An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. tvOS before 10.2 is affected. The issue involves the “WebKit” component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.

An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. tvOS before 10.2 is affected. The issue involves the “WebKit” component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.

An issue was discovered in certain Apple products. macOS before 10.12.4 is affected. The issue involves the “AppleGraphicsPowerManagement” component. A race condition allows attackers to execute arbitrary code in a privileged context via a crafted app.

An issue was discovered in certain Apple products. macOS before 10.12.4 is affected. The issue involves the “IOFireWireFamily” component. It allows attackers to cause a denial of service (NULL pointer dereference) via a crafted app.

In TigerVNC 1.7.1 (SSecurityPlain.cxx SSecurityPlain::processMsg), unauthenticated users can crash the server by sending long usernames.

In TigerVNC 1.7.1 (SMsgReader.cxx SMsgReader::readClientCutText), by causing an integer overflow, an authenticated client can crash the server.

A Cross-Site Scripting (XSS) was discovered in ‘SocialNetwork v1.2.1’. The vulnerability exists due to insufficient filtration of user-supplied data (mail) passed to the ‘SocialNetwork-andrea/app/template/pw_forgot.php’ URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website.

In TigerVNC 1.7.1 (CConnection.cxx CConnection::CConnection), an unauthenticated client can cause a small memory leak in the server.

Multiple Cross-Site Scripting (XSS) were discovered in ‘openeclass Release_3.5.4’. The vulnerabilities exist due to insufficient filtration of user-supplied data (meeting_id, user) passed to the ‘openeclass-master/modules/tc/webconf/webconf.php’ URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website.

A Cross-Site Scripting (XSS) was discovered in ‘wallacepos v1.4.1’. The vulnerability exists due to insufficient filtration of user-supplied data (token) passed to the ‘wallacepos-master/myaccount/resetpassword.php’ URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website.