CVSS: 8.8EPSS: 1%CPEs: 2EXPL: 0CVE-2017-6991 – Apple Safari WebSQL Type Confusion Information Disclosure Vulnerability
https://notcve.org/view.php?id=CVE-2017-6991
The issue results from the lack of proper validation of user-supplied data, which can result in a type confusion condition. • http://www.securitytracker.com/id/1038484 https://support.apple.com/HT207797 https://support.apple.com/HT207798 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 7.6EPSS: 10%CPEs: 1EXPL: 0CVE-2017-0266 – Microsoft Windows JavaScript Array Type Confusion Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2017-0266
By performing actions in JavaScript an attacker can trigger a type confusion condition. • http://www.securityfocus.com/bid/98276 https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0266 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 7.3EPSS: 1%CPEs: 12EXPL: 8CVE-2017-0213 – Microsoft Windows Privilege Escalation Vulnerability
https://notcve.org/view.php?id=CVE-2017-0213
Microsoft Windows suffers from a COM aggregate marshaler/IRemUnknown2 type confusion privilege escalation vulnerability. • https://www.exploit-db.com/exploits/42020 https://github.com/zcgonvh/CVE-2017-0213 https://github.com/eonrickity/CVE-2017-0213 https://github.com/shaheemirza/CVE-2017-0213- https://github.com/jbooz1/CVE-2017-0213 https://github.com/billa3283/CVE-2017-0213 https://github.com/Anonymous-Family/CVE-2017-0213 https://github.com/Jos675/CVE-2017-0213-Exploit http://www.securityfocus.com/bid/98102 http://www.securitytracker.com/id/1038457 https://portal.msrc.microsoft.com&# •
CVSS: 9.3EPSS: 91%CPEs: 15EXPL: 4CVE-2017-0290 – Microsoft Security Essentials / SCEP (Microsoft Windows 8/8.1/10 / Windows Server) - 'MsMpEng' Remote Type Confusion
https://notcve.org/view.php?id=CVE-2017-0290
The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 does not properly scan a specially crafted file leading to memory corruption, aka "Microsoft Malware Protection Engine Remote Code Execution Vulnerability." El motor de protección de malware de Microsoft que se ejecuta en Microsoft Forefront y Microsoft Defender en Microsoft Windows Server 2008 SP2 y R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold y R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607 y 1703 , y Windows Server 2016 no analiza correctamente un archivo especialmente diseñado que provoca daños en la memoria, también conocido como "Vulnerabilidad de ejecución remota de código de Microsoft Malware Protection Engine". • https://www.exploit-db.com/exploits/41975 https://github.com/homjxi0e/CVE-2017-0290- http://www.securityfocus.com/bid/98330 http://www.securitytracker.com/id/1038419 http://www.securitytracker.com/id/1038420 https://0patch.blogspot.si/2017/05/0patching-worst-windows-remote-code.html https://arstechnica.com/information-technology/2017/05/windows-defender-nscript-remote-vulnerability https://bugs.chromium.org/p/project-zero/issues/detail?id=1252 https://portal.msrc.microsoft.com/en-US/ • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 7.8EPSS: 52%CPEs: 20EXPL: 2CVE-2017-8291 – Artifex Ghostscript Type Confusion Vulnerability
https://notcve.org/view.php?id=CVE-2017-8291
Artifex Ghostscript through 2017-04-26 allows -dSAFER bypass and remote command execution via .rsdparams type confusion with a "/OutputFile (%pipe%" substring in a crafted .eps document that is an input to the gs program, as exploited in the wild in April 2017. Artifex Ghostscript permite sobrepasar -dSAFER y la ejecución de comandos remotos a través de una vulnerabilidad de type confusion en .rsdparams con una subcadena "/ OutputFile (% pipe%" en un documento .eps que se utilice como entrada al gs. ... Artifex Ghostscript allows -dSAFER bypass and remote command execution via .rsdparams type confusion with a "/OutputFile. • https://www.exploit-db.com/exploits/41955 http://openwall.com/lists/oss-security/2017/04/28/2 http://www.debian.org/security/2017/dsa-3838 http://www.securityfocus.com/bid/98476 https://access.redhat.com/errata/RHSA-2017:1230 https://bugs.ghostscript.com/show_bug.cgi?id=697808 https://bugzilla.redhat.com/show_bug.cgi?id=1446063 https://bugzilla.suse.com/show_bug.cgi?id=1036453 https://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=04b37bbce174eed24edec7ad5b920eb93db4d47d • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') CWE-843: Access of Resource Using Incompatible Type ('Type Confusion') •