2018

Video files loaded video captions cross-origin without checking for the presence of CORS headers permitting such cross-o

Using SVG filters that don't use the fixed point math implementation on a target iframe, a malicious page can extract pi

Certain response codes in FTP connections can result in the use of uninitialized values for ports in FTP operations. Thi

Malicious sites can display a spoofed location bar on a subsequently loaded page when the existing location bar on the n

The "mozAddonManager" allows for the installation of extensions from the CDN for addons.mozilla.org, a publicly accessib

WebExtensions could use the "mozAddonManager" API by modifying the CSP headers on sites with the appropriate permissions

Proxy Auto-Config (PAC) files can specify a JavaScript function called for all URL requests with the full URL path which

URLs containing certain unicode glyphs for alternative hyphens and quotes do not properly trigger punycode display, allo

Mozilla's add-ons SDK had a world-accessible resource with an HTML injection vulnerability. If an additional vulnerabili

Event handlers on "marquee" elements were executed despite a strict Content Security Policy (CSP) that disallowed inline

An issue where a "<select>" dropdown menu can be used to cover location bar content, resulting in potential spoofing att

An existing mitigation of timing side-channel attacks is insufficient in some circumstances. This issue is addressed in

Content Security Policy combined with HTTP to HTTPS redirection can be used by malicious server to verify whether a know

Two use-after-free errors during DOM operations resulting in potentially exploitable crashes. This vulnerability affects

Add-on updates failed to verify that the add-on ID inside the signed package matched the ID of the add-on being updated.

A mechanism where disruption of the loading of a new web page can cause the previous page's favicon and SSL indicator to

The Mozilla Updater can be made to choose an arbitrary target working directory for output files resulting from the upda

When the Mozilla Updater is run, if the Updater's log file in the working directory points to a hardlink, data can be ap

During URL parsing, a maliciously crafted URL can cause a potentially exploitable crash. This vulnerability affects Fire

A same-origin policy bypass with local shortcut files to load arbitrary local content from disk. This vulnerability affe

Web content could access information in the HTTP cache if e10s is disabled. This can reveal some visited URLs and the co

Cross-site scripting (XSS) vulnerability in the Canon PrintMe EFI webinterface allows remote attackers to inject arbitra

An issue was discovered in Dropbox Lepton 1.2.1. The validateAndCompress function in validation.cc allows remote attacke

md4c 0.2.6 has a NULL pointer dereference in the function md_process_line in md4c.c, related to ctx->current_block.

Sonatype Nexus Repository Manager versions 3.x before 3.12.0 has XSS in multiple areas in the Administration UI.

Grafana before 5.2.0-beta1 has XSS vulnerabilities in dashboard links.

A Reflected Cross-Site Scripting web vulnerability has been discovered in the OEcms v3.1 web-application. The vulnerabil

Cross-site scripting (XSS) vulnerability in news.php in Dimofinf CMS Version 3.0.0 allows remote attackers to inject arb

There is unauthenticated reflected cross-site scripting (XSS) in LAMS before 3.1 that allows a remote attacker to introd

The do_core_note function in readelf.c in libmagic.a in file 5.33 allows remote attackers to cause a denial of service (

The clustered setup of Apache MXNet allows users to specify which IP address and port the scheduler will listen on via t

An issue was discovered in certain Apple products. macOS before 10.13.5 is affected. The issue involves the "AMD" compon

An issue was discovered in certain Apple products. iOS before 11.4 is affected. The issue involves the "Siri" component.

An issue was discovered in certain Apple products. macOS before 10.13.5 is affected. The issue involves the "Firmware" c

An issue was discovered in certain Apple products. iOS before 11.4 is affected. The issue involves the "Messages" compon

An issue was discovered in certain Apple products. iOS before 11.4 is affected. Safari before 11.1.1 is affected. The is

An issue was discovered in certain Apple products. iOS before 11.4 is affected. The issue involves the "Siri Contacts" c

An issue was discovered in certain Apple products. iOS before 11.4 is affected. macOS before 10.13.5 is affected. tvOS b

An issue was discovered in certain Apple products. iOS before 11.4 is affected. The issue involves the "Magnifier" compo

An issue was discovered in certain Apple products. iOS before 11.4 is affected. macOS before 10.13.5 is affected. tvOS b

An issue was discovered in certain Apple products. iOS before 11.4 is affected. Safari before 11.1.1 is affected. iCloud

An issue was discovered in certain Apple products. iOS before 11.4 is affected. macOS before 10.13.5 is affected. iCloud

An issue was discovered in certain Apple products. iOS before 11.4 is affected. macOS before 10.13.5 is affected. iCloud

An issue was discovered in certain Apple products. iOS before 11.4 is affected. macOS before 10.13.5 is affected. iCloud

An issue was discovered in certain Apple products. iOS before 11.4 is affected. macOS before 10.13.5 is affected. tvOS b

An issue was discovered in certain Apple products. Safari before 11.1.1 is affected. The issue involves the "Safari" com

An issue was discovered in certain Apple products. iOS before 11.4 is affected. macOS before 10.13.5 is affected. The is

An issue was discovered in certain Apple products. iOS before 11.4 is affected. macOS before 10.13.5 is affected. tvOS b

An issue was discovered in certain Apple products. iOS before 11.4 is affected. Safari before 11.1.1 is affected. iCloud

An issue was discovered in certain Apple products. iOS before 11.3.1 is affected. macOS before 10.13.4 Security Update 2