| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| Use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, and Firefox ESR 153.5. |
| Use-after-free in the DOM: Animation component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, and Firefox ESR 153.5. |
| Use-after-free in the Audio/Video component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, and Firefox ESR 153.5. |
| Use-after-free in the SVG component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, and Firefox ESR 153.5. |
| Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, and Firefox ESR 153.5. |
| JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, and Firefox ESR 153.5. |
| Race condition, use-after-free in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, and Firefox ESR 153.5. |
| Use-after-free in the XML component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, and Firefox ESR 153.5. |
| Incorrect boundary conditions in the JavaScript Engine component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, and Firefox ESR 153.5. |
| Incorrect boundary conditions in the JavaScript Engine component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, and Firefox ESR 153.5. |
| Sandbox escape due to uninitialized memory in the Graphics component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, and Firefox ESR 153.5. |
| Use-after-free in the Graphics: Text component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, and Firefox ESR 153.5. |
| Use-after-free in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, and Firefox ESR 153.5. |
| IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerability in host firmware configuration parsing. An attacker with authenticated service-level access to the FSP can write specially crafted configuration data to cause memory corruption in the host firmware boot stage during system IPL, compromising the host firmware boot stack and the hypervisor subsequently loaded by it. Successful exploitation results in a confidentiality, integrity, and availability impact to the managed system. |
| IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerability in the service processor mailbox interface. An attacker with authenticated service-level access to the FSP can send a specially crafted mailbox message to read or modify arbitrary regions of Hostboot memory, compromising the host firmware boot stack and the hypervisor subsequently loaded by it. Successful exploitation results in a confidentiality, integrity, and availability impact to the managed system. |
| IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerability in the service processor mailbox interface. An attacker with authenticated service-level access to the FSP can send a specially crafted mailbox message to overflow host firmware runtime attribute storage, allowing arbitrary code to be executed in the host firmware runtime. This gives the attacker full access to the managed system's memory and hardware interfaces, resulting in a confidentiality, integrity, and availability impact to the managed system. |
| IBM Power Systems Firmware FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, and FW1060.00 through FW1060.81 is affected by a vulnerability in the host firmware boot process image validation path. An attacker with service access to the service processor can supply a maliciously crafted code update image, allowing arbitrary code to be executed on the host system. Successful exploitation could result in a confidentiality, integrity, and availability impact to the affected host system. |
| IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerability in the service processor mailbox interface. An attacker with authenticated service-level access to the FSP can send a specially crafted mailbox message to overflow host firmware runtime attribute storage, allowing arbitrary code to be executed in the host firmware runtime. This gives the attacker full access to the managed system's memory and hardware interfaces, resulting in a confidentiality, integrity, and availability impact to the managed system. |
| IBM Db2 Mirror for i 7.4, 7.5, and 7.6 is vulnerable to privilege escalation. An authenticated attacker could craft a malicious request that bypasses additional authorization and input validation checks to execute malicious code. An attacker could exploit this vulnerability to obtain elevated privileges on the system. |
| The WP-BusinessDirectory WordPress plugin through 4.0.2 does not restrict the type or destination of files saved by an unauthenticated upload handler, allowing unauthenticated attackers to write files with arbitrary content to arbitrary locations, though not to execute code on a default server configuration. |
