2018 CVEs (page 10)
Page 10 of 162 — CVEs published in 2018, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2018-21140 | Medium | 6.5 | 2020-04-21 | Certain NETGEAR devices are affected by incorrect configuration of security settings. This affects D3600 before 1.0.0.76 and D6000 before 1.0.0.76. |
CVE-2018-6402 | High | 7.5 | 2020-04-14 | Ecobee Ecobee4 4.2.0.171 devices can be forced to deauthenticate and connect to an unencrypted Wi-Fi network with the same SSID, even if the device settings sp… |
CVE-2018-21034 | Medium | 6.5 | 2020-04-09 | In Argo versions prior to v1.5.0-rc1, it was possible for authenticated Argo users to submit API calls to retrieve secrets and other manifests which were store… |
CVE-2018-21080 | Medium | 4.6 | 2020-04-08 | An issue was discovered on Samsung mobile devices with N(7.x) software. A physically proximate attacker wielding a magnet can activate NFC to bypass the locksc… |
CVE-2018-21079 | High | 7.5 | 2020-04-08 | An issue was discovered on Samsung mobile devices with L(5.x), M(6.0), N(7.x), and O(8.0) software. There is a kernel pointer leak in the USB gadget driver. Th… |
CVE-2018-21078 | High | 7.5 | 2020-04-08 | An issue was discovered on Samsung mobile devices with M(6.0), N(7.x), and O(8.0) software. The Contacts application allows attackers to originate video calls… |
CVE-2018-21077 | Low | 2.4 | 2020-04-08 | An issue was discovered on Samsung mobile devices with M(6.0), N(7.x), and O(8.x) software. There is a Clipboard content disclosure in the locked state because… |
CVE-2018-21076 | Medium | 5.5 | 2020-04-08 | An issue was discovered on Samsung mobile devices with N(7.x) (Exynos8890/8895 chipsets) software. There is information disclosure (a KASLR offset) in the Secu… |
CVE-2018-21075 | Critical | 9.8 | 2020-04-08 | An issue was discovered on Samsung mobile devices with N(7.x) and O(8.x) software. The Call+ application can load classes from an unintended path, leading to C… |
CVE-2018-21074 | Low | 3.3 | 2020-04-08 | An issue was discovered on Samsung mobile devices with M(6.x) (Exynos or Qualcomm chipsets) software. There is information disclosure from a Trustlet via the d… |
CVE-2018-21073 | Low | 2.4 | 2020-04-08 | An issue was discovered on Samsung mobile devices with N(7.x) and O(8.0) (Galaxy S9+, Galaxy S9, Galaxy S8+, Galaxy S8, Note 8). There is access to Clipboard c… |
CVE-2018-21072 | Critical | 9.8 | 2020-04-08 | An issue was discovered on Samsung mobile devices with M(6.0), N(7.x), and O(8.0) (Exynos chipsets) software. A kernel driver allows out-of-bounds Read/Write o… |
CVE-2018-21071 | High | 7.3 | 2020-04-08 | An issue was discovered on Samsung mobile devices with M(6.0) software. Because of an unprotected intent, an attacker can read arbitrary files and emails, and… |
CVE-2018-21070 | High | 8.4 | 2020-04-08 | An issue was discovered on Samsung mobile devices with N(7.x), O(8.0) devices (MSM8998 or SDM845 chipsets) software. An attacker can bypass Secure Boot and obt… |
CVE-2018-21069 | High | 7.5 | 2020-04-08 | An issue was discovered on Samsung mobile devices with N(7.x) (MediaTek chipsets) software. There is information disclosure (of kernel stack memory) in a Media… |
CVE-2018-21068 | Medium | 6.2 | 2020-04-08 | An issue was discovered on Samsung mobile devices with O(8.0) software. Execution of an application in a locked Secure Folder can occur without a password via… |
CVE-2018-21067 | Medium | 5.3 | 2020-04-08 | An issue was discovered on Samsung mobile devices with M(6.0) software. There is an information disclosure in a Trustlet because an address is logged. The Sams… |
CVE-2018-21066 | Critical | 9.8 | 2020-04-08 | An issue was discovered on Samsung mobile devices with M(6.0) (Exynos or MediaTek chipsets) software. There is a buffer overflow in a Trustlet that can cause m… |
CVE-2018-21065 | Critical | 9.8 | 2020-04-08 | An issue was discovered on Samsung mobile devices with M(6.0), N(7.x), and O(8.x) software. There is an integer underflow in eCryptFS because of a missing size… |
CVE-2018-21064 | Critical | 9.8 | 2020-04-08 | An issue was discovered on Samsung mobile devices with N(7.x) and O(8.x) software. There is an array overflow in a driver's input booster. The Samsung ID is SV… |
CVE-2018-21063 | Critical | 9.8 | 2020-04-08 | An issue was discovered on Samsung mobile devices with M(6.0), N(7.x), and O(8.x) (Exynos chipsets) software. Keymaster has an architectural problem because tl… |
CVE-2018-21062 | Medium | 4.6 | 2020-04-08 | An issue was discovered on Samsung mobile devices with N(7.x) and O(8.x) software. When biometric authentication is disabled, an attacker can view Streams cont… |
CVE-2018-21061 | Medium | 6.8 | 2020-04-08 | An issue was discovered on Samsung mobile devices with N(7.1) and O(8.x) software. A fake charger can execute critical functions in the locked state. The Samsu… |
CVE-2018-21060 | High | 7.5 | 2020-04-08 | An issue was discovered on Samsung mobile devices with N(7.x) and O(8.x) software. There is a Keyboard learned words leak in the locked state via the emergency… |
CVE-2018-21059 | High | 7.5 | 2020-04-08 | An issue was discovered on Samsung mobile devices with N(7.x) and O(8.x) software. There is Clipboard content visibility in the locked state via the emergency… |
CVE-2018-21058 | Critical | 9.8 | 2020-04-08 | An issue was discovered on Samsung mobile devices with N(7.0), O(8.0) (exynos7420 or Exynos 8890/8996 chipsets) software. Cache attacks can occur against the K… |
CVE-2018-21057 | Critical | 9.8 | 2020-04-08 | An issue was discovered on Samsung mobile devices with N(7.x) O(8.x, and P(9.0) (Exynos chipsets) software. There is a stack-based buffer overflow in the Shann… |
CVE-2018-21056 | Medium | 4.6 | 2020-04-08 | An issue was discovered on Samsung mobile devices with O(8.x) software. The Smartwatch displays Secure Folder Notification content. The Samsung ID is SVE-2018-… |
CVE-2018-21055 | Critical | 9.8 | 2020-04-08 | An issue was discovered on Samsung mobile devices with N(7.0) (Qualcomm models using MSM8996 chipsets) software. A device can be rooted with a custom image to… |
CVE-2018-21054 | Critical | 9.8 | 2020-04-08 | An issue was discovered on Samsung mobile devices with M(6.0), N(7.x) and O(8.x) except exynos9610/9820 in all Platforms, M(6.0) except MSM8909 SC77xx/9830 exy… |
CVE-2018-21053 | Medium | 4.6 | 2020-04-08 | An issue was discovered on Samsung mobile devices with N(7.x), O(8.x), and P(9.0) software. There is Clipboard access in the lockscreen state via a physical ke… |
CVE-2018-21052 | Critical | 9.8 | 2020-04-08 | An issue was discovered on Samsung mobile devices with N(7.x) and O(8.X) (Exynos chipsets) software. There is incorrect usage of shared memory in the vaultkeep… |
CVE-2018-21051 | Critical | 9.8 | 2020-04-08 | An issue was discovered on Samsung mobile devices with N(7.x) and O(8.x) (Exynos chipsets) software. There is an invalid free in the fingerprint Trustlet, lead… |
CVE-2018-21050 | Critical | 9.8 | 2020-04-08 | An issue was discovered on Samsung mobile devices with N(7.x) and O(8.X) (Exynos chipsets) software. There is a Buffer overflow in the esecomm Trustlet, leadin… |
CVE-2018-21049 | Critical | 9.8 | 2020-04-08 | An issue was discovered on Samsung mobile devices with N(7.x) and O(8.X) (Exynos chipsets) software. There is an arbitrary memory write in a Trustlet because a… |
CVE-2018-21048 | Medium | 6.2 | 2020-04-08 | An issue was discovered on Samsung mobile devices with O(8.x) software. There is a Notification leak on a locked device in Standalone Dex mode. The Samsung ID… |
CVE-2018-21047 | High | 7.5 | 2020-04-08 | An issue was discovered on Samsung mobile devices with O(8.x) software. There is a Factory Reset Protection (FRP) bypass via the voice assistant because Intern… |
CVE-2018-21046 | Low | 2.4 | 2020-04-08 | An issue was discovered on Samsung mobile devices with O(8.x) software. There is clipboard Data Exposure via the Emergency Dialer upon connecting a USB device… |
CVE-2018-21045 | Medium | 6.2 | 2020-04-08 | An issue was discovered on Samsung mobile devices with N(7.x) and O(8.x) software. There is Clipboard access in the lockscreen state via a copy-and-paste actio… |
CVE-2018-21044 | Critical | 9.8 | 2020-04-08 | An issue was discovered on Samsung mobile devices with N(7.x) and O(8.0) software. The sem Trustlet has a buffer overflow that leads to arbitrary TEE code exec… |
CVE-2018-21043 | Low | 3.3 | 2020-04-08 | An issue was discovered on Samsung mobile devices with O(8.x) and P(9.0) (Exynos 9810 chipsets) software. There is information disclosure about a kernel pointe… |
CVE-2018-21042 | Critical | 9.8 | 2020-04-08 | An issue was discovered on Samsung mobile devices with N(7.x), O(8.x), and P(9.0) software. Dual Messenger allows installation of an arbitrary APK with resulta… |
CVE-2018-21041 | High | 7.5 | 2020-04-08 | An issue was discovered on Samsung mobile devices with O(8.x) software. Access to Gallery in the Secure Folder can occur without authentication. The Samsung ID… |
CVE-2018-21040 | High | 8.1 | 2020-04-08 | An issue was discovered on Samsung mobile devices with O(8.x) and P(9.0) (Exynos 9810 chipsets) software. There is a race condition with a resultant use-after-… |
CVE-2018-21039 | High | 7.5 | 2020-04-08 | An issue was discovered on Samsung mobile devices with N(7.0) software. With the Location permission for the compass feature in Quick Tools (aka QuickTools), a… |
CVE-2018-21038 | Critical | 9.8 | 2020-04-08 | An issue was discovered on Samsung mobile devices with N(7.x) software. The Secure Folder app's startup logic allows authentication bypass. The Samsung ID is S… |
CVE-2018-21088 | High | 7.5 | 2020-04-08 | An issue was discovered on Samsung mobile devices with N(7.x) software. An attacker can cause a reboot because InputMethodManagerService has an unprotected sys… |
CVE-2018-21087 | Critical | 9.8 | 2020-04-08 | An issue was discovered on Samsung mobile devices with L(5.x), M(6.x), and N(7.x) software. There is a vnswap heap-based buffer overflow via the store function… |
CVE-2018-21086 | High | 8.1 | 2020-04-08 | An issue was discovered on Samsung mobile devices with L(5.x), M(6.0), and N(7.x) software. There is a race condition with a resultant double free in vnswap_in… |
CVE-2018-21085 | High | 8.1 | 2020-04-08 | An issue was discovered on Samsung mobile devices with L(5.x), M(6.0), and N(7.x) software. There is a race condition with a resultant use-after-free in vnswap… |
CVE-2018-21084 | High | 8.1 | 2020-04-08 | An issue was discovered on Samsung mobile devices with L(5.1), M(6.0), and N(7.x) software. There is a race condition with a resultant read-after-free issue in… |
CVE-2018-21083 | High | 7.5 | 2020-04-08 | An issue was discovered on Samsung mobile devices with M(6.0), N(7.x), and O(8.0) (Exynos or Qualcomm chipsets) software. There is information disclosure (of a… |
CVE-2018-21082 | High | 8.4 | 2020-04-08 | An issue was discovered on Samsung mobile devices with N(7.x) software. Dex Station allows App Pinning bypass and lock-screen bypass via the "Use screen lock t… |
CVE-2018-21081 | Critical | 9.1 | 2020-04-08 | An issue was discovered on Samsung mobile devices with N(7.x) software. In Dual Messenger, the second app can use the runtime permissions of the first app with… |
CVE-2018-21092 | Medium | 6.5 | 2020-04-08 | An issue was discovered on Samsung mobile devices with M(6.x) and N(7.x) software. A crafted AT command may be sent by the DeviceTest application via an NFC ta… |
CVE-2018-21091 | High | 7.5 | 2020-04-08 | An issue was discovered on Samsung mobile devices with M(6.x) and N(7.x) software. Telecom has a System Crash via abnormal exception handling. The Samsung ID i… |
CVE-2018-21090 | Critical | 9.8 | 2020-04-08 | An issue was discovered on Samsung mobile devices with software through 2017-11-03 (S.LSI modem chipsets). The Exynos modem chipset has a baseband buffer overf… |
CVE-2018-21089 | Critical | 9.8 | 2020-04-08 | An issue was discovered on Samsung mobile devices with N(7.x) (MT6755/MT6757 Mediatek models) software. Bootloader has an integer overflow that leads to arbitr… |
CVE-2018-17954 | Critical | 9.3 | 2020-04-03 | An Improper Privilege Management in crowbar of SUSE OpenStack Cloud 7, SUSE OpenStack Cloud 8, SUSE OpenStack Cloud 9, SUSE OpenStack Cloud Crowbar 8, SUSE Ope… |
CVE-2018-13371 | High | 8.8 | 2020-04-02 | An external control of system vulnerability in FortiOS may allow an authenticated, regular user to change the routing settings of the device via connecting to… |
CVE-2018-11802 | Medium | 4.3 | 2020-04-01 | In Apache Solr, the cluster can be partitioned into multiple collections and only a subset of nodes actually host any given collection. However, if a node rece… |
CVE-2018-11106 | Critical | 9.8 | 2020-04-01 | NETGEAR has released fixes for a pre-authentication command injection in request_handler.php security vulnerability on the following product models: WC7500, ru… |
CVE-2018-20335 | High | 7.5 | 2020-03-20 | An issue was discovered in ASUSWRT 3.0.0.4.384.20308. An unauthenticated user can trigger a DoS of the httpd service via the /APP_Installation.asp?= URI. |
CVE-2018-20334 | Critical | 9.8 | 2020-03-20 | An issue was discovered in ASUSWRT 3.0.0.4.384.20308. When processing the /start_apply.htm POST data, there is a command injection issue via shell metacharacte… |
CVE-2018-20333 | High | 7.5 | 2020-03-20 | An issue was discovered in ASUSWRT 3.0.0.4.384.20308. An unauthenticated user can request /update_applist.asp to see if a USB device is attached to the router… |
CVE-2018-21037 | High | 8.8 | 2020-03-17 | Subrion CMS 4.1.5 (and possibly earlier versions) allow CSRF to change the administrator password via the panel/members/edit/1 URI. |
CVE-2018-18576 | Medium | 5.3 | 2020-03-17 | The Hustle (aka wordpress-popup) plugin through 6.0.5 for WordPress allows Directory Traversal to obtain a directory listing via the views/admin/dashboard/ URI. |
CVE-2018-13063 | High | 7.5 | 2020-03-16 | Easy!Appointments 1.3.0 has a Missing Authorization issue allowing retrieval of hashed passwords and salts. |
CVE-2018-13060 | Medium | 6.5 | 2020-03-16 | Easy!Appointments 1.3.0 has a Guessable CAPTCHA issue. |
CVE-2018-10125 | Medium | 6.1 | 2020-03-16 | Contao before 4.5.7 has XSS in the system log. |
CVE-2018-20586 | Medium | 5.3 | 2020-03-12 | bitcoind and Bitcoin-Qt prior to 0.17.1 allow injection of arbitrary data into the debug log via an RPC call. |
CVE-2018-19516 | Medium | 5.3 | 2020-03-12 | messagepartthemes/default/defaultrenderer.cpp in messagelib in KDE Applications before 18.12.0 does not properly restrict the handling of an http-equiv="REFRES… |
CVE-2018-10704 | Medium | 6.1 | 2020-03-12 | yidashi yii2cmf 2.0 has XSS via the /search q parameter. |
CVE-2018-18894 | High | 7.5 | 2020-03-10 | Certain older Lexmark devices (C, M, X, and 6500e before 2018-12-18) contain a directory traversal vulnerability in the embedded web server. |
CVE-2018-14502 | Critical | 9.8 | 2020-03-10 | controllers/quizzes.php in the Kiboko Chained Quiz plugin before 1.0.9 for WordPress allows remote unauthenticated users to execute arbitrary SQL commands via… |
CVE-2018-11838 | High | 7.8 | 2020-03-05 | Possible double free issue in WLAN due to lack of checking memory free condition. in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Conne… |
CVE-2018-5951 | High | 7.5 | 2020-03-02 | An issue was discovered in Mikrotik RouterOS. Crafting a packet that has a size of 1 byte and sending it to an IPv6 address of a RouterOS box with IP Protocol… |
CVE-2018-20343 | High | 7.8 | 2020-03-02 | Multiple buffer overflow vulnerabilities have been found in Ken Silverman Build Engine 1. An attacker could craft a special map file to execute arbitrary code… |
CVE-2018-19798 | High | 8.8 | 2020-03-02 | Fleetco Fleet Maintenance Management (FMM) 1.2 and earlier allows uploading an arbitrary ".php" file with the application/x-php Content-Type to the accidents_a… |
CVE-2018-19658 | Medium | 5.4 | 2020-03-02 | The Markdown editor in YXBJ before 8.3.2 on macOS has stored XSS. This behavior may be encountered by some Evernote users; however, it is a vulnerability in YX… |
CVE-2018-19599 | Medium | 5.4 | 2020-03-02 | Monstra CMS 1.6 allows XSS via an uploaded SVG document to the admin/index.php?id=filesmanager&path=uploads/ URI. NOTE: this is a discontinued product. |
CVE-2018-17572 | Medium | 4.8 | 2020-03-02 | InfluxDB 0.9.5 has Reflected XSS in the Write Data module. |
CVE-2018-16357 | Critical | 9.8 | 2020-03-02 | An issue was discovered in PbootCMS. There is a SQL injection via the api.php/Cms/search order parameter. |
CVE-2018-16356 | Critical | 9.8 | 2020-03-02 | An issue was discovered in PbootCMS. There is a SQL injection via the api.php/List/index order parameter. |
CVE-2018-15820 | Medium | 6.1 | 2020-03-02 | EasyIO EasyIO-30P devices before 2.0.5.27 allow XSS via the dev.htm GDN parameter. |
CVE-2018-15819 | High | 7.5 | 2020-03-02 | EasyIO EasyIO-30P devices before 2.0.5.27 have Incorrect Access Control, related to webuser.js. |
CVE-2018-14384 | Medium | 4.8 | 2020-03-02 | The Website Manager module in SEO Panel 3.13.0 and earlier is affected by a stored Cross-Site Scripting (XSS) vulnerability, allowing remote authenticated atta… |
CVE-2018-17058 | High | 8.8 | 2020-03-02 | An issue was discovered in JABA XPress Online Shop through 2018-09-14. It contains an arbitrary file upload vulnerability in the picture-upload feature of Prod… |
CVE-2018-21035 | High | 7.5 | 2020-02-28 | In Qt through 5.14.1, the WebSocket implementation accepts up to 2GB for frames and 2GB for messages. Smaller limits cannot be configured. This makes it easier… |
CVE-2018-8878 | Medium | 5.3 | 2020-02-27 | Information disclosure in Asuswrt-Merlin firmware for ASUS devices older than 384.4 and ASUS firmware before 3.0.0.4.382.50470 for devices allows remote attack… |
CVE-2018-8877 | Medium | 5.3 | 2020-02-27 | Information disclosure in Asuswrt-Merlin firmware for ASUS devices older than 384.4 and ASUS firmware before 3.0.0.4.382.50470 for devices allows remote attack… |
CVE-2018-14705 | Critical | 9.8 | 2020-02-24 | In Drobo 5N2 4.0.5, all optional applications lack any form of authentication/authorization validation. As a result, any user capable of accessing the device o… |
CVE-2018-13313 | Medium | 6.5 | 2020-02-24 | In TOTOLINK A3002RU 1.0.8, the router provides a page that allows the user to change their account name and password. This page, password.htm, contains JavaScr… |
CVE-2018-16994 | High | 7.5 | 2020-02-18 | An issue was discovered on PHOENIX CONTACT AXL F BK PN <=1.0.4, AXL F BK ETH <= 1.12, and AXL F BK ETH XC <= 1.11 devices and Bosch Rexroth S20-ETH-BK and Rexr… |
CVE-2018-21033 | Medium | 6.5 | 2020-02-14 | A vulnerability in Hitachi Command Suite prior to 8.6.2-00, Hitachi Automation Director prior to 8.6.2-00 and Hitachi Infrastructure Analytics Advisor prior to… |
CVE-2018-21032 | Medium | 4.3 | 2020-02-14 | A vulnerability in Hitachi Command Suite prior to 8.7.1-00 and Hitachi Automation Director prior to 8.5.0-00 allow authenticated remote users to expose technic… |
CVE-2018-3987 | Medium | 5.5 | 2020-02-13 | An exploitable information disclosure vulnerability exists in the 'Secret Chats' functionality of Rakuten Viber on Android 9.3.0.6. The 'Secret Chats' function… |
CVE-2018-14553 | High | 7.5 | 2020-02-11 | gdImageClone in gd.c in libgd 2.1.0-rc2 through 2.2.5 has a NULL pointer dereference allowing attackers to crash an application via a specific function call se… |
CVE-2018-19441 | Medium | 4.7 | 2020-01-27 | An issue was discovered in Neato Botvac Connected 2.2.0. The GenerateRobotPassword function of the NeatoCrypto library generates insufficiently random numbers… |
CVE-2018-20105 | Medium | 4.0 | 2020-01-27 | A Inclusion of Sensitive Information in Log Files vulnerability in yast2-rmt of SUSE Linux Enterprise Server 15; openSUSE Leap allows local attackers to learn… |