CVE-2018-12397

HIGH Year: 2018
CVSS v3 Score
7.1
High
CVSS v2 Score
3.6
Low
Weakness Type
CWE-200
View all →

Vulnerability Description

A WebExtension can request access to local files without the warning prompt stating that the extension will "Access your data for all websites" being displayed to the user. This allows extensions to run content scripts in local pages without permission warnings when a local file is opened. This vulnerability affects Firefox ESR < 60.3 and Firefox < 63.

Related Vulnerabilities

CVE-2016-0089

HIGH
CVSS:7.1(High)

Hyper-V in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, and Windows 10 allows guest OS users to obtain sensitive information from host OS memory via a crafted application, aka "Hyper-V Info...

CWE-2002016

CVE-2016-0090

HIGH
CVSS:7.1(High)

Hyper-V in Microsoft Windows 8.1, Windows Server 2012 R2, and Windows 10 allows guest OS users to obtain sensitive information from host OS memory via a crafted application, aka "Hyper-V Information D...

CWE-2002016

CVE-2016-10339

HIGH
CVSS:7.1(High)

In all Android releases from CAF using the Linux kernel, HLOS can overwite secure memory or read contents of the keystore.

CWE-2002016

CVE-2016-1360

HIGH
CVSS:7.1(High)

Cisco Prime LAN Management Solution (LMS) through 4.2.5 uses the same database decryption key across different customers' installations, which allows local users to obtain cleartext data by leveraging...

CWE-2002016

CVE-2016-2015

HIGH
CVSS:7.1(High)

HPE System Management Homepage before 7.5.5 allows local users to obtain sensitive information or modify data via unspecified vectors.

CWE-2002016

CVE-2016-4660

HIGH
CVSS:7.1(High)

An issue was discovered in certain Apple products. iOS before 10.1 is affected. macOS before 10.12.1 is affected. tvOS before 10.0.1 is affected. watchOS before 3.1 is affected. The issue involves the...

CWE-2002016