CVE-2018-16983

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

NoScript Classic before 5.1.8.7, as used in Tor Browser 7.x and other products, allows attackers to bypass script blocking via the text/html;/json Content-Type value.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://noscript.net/getit#classicRelease Notes
https://twitter.com/Zerodium/status/1039127214602641409Third Party Advisory
https://www.zdnet.com/article/exploit-vendor-drops-tor-browser-zero-day-on-twitter/Third Party Advisory
https://noscript.net/getit#classicRelease Notes
https://twitter.com/Zerodium/status/1039127214602641409Third Party Advisory
https://www.zdnet.com/article/exploit-vendor-drops-tor-browser-zero-day-on-twitter/Third Party Advisory

Timeline

Published: Sep 13, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-169844.9An issue was discovered in Django 2.1 before 2.1.2, in which unprivileged users can read the password hashes of arbitrary accounts. The read CVE-2018-169857.5In Lizard (formerly LZ5) 2.0, use of an invalid memory address was discovered in LZ5_compress_continue in lz5_compress.c, related to LZ5_com CVE-2018-169868.8Texas Instruments BLE-STACK v2.2.1 for SimpleLink CC2640 and CC2650 devices allows remote attackers to execute arbitrary code via a malforme CVE-2018-169877.2Squash TM through 1.18.0 presents the cleartext passwords of external services in the administration panel, as demonstrated by a ta-server-p CVE-2018-169889.8An issue was discovered in Open XDMoD through 7.5.0. An authentication bypass (account takeover) exists due to a weak password reset mechani CVE-2018-16998.8IBM Maximo Asset Management 7.6 through 7.6.3 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements,CVE-2018-169947.5An issue was discovered on PHOENIX CONTACT AXL F BK PN <=1.0.4, AXL F BK ETH <= 1.12, and AXL F BK ETH XC <= 1.11 devices and Bosch Rexroth CVE-2018-169995.5Netwide Assembler (NASM) 2.14rc15 has an invalid memory write (segmentation fault) in expand_smacro in preproc.c, which allows attackers to CVE-2018-170006.5A NULL pointer dereference in the function _TIFFmemcmp at tif_unix.c (called from TIFFWriteDirectoryTagTransferfunction) in LibTIFF 4.0.9 al CVE-2018-170016.1On the RICOH SP 4510SF printer, HTML Injection and Stored XSS vulnerabilities have been discovered in the area of adding addresses via the e CVE-2018-170026.1On the RICOH MP 2001 printer, HTML Injection and Stored XSS vulnerabilities have been discovered in the area of adding addresses via the ent CVE-2018-170036.1In LimeSurvey 3.14.7, HTML Injection and Stored XSS have been discovered in the appendix via the surveyls_title parameter to /index.php?r=ad