiteboard
- CVE-2018-16188SQL injection vulnerability in the RICOH Interactive Whiteboard D2200 V1.3 to V2.2, D5500 V1.3 to V2.2, D5510 V1.3 to V2.2, the display versRICOH COMPANY RICOH Interactive Whiteboard
- CVE-2018-16191Open redirect vulnerability in EC-CUBE (EC-CUBE 3.0.0, EC-CUBE 3.0.1, EC-CUBE 3.0.2, EC-CUBE 3.0.3, EC-CUBE 3.0.4, EC-CUBE 3.0.5, EC-CUBE 3.LOCKON CO. EC-CUBE · ec-cube/ec-cube
- CVE-2018-16192Aterm WF1200CR and Aterm WG1200CR (Aterm WF1200CR firmware Ver1.1.1 and earlier, Aterm WG1200CR firmware Ver1.0.1 and earlier) allow an attaNEC Aterm WF1200CR and Aterm WG1200CR
- CVE-2018-16193Cross-site scripting vulnerability in Aterm WF1200CR and Aterm WG1200CR (Aterm WF1200CR firmware Ver1.1.1 and earlier, Aterm WG1200CR firmwaNEC Aterm WF1200CR and Aterm WG1200CR
- CVE-2018-16194Aterm WF1200CR and Aterm WG1200CR (Aterm WF1200CR firmware Ver1.1.1 and earlier, Aterm WG1200CR firmware Ver1.0.1 and earlier) allows authenNEC Aterm WF1200CR and Aterm WG1200CR
- CVE-2018-16195Aterm WF1200CR and Aterm WG1200CR (Aterm WF1200CR firmware Ver1.1.1 and earlier, Aterm WG1200CR firmware Ver1.0.1 and earlier) allows an attNEC Aterm WF1200CR and Aterm WG1200CR
- CVE-2018-16196Multiple Yokogawa products that contain Vnet/IP Open Communication Driver (CENTUM CS 3000(R3.05.00 - R3.09.50), CENTUM CS 3000 Entry Class(RYokogawa Electric Multiple Yokogawa products that contain V…
- CVE-2018-16197Toshiba Home gateway HEM-GW16A 1.2.9 and earlier, Toshiba Home gateway HEM-GW26A 1.2.9 and earlier allows an attacker on the same network seToshiba Lighting & Technology Toshiba Home gateway HEM-GW16…
- CVE-2018-16198Toshiba Home gateway HEM-GW16A 1.2.9 and earlier, Toshiba Home gateway HEM-GW26A 1.2.9 and earlier may allow an attacker on the same networkToshiba Lighting & Technology Toshiba Home gateway HEM-GW16…
- CVE-2018-16199Cross-site scripting vulnerability in Toshiba Home gateway HEM-GW16A 1.2.9 and earlier, Toshiba Home gateway HEM-GW26A 1.2.9 and earlier allToshiba Lighting & Technology Toshiba Home gateway HEM-GW16…
- CVE-2018-16200Toshiba Home gateway HEM-GW16A 1.2.9 and earlier, Toshiba Home gateway HEM-GW26A 1.2.9 and earlier allows an attacker on the same network seToshiba Lighting & Technology Toshiba Home gateway HEM-GW16…
- CVE-2018-16201Toshiba Home gateway HEM-GW16A 1.2.9 and earlier, Toshiba Home gateway HEM-GW26A 1.2.9 and earlier uses hard-coded credentials, which may alToshiba Lighting & Technology Toshiba Home gateway HEM-GW16…
- CVE-2018-16202Directory traversal vulnerability in cordova-plugin-ionic-webview versions prior to 2.2.0 (not including 2.0.0-beta.0, 2.0.0-beta.1, 2.0.0-bnpm cordova-plugin-ionic-webview · cordova-plugin-ionic-web…
- CVE-2018-16203PgpoolAdmin 4.0 and earlier allows remote attackers to bypass the login authentication and obtain the administrative privilege of the PostgrPgPool Global Development Group PgpoolAdmin
- CVE-2018-16204Cross-site scripting vulnerability in Google XML Sitemaps Version 4.0.9 and earlier allows remote authenticated attackers to inject arbitrarArne Brachhold Google XML Sitemaps
- CVE-2018-16205Cross-site scripting vulnerability in GROWI v3.2.3 and earlier allows remote attackers to inject arbitrary web script or HTML via New Page mWESEEK GROWI
- CVE-2019-3498In Django 1.11.x before 1.11.18, 2.0.x before 2.0.10, and 2.1.x before 2.1.5, an Improper Neutralization of Special Elements in Output Used django
- CVE-2019-5882Irssi 1.1.x before 1.1.2 has a use after free when hidden lines are expired from the scroll buffer.
- CVE-2016-10403Insufficient data validation on image data in PDFium in Google Chrome prior to 51.0.2704.63 allowed a remote attacker to perform an out of bGoogle Chrome
- CVE-2016-9651A missing check for whether a property of a JS object is private in V8 in Google Chrome prior to 55.0.2883.75 allowed a remote attacker to eGoogle Chrome
- CVE-2017-15401A memory corruption bug in WebAssembly could lead to out of bounds read and write through V8 in WebAssembly in Google Chrome prior to 62.0.3Google Chrome
- CVE-2017-15402Using an ID that can be controlled by a compromised renderer which allows any frame to overwrite the page_state of any other frame in the saGoogle Chrome
- CVE-2017-15403Insufficient data validation in crosh could lead to a command injection under chronos privileges in Networking in Google Chrome on Chrome OSGoogle Chrome
- CVE-2017-15404An ability to process crash dumps under root privileges and inappropriate symlinks handling could lead to a local privilege escalation in CrGoogle Chrome
- CVE-2017-15405Inappropriate symlink handling and a race condition in the stateful recovery feature implementation could lead to a persistance established Google Chrome
- CVE-2017-15428Insufficient data validation in V8 builtins string generator could lead to out of bounds read and write access in V8 in Google Chrome prior Google Chrome
- CVE-2018-16065A Javascript reentrancy issues that caused a use-after-free in V8 in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to executGoogle Chrome
- CVE-2018-16066A use after free in Blink in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to potentially exploit heap corruption via a crafGoogle Chrome
- CVE-2018-16067A use after free in WebAudio in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to potentially exploit heap corruption via a cGoogle Chrome
- CVE-2018-16068Missing validation in Mojo in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to potentially perform a sandbox escape via a crGoogle Chrome
- CVE-2018-16071A use after free in WebRTC in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to potentially exploit heap corruption via a craGoogle Chrome
- CVE-2018-16072A missing origin check related to HLS manifests in Blink in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to bypass same oriGoogle Chrome
- CVE-2018-16076Missing bounds check in PDFium in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to perform an out of bounds memory read via Google Chrome
- CVE-2018-16078Unsafe handling of credit card details in Autofill in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to obtain potentially seGoogle Chrome
- CVE-2018-16079A race condition between permission prompts and navigations in Prompts in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to sGoogle Chrome
- CVE-2018-16080A missing check for popup window handling in Fullscreen in Google Chrome on macOS prior to 69.0.3497.81 allowed a remote attacker to spoof tGoogle Chrome
- CVE-2018-16081Allowing the chrome.debugger API to run on file:// URLs in DevTools in Google Chrome prior to 69.0.3497.81 allowed an attacker who convincedGoogle Chrome
- CVE-2018-16082An out of bounds read in Swiftshader in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to potentially perform out of bounds mGoogle Chrome
- CVE-2018-16083An out of bounds read in forward error correction code in WebRTC in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to performGoogle Chrome
- CVE-2018-16084The default selected dialog button in CustomHandlers in Google Chrome prior to 69.0.3497.81 allowed a remote attacker who convinced the userGoogle Chrome
- CVE-2018-16085A use after free in ResourceCoordinator in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to potentially exploit heap corruptGoogle Chrome
- CVE-2018-16087Lack of proper state tracking in Permissions in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to bypass navigation restrictiGoogle Chrome
- CVE-2018-16088A missing check for JS-simulated input events in Blink in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to download arbitrarGoogle Chrome
- CVE-2018-17457An object lifecycle issue in Blink could lead to a use after free in WebAudio in Google Chrome prior to 69.0.3497.81 allowed a remote attackGoogle Chrome
- CVE-2018-17458An improper update of the WebAssembly dispatch table in WebAssembly in Google Chrome prior to 69.0.3497.92 allowed a remote attacker to execGoogle Chrome
- CVE-2018-17459Incorrect handling of clicks in the omnibox in Navigation in Google Chrome prior to 69.0.3497.92 allowed a remote attacker to spoof the contGoogle Chrome
- CVE-2018-17461An out of bounds read in PDFium in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to perform an out of bounds memory read viaGoogle Chrome
- CVE-2018-17470A heap buffer overflow in GPU in Google Chrome prior to 70.0.3538.67 allowed a remote attacker who had compromised the renderer process to pGoogle Chrome
- CVE-2018-20065Handling of URI action in PDFium in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to initiate potentially unsafe navigationsGoogle Chrome
- CVE-2018-20066Incorrect object lifecycle in Extensions in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to potentially exploit heap corrupGoogle Chrome
- CVE-2018-20067A renderer initiated back navigation was incorrectly allowed to cancel a browser initiated one in Navigation in Google Chrome prior to 71.0.Google Chrome
- CVE-2018-20068Incorrect handling of 304 status codes in Navigation in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to confuse the user abGoogle Chrome
- CVE-2018-20069Failure to prevent navigation to top frame to data URLs in Navigation in Google Chrome on iOS prior to 71.0.3578.80 allowed a remote attackeGoogle Chrome
- CVE-2018-20070Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to spoof the cGoogle Chrome
- CVE-2018-20071Insufficiently strict origin checks during JIT payment app installation in Payments in Google Chrome prior to 70.0.3538.67 allowed a remote Google Chrome
- CVE-2018-6056Type confusion could lead to a heap out-of-bounds write in V8 in Google Chrome prior to 64.0.3282.168 allowing a remote attacker to execute Google Chrome
- CVE-2018-6084Insufficiently sanitized distributed objects in Updater in Google Chrome on macOS prior to 66.0.3359.117 allowed a local attacker to executeGoogle Chrome
- CVE-2018-6091Service Workers can intercept any request made by an <embed> or <object> tag in Fetch API in Google Chrome prior to 66.0.3359.117 allowed a Google Chrome
- CVE-2018-6093Insufficient origin checks in Blink in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to leak cross-origin data via a crafteGoogle Chrome
- CVE-2018-6096A JavaScript focused window could overlap the fullscreen notification in Fullscreen in Google Chrome prior to 66.0.3359.117 allowed a remoteGoogle Chrome
- CVE-2018-6097Incorrect handling of asynchronous methods in Fullscreen in Google Chrome on macOS prior to 66.0.3359.117 allowed a remote attacker to enterGoogle Chrome
- CVE-2018-6100Incorrect handling of confusable characters in URL Formatter in Google Chrome on macOS prior to 66.0.3359.117 allowed a remote attacker to pGoogle Chrome
- CVE-2018-6106An asynchronous generator may return an incorrect state in V8 in Google Chrome prior to 66.0.3359.117 allowing a remote attacker to potentiaGoogle Chrome
- CVE-2018-6109readAsText() can indefinitely read the file picked by the user, rather than only once at the time the file is picked in File API in Google CGoogle Chrome
- CVE-2018-6110Parsing documents as HTML in Downloads in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to cause Chrome to execute scripts Google Chrome
- CVE-2018-6111An object lifetime issue in the developer tools network handler in Google Chrome prior to 66.0.3359.117 allowed a local attacker to execute Google Chrome
- CVE-2018-6112Making URLs clickable and allowing them to be styled in DevTools in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to bypassGoogle Chrome
- CVE-2018-6113Improper handling of pending navigation entries in Navigation in Google Chrome on iOS prior to 66.0.3359.117 allowed a remote attacker to peGoogle Chrome
- CVE-2018-6114Incorrect enforcement of CSP for <object> tags in Blink in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to bypass content Google Chrome
- CVE-2018-6117Confusing settings in Autofill in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to obtain potentially sensitive informationGoogle Chrome
- CVE-2018-6120An integer overflow that could lead to an attacker-controlled heap out-of-bounds write in PDFium in Google Chrome prior to 66.0.3359.170 allGoogle Chrome
- CVE-2018-6123A use after free in Blink in Google Chrome prior to 67.0.3396.62 allowed a remote attacker to potentially exploit heap corruption via a crafGoogle Chrome
- CVE-2018-6124Type confusion in ReadableStreams in Blink in Google Chrome prior to 67.0.3396.62 allowed a remote attacker to potentially exploit object coGoogle Chrome
- CVE-2018-6126A precision error in Skia in Google Chrome prior to 67.0.3396.62 allowed a remote attacker to perform an out of bounds memory write via a crGoogle Chrome
- CVE-2018-6127Early free of object in use in IndexDB in Google Chrome prior to 67.0.3396.62 allowed a remote attacker who had compromised the renderer proGoogle Chrome
- CVE-2018-6133Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 67.0.3396.62 allowed a remote attacker to perform domGoogle Chrome
- CVE-2018-6135Lack of clearing the previous site before loading alerts from a new one in Blink in Google Chrome prior to 67.0.3396.62 allowed a remote attGoogle Chrome
- CVE-2018-6137CSS Paint API in Blink in Google Chrome prior to 67.0.3396.62 allowed a remote attacker to leak cross-origin data via a crafted HTML page.Google Chrome
- CVE-2018-6139Insufficient target checks on the chrome.debugger API in DevTools in Google Chrome prior to 67.0.3396.62 allowed an attacker who convinced aGoogle Chrome
- CVE-2018-6140Allowing the chrome.debugger API to attach to Web UI pages in DevTools in Google Chrome prior to 67.0.3396.62 allowed an attacker who convinGoogle Chrome
- CVE-2018-6141Insufficient validation of an image filter in Skia in Google Chrome prior to 67.0.3396.62 allowed a remote attacker who had compromised the Google Chrome
- CVE-2018-6143Insufficient validation in V8 in Google Chrome prior to 67.0.3396.62 allowed a remote attacker to perform an out of bounds memory read via aGoogle Chrome
- CVE-2018-6144Off-by-one error in PDFium in Google Chrome prior to 67.0.3396.62 allowed a remote attacker to perform an out of bounds memory write via a cGoogle Chrome
- CVE-2018-6147Lack of secure text entry mode in Browser UI in Google Chrome on Mac prior to 67.0.3396.62 allowed a local attacker to obtain potentially seGoogle Chrome
- CVE-2018-6151Bad cast in DevTools in Google Chrome on Win, Linux, Mac, Chrome OS prior to 66.0.3359.117 allowed an attacker who convinced a user to instaGoogle Chrome
- CVE-2018-6153A precision error in Skia in Google Chrome prior to 68.0.3440.75 allowed a remote attacker who had compromised the renderer process to perfoGoogle Chrome
- CVE-2018-6158A race condition in Oilpan in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to potentially exploit heap corruption via a craGoogle Chrome
- CVE-2018-6160JavaScript alert handling in Prompts in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to spoof the contents of the Omnibox (Google Chrome
- CVE-2018-6162Improper deserialization in WebGL in Google Chrome on Mac prior to 68.0.3440.75 allowed a remote attacker to potentially exploit heap corrupGoogle Chrome
- CVE-2018-6163Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to perform domGoogle Chrome
- CVE-2018-6164Insufficient origin checks for CSS content in Blink in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to leak cross-origin daGoogle Chrome
- CVE-2018-6165Incorrect handling of reloads in Navigation in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to spoof the contents of the OmGoogle Chrome
- CVE-2018-6166Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to perform domGoogle Chrome
- CVE-2018-6167Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to perform domGoogle Chrome
- CVE-2018-6169Lack of timeout on extension install prompt in Extensions in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to trigger instalGoogle Chrome
- CVE-2018-6170A bad cast in PDFium in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to potentially exploit heap corruption via a crafted PGoogle Chrome
- CVE-2018-6172Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to perform domGoogle Chrome
- CVE-2018-6173Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to perform domGoogle Chrome
- CVE-2018-6174Integer overflows in Swiftshader in Google Chrome prior to 68.0.3440.75 potentially allowed a remote attacker to execute arbitrary code via Google Chrome
- CVE-2018-6175Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to perform domGoogle Chrome
- CVE-2018-6178Eliding from the wrong side in an infobar in DevTools in Google Chrome prior to 68.0.3440.75 allowed an attacker who convinced a user to insGoogle Chrome
- CVE-2018-6179Insufficient enforcement of file access permission in the activeTab case in Extensions in Google Chrome prior to 68.0.3440.75 allowed an attGoogle Chrome
- CVE-2018-20680Frog CMS 0.9.5 has XSS in the admin/?/page/edit/1 body field.
- CVE-2019-5748In Traccar Server version 4.2, protocol/SpotProtocolDecoder.java might allow XXE attacks.
- CVE-2019-0542A remote code execution vulnerability exists in Xterm.js when the component mishandles special characters, aka "Xterm Remote Code Execution https://xtermjs.org/ xterm.js · xterm
- CVE-2016-10735In Bootstrap 3.x before 3.4.0 and 4.x-beta before 4.0.0-beta.2, XSS is possible in the data-target attribute, a different vulnerability thanbootstrap · org.webjars:bootstrap +3
- CVE-2018-20676In Bootstrap before 3.4.0, XSS is possible in the tooltip data-viewport attribute.bootstrap · bootstrap-sass +2
- CVE-2018-20677In Bootstrap before 3.4.0, XSS is possible in the affix configuration target property.bootstrap · bootstrap-sass +2
- CVE-2018-20674D-Link DIR-822 C1 before v3.11B01Beta, DIR-822-US C1 before v3.11B01Beta, DIR-850L A* before v1.21B08Beta, DIR-850L B* before v2.22B03Beta,
- CVE-2018-20675D-Link DIR-822 C1 before v3.11B01Beta, DIR-822-US C1 before v3.11B01Beta, DIR-850L A* before v1.21B08Beta, DIR-850L B* before v2.22B03Beta,