CVE Vulnerability Catalog

An issue was discovered in Enigmail before version 1.9.9 related to signature spoofing in multipart/related messages. A signed message part can be referenced with a cid: URI but not actually displayed, leading to the entire message appearing signed while the recipient does not see any of the signed text.

An issue was discovered in Enigmail before 1.9.9 related to signature spoofing. The UI does not properly distinguish between an attachment signature and a signature that applies to the entire containing message, which may lead to unauthorized message authentication.

An issue was discovered in Enigmail before 1.9.9 related to regular expressions that can be exploited for Denial of Service by attempting to match arbitrarily long strings.

An issue was discovered in Enigmail before 1.9.9 related to improper random secret generation. The use of Math.Random() by pretty Easy privacy (pEp) leads to this vulnerability.

An issue was discovered in Open-iSCSI through 2.0.875 that allows a local attacker to cause the iscsiuio server to abort or potentially execute code by sending messages with incorrect lengths. The lack of payload length validation in the process_iscsid_broadcast function leads to buffer overflows.

CVE-2017-17010 in Content Manager Assistant for PlayStation version 3.55.7671.0901 and earlier has an untrusted search path vulnerability that allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.

The Linux kernel up to version 4.14.8 has a vulnerability that allows local users to cause a denial of service (memory corruption) by mishandling register truncation.

The check_alu_op function in kernel/bpf/verifier.c in the Linux kernel through 4.4 allows local users to cause a denial of service (memory corruption) or possibly have unspecified other impact by leveraging incorrect sign extension.

A vulnerability has been discovered in the Auth0 passport-wsfed-saml2 library affecting versions < 3.0.5. This vulnerability allows an attacker to impersonate another user and potentially elevate their privileges if the SAML identity provider does not sign the full SAML response.

Specially crafted packets sent to port 161/udp could cause a denial of service condition. Affected devices must be restarted manually.

The Ruggedcom Discovery Protocol (RCDP) is still able to write to the device after initial configuration under certain conditions.

An issue was discovered in certain Apple products, including iOS before 11.2.1 and tvOS before 11.2.1, related to the 'HomeKit' component. It allows remote attackers to modify the application state through incorrect message handling.

An issue was discovered in certain Apple products, including macOS before version 10.13.2, related to the 'Intel Graphics Driver' component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.

An issue was discovered in certain Apple products, including iOS before 11.2, related to the 'IOMobileFrameBuffer' component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.

An issue was discovered in certain Apple products, including macOS before 10.13.2, related to the 'Intel Graphics Driver' component. It allows local users to bypass intended memory-read restrictions or cause a denial of service (out-of-bounds read and system crash).

An issue was discovered in certain Apple products, including iOS before 11.2, macOS before 10.13.2, tvOS before 11.2, and watchOS before 4.2, involving the 'Kernel' component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.

An issue was discovered in certain Apple products, including macOS before 10.13.2, related to the 'Intel Graphics Driver' component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (out-of-bounds read) via a crafted app.

An issue was discovered in certain Apple products, including iOS before 11.2, related to the 'Mail' component. It might allow remote attackers to bypass an intended encryption protection mechanism by leveraging incorrect S/MIME certificate selection.

An issue was discovered in certain Apple products, including macOS before 10.13.2, related to the 'Mail' component. It allows remote attackers to read cleartext e-mail content that was intended to be protected by S/MIME encryption.

An issue was discovered in certain Apple products affecting iOS before 11.2, Safari before 11.0.2, iCloud before 7.2 on Windows, iTunes before 12.7.2 on Windows, and tvOS before 11.2. The issue involves the 'WebKit' component and allows remote attackers to execute arbitrary code or cause a denial of service via a crafted website.