2018 CVEs (page 101)
Page 101 of 162 — CVEs published in 2018, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2018-3936 | High | 8.8 | 2018-07-11 | In Antenna House Office Server Document Converter version V6.1 Pro MR2 for Linux64 (6,1,2018,0312), a crafted Microsoft Word (DOC) document can lead to an out-… |
CVE-2018-3933 | High | 8.8 | 2018-07-11 | An exploitable out-of-bounds write exists in the Microsoft Word document conversion functionality of the Antenna House Office Server Document Converter version… |
CVE-2018-3932 | High | 8.8 | 2018-07-11 | An exploitable stack-based buffer overflow exists in the Microsoft Word document conversion functionality of the Antenna House Office Server Document Converter… |
CVE-2018-3931 | High | 7.8 | 2018-07-11 | In Antenna House Office Server Document Converter version V6.1 Pro MR2 for Linux64 (6,1,2018,0312), a crafted Microsoft Word (DOC) document can lead to an out-… |
CVE-2018-3930 | High | 7.8 | 2018-07-11 | In Antenna House Office Server Document Converter version V6.1 Pro MR2 for Linux64 (6,1,2018,0312), a crafted Microsoft Word (DOC) document can lead to an out-… |
CVE-2018-3929 | High | 7.8 | 2018-07-11 | An exploitable heap corruption exists in the PowerPoint document conversion functionality of the Antenna House Office Server Document Converter version V6.1 Pr… |
CVE-2018-13989 | High | 8.8 | 2018-07-11 | Grundig Smart Inter@ctive TV 3.0 devices allow CSRF attacks via a POST request to TCP port 8085 containing a predictable ID value, as demonstrated by a /sendrc… |
CVE-2018-11529 | High | 8.0 | 2018-07-11 | VideoLAN VLC media player 2.2.x is prone to a use after free vulnerability which an attacker can leverage to execute arbitrary code via crafted MKV files. Fail… |
CVE-2018-10197 | Critical | 9.8 | 2018-07-11 | There is a time-based blind SQL injection vulnerability in the Access Manager component before 9.18.040 and 10.x before 10.18.040 in ELO ELOenterprise 9 and 10… |
CVE-2018-8007 | High | 7.2 | 2018-07-11 | Apache CouchDB administrative users can configure the database server via HTTP(S). Due to insufficient validation of administrator-supplied configuration setti… |
CVE-2018-0500 | Critical | 9.8 | 2018-07-11 | Curl_smtp_escape_eob in lib/smtp.c in curl 7.54.1 to and including curl 7.60.0 has a heap-based buffer overflow that might be exploitable by an attacker who ca… |
CVE-2018-13879 | Medium | 5.4 | 2018-07-11 | A reflected XSS issue was discovered in the registration form in Rocket.Chat before 0.66. When one creates an account, the next step will ask for a username. T… |
CVE-2018-13878 | Medium | 6.1 | 2018-07-11 | An XSS issue was discovered in packages/rocketchat-mentions/Mentions.js in Rocket.Chat before 0.65. The real name of a username is displayed unescaped when the… |
CVE-2018-8356 | Medium | 5.5 | 2018-07-11 | A security feature bypass vulnerability exists when Microsoft .NET Framework components do not correctly validate certificates, aka ".NET Framework Security Fe… |
CVE-2018-8327 | Critical | 9.8 | 2018-07-11 | A remote code execution vulnerability exists in PowerShell Editor Services, aka "PowerShell Editor Services Remote Code Execution Vulnerability." This affects… |
CVE-2018-8326 | Medium | 5.4 | 2018-07-11 | A cross-site-scripting (XSS) vulnerability exists when an open source customization for Microsoft Active Directory Federation Services (AD FS) does not properl… |
CVE-2018-8325 | Medium | 4.3 | 2018-07-11 | An information disclosure vulnerability exists when Microsoft Edge improperly handles objects in memory, aka "Microsoft Edge Information Disclosure Vulnerabili… |
CVE-2018-8324 | Medium | 4.3 | 2018-07-11 | An information disclosure vulnerability exists when Microsoft Edge improperly handles objects in memory, aka "Microsoft Edge Information Disclosure Vulnerabili… |
CVE-2018-8323 | Medium | 5.4 | 2018-07-11 | An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected Share… |
CVE-2018-8319 | Critical | 9.8 | 2018-07-11 | A Security Feature Bypass vulnerability exists in MSR JavaScript Cryptography Library that is caused by incorrect arithmetic computations, aka "MSR JavaScript… |
CVE-2018-8314 | Medium | 4.7 | 2018-07-11 | An elevation of privilege vulnerability exists when Windows fails a check, allowing a sandbox escape, aka "Windows Elevation of Privilege Vulnerability." This… |
CVE-2018-8313 | High | 7.8 | 2018-07-11 | An elevation of privilege vulnerability exists in the way that the Windows Kernel API enforces permissions, aka "Windows Elevation of Privilege Vulnerability."… |
CVE-2018-8312 | High | 7.8 | 2018-07-11 | A remote code execution vulnerability exists when Microsoft Access fails to properly handle objects in memory, aka "Microsoft Access Remote Code Execution Vuln… |
CVE-2018-8311 | High | 8.8 | 2018-07-11 | A remote code execution vulnerability exists when Skype for Business and Microsoft Lync clients fail to properly sanitize specially crafted content, aka "Remot… |
CVE-2018-8310 | High | 7.5 | 2018-07-11 | A tampering vulnerability exists when Microsoft Outlook does not properly handle specific attachment types when rendering HTML emails, aka "Microsoft Office Ta… |
CVE-2018-8309 | Medium | 5.5 | 2018-07-11 | A denial of service vulnerability exists when Windows improperly handles objects in memory, aka "Windows Denial of Service Vulnerability." This affects Windows… |
CVE-2018-8308 | Medium | 6.6 | 2018-07-11 | An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory, aka "Windows Kernel Elevation of Privilege V… |
CVE-2018-8307 | Medium | 5.3 | 2018-07-11 | A security feature bypass vulnerability exists when Microsoft WordPad improperly handles embedded OLE objects, aka "WordPad Security Feature Bypass Vulnerabili… |
CVE-2018-8306 | Medium | 5.5 | 2018-07-11 | A command injection vulnerability exists in the Microsoft Wireless Display Adapter (MWDA) when the Microsoft Wireless Display Adapter does not properly manage… |
CVE-2018-8305 | Medium | 6.5 | 2018-07-11 | An information disclosure vulnerability exists in Windows Mail Client when a message is opened, aka "Windows Mail Client Information Disclosure Vulnerability."… |
CVE-2018-8304 | Medium | 5.9 | 2018-07-11 | A denial of service vulnerability exists in Windows Domain Name System (DNS) DNSAPI.dll when it fails to properly handle DNS responses, aka "Windows DNSAPI Den… |
CVE-2018-8301 | High | 7.5 | 2018-07-11 | A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka "Microsoft Edge Memory Corruption Vulnerability." T… |
CVE-2018-8300 | High | 8.8 | 2018-07-11 | A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package, aka "Microso… |
CVE-2018-8299 | Medium | 5.4 | 2018-07-11 | An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected Share… |
CVE-2018-8298 | High | 7.5 | 2018-07-11 | A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption… |
CVE-2018-8297 | Medium | 4.3 | 2018-07-11 | An information disclosure vulnerability exists when Microsoft Edge improperly handles objects in memory, aka "Microsoft Edge Information Disclosure Vulnerabili… |
CVE-2018-8296 | High | 7.5 | 2018-07-11 | A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "Scripting Engine Memory… |
CVE-2018-8294 | High | 7.5 | 2018-07-11 | A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Eng… |
CVE-2018-8291 | High | 7.5 | 2018-07-11 | A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers, aka "Scripting Engine Memory Corr… |
CVE-2018-8290 | High | 7.5 | 2018-07-11 | A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Eng… |
CVE-2018-8289 | Medium | 4.3 | 2018-07-11 | An information disclosure vulnerability exists when Microsoft Edge improperly handles objects in memory, aka "Microsoft Edge Information Disclosure Vulnerabili… |
CVE-2018-8288 | High | 7.5 | 2018-07-11 | A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers, aka "Scripting Engine Memory Corr… |
CVE-2018-8287 | High | 7.5 | 2018-07-11 | A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers, aka "Scripting Engine Memory Corr… |
CVE-2018-8286 | High | 7.5 | 2018-07-11 | A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Eng… |
CVE-2018-8284 | High | 8.1 | 2018-07-11 | A remote code execution vulnerability exists when the Microsoft .NET Framework fails to validate input properly, aka ".NET Framework Remote Code Injection Vuln… |
CVE-2018-8283 | High | 7.5 | 2018-07-11 | A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption… |
CVE-2018-8282 | High | 7.8 | 2018-07-11 | An elevation of privilege vulnerability exists in Windows when the Windows kernel-mode driver fails to properly handle objects in memory, aka "Win32k Elevation… |
CVE-2018-8281 | High | 7.8 | 2018-07-11 | A remote code execution vulnerability exists in Microsoft Office software when the software fails to properly handle objects in memory, aka "Microsoft Office R… |
CVE-2018-8280 | High | 7.5 | 2018-07-11 | A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Eng… |
CVE-2018-8279 | High | 7.5 | 2018-07-11 | A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka "Microsoft Edge Memory Corruption Vulnerability." T… |
CVE-2018-8278 | Medium | 6.1 | 2018-07-11 | A spoofing vulnerability exists when Microsoft Edge improperly handles specific HTML content, aka "Microsoft Edge Spoofing Vulnerability." This affects Microso… |
CVE-2018-8276 | Medium | 6.5 | 2018-07-11 | A security feature bypass vulnerability exists in the Microsoft Chakra scripting engine that allows Control Flow Guard (CFG) to be bypassed, aka "Scripting Eng… |
CVE-2018-8275 | High | 7.5 | 2018-07-11 | A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka "Microsoft Edge Memory Corruption Vulnerability." T… |
CVE-2018-8274 | High | 7.5 | 2018-07-11 | A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka "Microsoft Edge Memory Corruption Vulnerability." T… |
CVE-2018-8262 | High | 7.5 | 2018-07-11 | A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka "Microsoft Edge Memory Corruption Vulnerability." T… |
CVE-2018-8260 | High | 8.8 | 2018-07-11 | A Remote Code Execution vulnerability exists in .NET software when the software fails to check the source markup of a file, aka ".NET Framework Remote Code Exe… |
CVE-2018-8242 | High | 7.5 | 2018-07-11 | A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "Scripting Engine Memory… |
CVE-2018-8238 | High | 7.8 | 2018-07-11 | A security feature bypass vulnerability exists when Skype for Business or Lync do not properly parse UNC path links shared via messages, aka "Skype for Busines… |
CVE-2018-8232 | High | 7.8 | 2018-07-11 | A Tampering vulnerability exists when Microsoft Macro Assembler improperly validates code, aka "Microsoft Macro Assembler Tampering Vulnerability." This affect… |
CVE-2018-8222 | Medium | 5.3 | 2018-07-11 | A security feature bypass vulnerability exists in Device Guard that could allow an attacker to inject malicious code into a Windows PowerShell session, aka "De… |
CVE-2018-8206 | High | 7.5 | 2018-07-11 | A denial of service vulnerability exists when Windows improperly handles File Transfer Protocol (FTP) connections, aka "Windows FTP Server Denial of Service Vu… |
CVE-2018-8202 | High | 7.8 | 2018-07-11 | An elevation of privilege vulnerability exists in .NET Framework which could allow an attacker to elevate their privilege level, aka ".NET Framework Elevation… |
CVE-2018-8172 | High | 7.8 | 2018-07-11 | A remote code execution vulnerability exists in Visual Studio software when the software does not check the source markup of a file for an unbuilt project, aka… |
CVE-2018-8171 | High | 7.5 | 2018-07-11 | A Security Feature Bypass vulnerability exists in ASP.NET when the number of incorrect login attempts is not validated, aka "ASP.NET Security Feature Bypass Vu… |
CVE-2018-8125 | High | 7.5 | 2018-07-11 | A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka "Microsoft Edge Memory Corruption Vulnerability." T… |
CVE-2018-0949 | Medium | 6.5 | 2018-07-11 | A security feature bypass vulnerability exists when Microsoft Internet Explorer improperly handles requests involving UNC resources, aka "Internet Explorer Sec… |
CVE-2018-3693 | Medium | 5.6 | 2018-07-10 | Systems with microprocessors utilizing speculative execution and branch prediction may allow unauthorized disclosure of information to an attacker with local u… |
CVE-2018-3688 | High | 7.8 | 2018-07-10 | Unquoted service paths in Intel Quartus Prime Programmer and Tools in versions 15.1 - 18.0 allow a local attacker to potentially execute arbitrary code. |
CVE-2018-3687 | High | 7.8 | 2018-07-10 | Unquoted service paths in Intel Quartus II Programmer and Tools in versions 11.0 - 15.0 allow a local attacker to potentially execute arbitrary code. |
CVE-2018-3684 | High | 7.8 | 2018-07-10 | Unquoted service paths in Intel Quartus II in versions 11.0 - 15.0 allow a local attacker to potentially execute arbitrary code. |
CVE-2018-3683 | High | 7.8 | 2018-07-10 | Unquoted service paths in Intel Quartus Prime in versions 15.1 - 18.0 allow a local attacker to potentially execute arbitrary code. |
CVE-2018-3682 | High | 8.2 | 2018-07-10 | BMC Firmware in Intel server boards, compute modules, and systems potentially allow an attacker with administrative privileges to make unauthorized read\writes… |
CVE-2018-3668 | High | 7.8 | 2018-07-10 | Unquoted service paths in Intel Processor Diagnostic Tool (IPDT) before version 4.1.0.27 allows a local attacker to potentially execute arbitrary code. |
CVE-2018-3667 | High | 7.8 | 2018-07-10 | Installation tool IPDT (Intel Processor Diagnostic Tool) 4.1.0.24 sets permissions of installed files incorrectly, allowing for execution of arbitrary code and… |
CVE-2018-3652 | High | 7.6 | 2018-07-10 | Existing UEFI setting restrictions for DCI (Direct Connect Interface) in 5th and 6th generation Intel Xeon Processor E3 Family, Intel Xeon Scalable processors… |
CVE-2018-3632 | Medium | 6.7 | 2018-07-10 | Memory corruption in Intel Active Management Technology in Intel Converged Security Manageability Engine Firmware 6.x / 7.x / 8.x / 9.x / 10.x / 11.0 / 11.5 /… |
CVE-2018-3629 | Medium | 6.5 | 2018-07-10 | Buffer overflow in event handler in Intel Active Management Technology in Intel Converged Security Manageability Engine Firmware 3.x, 4.x, 5.x, 6.x, 7.x, 8.x… |
CVE-2018-3628 | High | 8.8 | 2018-07-10 | Buffer overflow in HTTP handler in Intel Active Management Technology in Intel Converged Security Manageability Engine Firmware 3.x, 4.x, 5.x, 6.x, 7.x, 8.x, 9… |
CVE-2018-3627 | High | 8.2 | 2018-07-10 | Logic bug in Intel Converged Security Management Engine 11.x may allow an attacker to execute arbitrary code via local privileged access. |
CVE-2018-3619 | Medium | 4.6 | 2018-07-10 | Information disclosure vulnerability in storage media in systems with Intel Optane memory module with Whole Disk Encryption may allow an attacker to recover da… |
CVE-2018-13876 | Critical | 9.8 | 2018-07-10 | An issue was discovered in the HDF HDF5 1.8.20 library. There is a stack-based buffer overflow in the function H5FD_sec2_read in H5FDsec2.c, related to HDread. |
CVE-2018-13875 | High | 7.8 | 2018-07-10 | An issue was discovered in the HDF HDF5 1.8.20 library. There is an out-of-bounds read in the function H5VM_memcpyvv in H5VM.c. |
CVE-2018-13874 | Critical | 9.8 | 2018-07-10 | An issue was discovered in the HDF HDF5 1.8.20 library. There is a stack-based buffer overflow in the function H5FD_sec2_read in H5FDsec2.c, related to HDmemse… |
CVE-2018-13873 | Critical | 9.8 | 2018-07-10 | An issue was discovered in the HDF HDF5 1.8.20 library. There is a buffer over-read in H5O_chunk_deserialize in H5Ocache.c. |
CVE-2018-13872 | Critical | 9.8 | 2018-07-10 | An issue was discovered in the HDF HDF5 1.8.20 library. There is a heap-based buffer overflow in the function H5G_ent_decode in H5Gent.c. |
CVE-2018-13871 | Critical | 9.8 | 2018-07-10 | An issue was discovered in the HDF HDF5 1.8.20 library. There is a heap-based buffer overflow in the function H5FL_blk_malloc in H5FL.c. |
CVE-2018-13870 | Critical | 9.8 | 2018-07-10 | An issue was discovered in the HDF HDF5 1.8.20 library. There is a heap-based buffer over-read in the function H5O_link_decode in H5Olink.c. |
CVE-2018-13869 | Critical | 9.8 | 2018-07-10 | An issue was discovered in the HDF HDF5 1.8.20 library. There is a memcpy parameter overlap in the function H5O_link_decode in H5Olink.c. |
CVE-2018-13868 | Critical | 9.8 | 2018-07-10 | An issue was discovered in the HDF HDF5 1.8.20 library. There is a heap-based buffer over-read in the function H5O_fill_old_decode in H5Ofill.c. |
CVE-2018-13867 | Critical | 9.8 | 2018-07-10 | An issue was discovered in the HDF HDF5 1.8.20 library. There is an out of bounds read in the function H5F__accum_read in H5Faccum.c. |
CVE-2018-13866 | Critical | 9.8 | 2018-07-10 | An issue was discovered in the HDF HDF5 1.8.20 library. There is a stack-based buffer over-read in the function H5F_addr_decode_len in H5Fint.c. |
CVE-2018-13865 | Medium | 6.1 | 2018-07-10 | An issue was discovered in idreamsoft iCMS 7.0.9. XSS exists via the callback parameter in a public/api.php uploadpic request, bypassing the iWAF protection me… |
CVE-2018-13863 | High | 7.5 | 2018-07-10 | The MongoDB bson JavaScript module (also known as js-bson) versions 0.5.0 to 1.0.x before 1.0.5 is vulnerable to a Regular Expression Denial of Service (ReDoS)… |
CVE-2018-12462 | Medium | 4.8 | 2018-07-10 | NetIQ iManager 3.1.1 addresses potential XSS vulnerabilities. |
CVE-2018-1116 | Medium | 4.4 | 2018-07-10 | A flaw was found in polkit before version 0.116. The implementation of the polkit_backend_interactive_authority_check_authorization function in polkitd allows… |
CVE-2018-10872 | Medium | 6.5 | 2018-07-10 | A flaw was found in the way the Linux kernel handled exceptions delivered after a stack switch operation via Mov SS or Pop SS instructions. During the stack sw… |
CVE-2018-2440 | Medium | 4.4 | 2018-07-10 | Under certain circumstances SAP Dynamic Authorization Management (DAM) by NextLabs (Java Policy Controller versions 7.7 and 8.5) exposes sensitive information… |
CVE-2018-2439 | Medium | 5.9 | 2018-07-10 | The SAP Internet Graphics Server (IGS), 7.20, 7.20EXT, 7.45, 7.49, 7.53, has insufficient request validation (for example, where the request is validated for a… |
CVE-2018-2438 | High | 7.5 | 2018-07-10 | The SAP Internet Graphics Server (IGS), 7.20, 7.20EXT, 7.45, 7.49, 7.53, has several denial-of-service vulnerabilities that allow an attacker to prevent legiti… |
CVE-2018-2437 | Critical | 9.1 | 2018-07-10 | The SAP Internet Graphics Service (IGS), 7.20, 7.20EXT, 7.45, 7.49, 7.53, allows an attacker to externally trigger IGS command executions which can lead to: di… |