CVE-2018-8319

highPriorität · verfolgen · 42EPSS 0.077 · 95. PerzentilEUUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

7.72% (95th) EPSS

CVSS 7.5 · high

Is it mine?

3 products

Prüfe deine Angriffsfläche

Who says so?

4 sources

cnnvd · enisa_euvd · nvd · osv

EPSS · bewertet 2026-10-26

A Security Feature Bypass vulnerability exists in MSR JavaScript Cryptography Library that is caused by incorrect arithmetic computations, aka "MSR JavaScript Cryptography Library Security Feature Bypass Vulnerability." This affects Microsoft Research JavaScript Cryptography Library.

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

9.8

010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · high–critical · 7.5–9.8

v2.07.5highAV:N/AC:L/Au:N/C:P/I:P/A:Pprimary · NVD / NIST USAusnutzbarkeit 10 · Auswirkung 6.4

v3.09.8criticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hprimary · NVD / NIST USAusnutzbarkeit 3.9 · Auswirkung 5.9

v3.09.8criticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · OSV

v3.09criticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-682USprimärCWE-682US

betroffene Produkte (3)

Betroffene Produkte und Versionsbereiche.

Microsoft Microsoft Research JavaScript Cryptography Library≤ Microsoft Research JavaScript Cryptography Libraryenisa_euvdEU
microsoft research javascript cryptography library= 1.4nvdUScpe:2.3:a:microsoft:research_javascript_cryptography_library:*:*:*:*:*:*:*:*
npm msrcrypto< 1.4.1osvUSpkg:npm/msrcrypto

Advisories (1)

Hersteller- und Ökosystem-Meldungen dazu.

GHSA-qg3g-2mgh-33j8Sensitive Data Exposure in msrcrypto2018-09-10ghsa · osvUS
Versions of `msrcrypto` prior to 1.4.1 are vulnerable to Sensitive Data Exposure. The package's Elliptic Curve Cryptography (ECC) implementation may leak information about a server's private ECC key. It can also allow attackers to craft invalid ECDSA signatures that pass as valid. There is no published proof-of-concept for this vulnerability. ## Recommendation Upgrade to version 1.4.1 or later.

auch bekannt als (3)

Weitere Namen und Kennungen dieser Entität.

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvd enisa_euvd nvd osv NVD CVE.org MITRE

veröffentlicht 2018-07-11geändert 2026-06-17

verwandt (254)

Verwandte Einträge.

ID	Schweregrad	EPSS	ausnutzbar	veröffentlicht
CVE-2022-30780US	high7.5	57.2% (99th)	Exploit	2022-06-11
Lighttpd 1.4.56 through 1.4.58 allows a remote attacker to cause a denial of service (CPU consumption from stuck connections) because connection_read_header_more in connections.c h…
CVE-2016-0777US	medium6.5	63.5% (99th)	Exploit	2016-01-14
The resend_bytes function in roaming_common.c in the client in OpenSSH 5.x, 6.x, and 7.x before 7.1p2 allows remote servers to obtain sensitive information from process memory by r…
CVE-2017-7376US	critical9.8	23.0% (98th)	Exploit	2018-02-19
Buffer overflow in libxml2 allows remote attackers to execute arbitrary code by leveraging an incorrect limit for port values when handling redirects.
CVE-2022-30600US	critical9.8	4.97% (92nd)	Exploit	2022-05-18
A flaw was found in moodle where logic used to count failed login attempts could result in the account lockout threshold being bypassed.
CVE-2021-45960US	high8.8	4.67% (92nd)	Exploit	2022-01-01
In Expat (aka libexpat) before 2.4.3, a left shift by 29 (or more) places in the storeAtts function in xmlparse.c can lead to realloc misbehavior (e.g., allocating too few bytes, o…

+249 weitere

Referenzen (7)

Externe Belege — Patches, Meldungen, Analysen.

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8319 cnnvd
http://www.securityfocus.com/bid/104655 enisa_euvd
http://www.securitytracker.com/id/1041268 enisa_euvd
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8319 enisa_euvd
http://www.securityfocus.com/bid/104655Third Party AdvisoryVDB Entrynvd
http://www.securitytracker.com/id/1041268Third Party AdvisoryVDB Entrynvd
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8319PatchVendor Advisorynvd

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan