LE
Product
Leap
On CISA KEVExploited in the wildRansomware-linked
1,893
CVEs
19
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 193High 302Medium 5Low 0
Watch
Add Leap to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2016-5150 | 8.8 | Sep 11 | WebKit/Source/bindings/modules/v8/V8BindingForModules.cpp in Blink, as used in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux, has an… Affected: 42.1 |
| CVE-2016-5149 | 8.8 | Sep 11 | The extensions subsystem in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux relies on an IFRAME source URL to identify an associated… Affected: 42.1 |
| CVE-2016-4069 | 8.8 | Aug 25 | Cross-site request forgery (CSRF) vulnerability in Roundcube Webmail before 1.1.5 allows remote attackers to hijack the authentication of users for requests that download… Affected: 42.1 |
| CVE-2016-5131 | 8.8 | Jul 23 | Use-after-free vulnerability in libxml2 through 2.9.4, as used in Google Chrome before 52.0.2743.82, allows remote attackers to cause a denial of service or possibly have… Affected: 42.1 |
| CVE-2016-1704 | 8.8 | Jul 3 | Multiple unspecified vulnerabilities in Google Chrome before 51.0.2704.103 allow attackers to cause a denial of service or possibly have other impact via unknown vectors Affected: 42.1 |
| CVE-2016-3062 | 8.8 | Jun 16 | The mov_read_dref function in libavformat/mov.c in Libav before 11.7 and FFmpeg before 0.11 allows remote attackers to cause a denial of service (memory corruption) or execute… Affected: 42.1 |
| CVE-2016-2834 | 8.8 | Jun 13 | Mozilla Network Security Services (NSS) before 3.23, as used in Mozilla Firefox before 47.0, allows remote attackers to cause a denial of service (memory corruption and… Affected: 42.1 |
| CVE-2016-2831 | 8.8 | Jun 13 | Mozilla Firefox before 47.0 and Firefox ESR 45.x before 45.2 do not ensure that the user approves the fullscreen and pointerlock settings, which allows remote attackers to cause a… Affected: 42.1 |
| CVE-2016-2828 | 8.8 | Jun 13 | Use-after-free vulnerability in Mozilla Firefox before 47.0 and Firefox ESR 45.x before 45.2 allows remote attackers to execute arbitrary code via WebGL content that triggers… Affected: 42.1 |
| CVE-2016-2824 | 8.8 | Jun 13 | The TSymbolTableLevel class in ANGLE, as used in Mozilla Firefox before 47.0 and Firefox ESR 45.x before 45.2 on Windows, allows remote attackers to cause a denial of service… Affected: 42.1 |
| CVE-2016-2819 | 8.8 | Jun 13 | Heap-based buffer overflow in Mozilla Firefox before 47.0 and Firefox ESR 45.x before 45.2 allows remote attackers to execute arbitrary code via foreign-context HTML5 fragments,… Affected: 42.1 |
| CVE-2016-2818 | 8.8 | Jun 13 | Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 47.0 and Firefox ESR 45.x before 45.2 allow remote attackers to cause a denial of service… Affected: 42.1 |
| CVE-2016-2815 | 8.8 | Jun 13 | Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 47.0 allow remote attackers to cause a denial of service (memory corruption and application… Affected: 42.1 |
| CVE-2016-1703 | 8.8 | Jun 5 | Multiple unspecified vulnerabilities in Google Chrome before 51.0.2704.79 allow attackers to cause a denial of service or possibly have other impact via unknown vectors Affected: 42.1 |
| CVE-2016-1701 | 8.8 | Jun 5 | The Autofill implementation in Google Chrome before 51.0.2704.79 mishandles the interaction between field updates and JavaScript code that triggers a frame deletion, which allows… Affected: 42.1 |
| CVE-2016-1697 | 8.8 | Jun 5 | The FrameLoader::startLoad function in WebKit/Source/core/loader/FrameLoader.cpp in Blink, as used in Google Chrome before 51.0.2704.79, does not prevent frame navigations during… Affected: 42.1 |
| CVE-2016-1696 | 8.8 | Jun 5 | The extensions subsystem in Google Chrome before 51.0.2704.79 does not properly restrict bindings access, which allows remote attackers to bypass the Same Origin Policy via… Affected: 42.1 |
| CVE-2016-1695 | 8.8 | Jun 5 | Multiple unspecified vulnerabilities in Google Chrome before 51.0.2704.63 allow attackers to cause a denial of service or possibly have other impact via unknown vectors Affected: 42.1 |
| CVE-2016-1681 | 8.8 | Jun 5 | Heap-based buffer overflow in the opj_j2k_read_SPCod_SPCoc function in j2k.c in OpenJPEG, as used in PDFium in Google Chrome before 51.0.2704.63, allows remote attackers to cause… Affected: 42.1 |
| CVE-2016-1680 | 8.8 | Jun 5 | Use-after-free vulnerability in ports/SkFontHost_FreeType.cpp in Skia, as used in Google Chrome before 51.0.2704.63, allows remote attackers to cause a denial of service (heap… Affected: 42.1 |
| CVE-2016-1679 | 8.8 | Jun 5 | The ToV8Value function in content/child/v8_value_converter_impl.cc in the V8 bindings in Google Chrome before 51.0.2704.63 does not properly restrict use of getters and setters,… Affected: 42.1 |
| CVE-2016-1678 | 8.8 | Jun 5 | objects.cc in Google V8 before 5.0.71.32, as used in Google Chrome before 51.0.2704.63, does not properly restrict lazy deoptimization, which allows remote attackers to cause a… Affected: 42.1 |
| CVE-2016-1676 | 8.8 | Jun 5 | extensions/renderer/resources/binding.js in the extension bindings in Google Chrome before 51.0.2704.63 does not properly use prototypes, which allows remote attackers to bypass… Affected: 42.1 |
| CVE-2016-1675 | 8.8 | Jun 5 | Blink, as used in Google Chrome before 51.0.2704.63, allows remote attackers to bypass the Same Origin Policy by leveraging the mishandling of Document reattachment during… Affected: 42.1 |
| CVE-2016-1674 | 8.8 | Jun 5 | The extensions subsystem in Google Chrome before 51.0.2704.63 allows remote attackers to bypass the Same Origin Policy via unspecified vectors Affected: 42.1 |
| CVE-2016-1673 | 8.8 | Jun 5 | Blink, as used in Google Chrome before 51.0.2704.63, allows remote attackers to bypass the Same Origin Policy via unspecified vectors Affected: 42.1 |
| CVE-2016-1672 | 8.8 | Jun 5 | The ModuleSystem::RequireForJsInner function in extensions/renderer/module_system.cc in the extension bindings in Google Chrome before 51.0.2704.63 mishandles properties, which… Affected: 42.1 |
| CVE-2016-4342 | 8.8 | May 22 | ext/phar/phar_object.c in PHP before 5.5.32, 5.6.x before 5.6.18, and 7.x before 7.0.3 mishandles zero-length uncompressed data, which allows remote attackers to cause a denial of… Affected: 42.1 |
| CVE-2016-2807 | 8.8 | Apr 30 | Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 46.0, Firefox ESR 38.x before 38.8, and Firefox ESR 45.x before 45.1 allow remote attackers to… Affected: 42.1 |
| CVE-2016-2806 | 8.8 | Apr 30 | Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 46.0 and Firefox ESR 45.x before 45.1 allow remote attackers to cause a denial of service… Affected: 42.1 |
| CVE-2016-1655 | 8.8 | Apr 18 | Google Chrome before 50.0.2661.75 does not properly consider that frame removal may occur during callback execution, which allows remote attackers to cause a denial of service… Affected: 42.1 |
| CVE-2016-1653 | 8.8 | Apr 18 | The LoadBuffer implementation in Google V8, as used in Google Chrome before 50.0.2661.75, mishandles data types, which allows remote attackers to cause a denial of service or… Affected: 42.1 |
| CVE-2016-2313 | 8.8 | Apr 13 | auth_login.php in Cacti before 0.8.8g allows remote authenticated users who use web authentication to bypass intended access restrictions by logging in as a user not in the cacti… Affected: 42.1 |
| CVE-2016-3982 | 8.8 | Apr 13 | Off-by-one error in the bmp_rle4_fread function in pngxrbmp.c in OptiPNG before 0.7.6 allows remote attackers to cause a denial of service (out-of-bounds read or write access and… Affected: 42.1 |
| CVE-2016-3630 | 8.8 | Apr 13 | The binary delta decoder in Mercurial before 3.7.3 allows remote attackers to execute arbitrary code via a (1) clone, (2) push, or (3) pull command, related to (a) a list sizing… Affected: 42.1 |
| CVE-2016-3069 | 8.8 | Apr 13 | Mercurial before 3.7.3 allows remote attackers to execute arbitrary code via a crafted name when converting a Git repository Affected: 42.1 |
| CVE-2016-3068 | 8.8 | Apr 13 | Mercurial before 3.7.3 allows remote attackers to execute arbitrary code via a crafted git ext:: URL when cloning a subrepository Affected: 42.1 |
| CVE-2016-1645 | 8.8 | Mar 13 | Multiple integer signedness errors in the opj_j2k_update_image_data function in j2k.c in OpenJPEG, as used in PDFium in Google Chrome before 49.0.2623.87, allow remote attackers… Affected: 42.1 |
| CVE-2016-2802 | 8.8 | Mar 13 | The graphite2::TtfUtil::CmapSubtable4NextCodepoint function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote… Affected: 42.1 |
| CVE-2016-2801 | 8.8 | Mar 13 | The graphite2::TtfUtil::CmapSubtable12Lookup function in TtfUtil.cpp in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows… Affected: 42.1 |
| CVE-2016-2800 | 8.8 | Mar 13 | The graphite2::Slot::getAttr function in Slot.cpp in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to… Affected: 42.1 |
| CVE-2016-2799 | 8.8 | Mar 13 | Heap-based buffer overflow in the graphite2::Slot::setAttr function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows… Affected: 42.1 |
| CVE-2016-2798 | 8.8 | Mar 13 | The graphite2::GlyphCache::Loader::Loader function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to… Affected: 42.1 |
| CVE-2016-2797 | 8.8 | Mar 13 | The graphite2::TtfUtil::CmapSubtable12Lookup function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers… Affected: 42.1 |
| CVE-2016-2796 | 8.8 | Mar 13 | Heap-based buffer overflow in the graphite2::vm::Machine::Code::Code function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7,… Affected: 42.1 |
| CVE-2016-2795 | 8.8 | Mar 13 | The graphite2::FileFace::get_table_fn function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, does not initialize memory for… Affected: 42.1 |
| CVE-2016-2794 | 8.8 | Mar 13 | The graphite2::TtfUtil::CmapSubtable12NextCodepoint function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote… Affected: 42.1 |
| CVE-2016-2793 | 8.8 | Mar 13 | CachedCmap.cpp in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to cause a denial of service (buffer… Affected: 42.1 |
| CVE-2016-2792 | 8.8 | Mar 13 | The graphite2::Slot::getAttr function in Slot.cpp in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to… Affected: 42.1 |
| CVE-2016-2791 | 8.8 | Mar 13 | The graphite2::GlyphCache::glyph function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to cause a… Affected: 42.1 |
The 500 most important CVEs for this product (exploited first, then by severity)