2018 CVEs (page 11)
Page 11 of 162 — CVEs published in 2018, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2018-12476 | Medium | 4.3 | 2020-01-27 | Relative Path Traversal vulnerability in obs-service-tar_scm of SUSE Linux Enterprise Server 15; openSUSE Factory allows remote attackers with control over a r… |
CVE-2018-8654 | Medium | 6.5 | 2020-01-24 | An elevation of privilege vulnerability exists in Microsoft Dynamics 365 Server, aka 'Microsoft Dynamics 365 Elevation of Privilege Vulnerability'. |
CVE-2018-16272 | Critical | 9.8 | 2020-01-22 | The wpa_supplicant system service in Samsung Galaxy Gear series allows an unprivileged process to fully control the Wi-Fi interface, due to the lack of its D-B… |
CVE-2018-16271 | Medium | 6.5 | 2020-01-22 | The wemail_consumer_service (from the built-in application wemail) in Samsung Galaxy Gear series allows an unprivileged process to manipulate a user's mailbox… |
CVE-2018-16270 | High | 7.5 | 2020-01-22 | Samsung Galaxy Gear series before build RE2 includes the hcidump utility with no privilege or permission restriction. This allows an unprivileged process to du… |
CVE-2018-16269 | High | 7.5 | 2020-01-22 | The wnoti system service in Samsung Galaxy Gear series allows an unprivileged process to take over the internal notification message data, due to improper D-Bu… |
CVE-2018-16268 | Medium | 4.3 | 2020-01-22 | The SoundServer/FocusServer system services in Tizen allow an unprivileged process to perform media-related system actions, due to improper D-Bus security poli… |
CVE-2018-16267 | High | 8.1 | 2020-01-22 | The system-popup system service in Tizen allows an unprivileged process to perform popup-related system actions, due to improper D-Bus security policy configur… |
CVE-2018-16266 | High | 8.1 | 2020-01-22 | The Enlightenment system service in Tizen allows an unprivileged process to fully control or capture windows, due to improper D-Bus security policy configurati… |
CVE-2018-16265 | Medium | 6.5 | 2020-01-22 | The bt/bt_core system service in Tizen allows an unprivileged process to create a system user interface and control the Bluetooth pairing process, due to impro… |
CVE-2018-16264 | Medium | 6.5 | 2020-01-22 | The BlueZ system service in Tizen allows an unprivileged process to partially control Bluetooth or acquire sensitive information, due to improper D-Bus securit… |
CVE-2018-16263 | High | 8.8 | 2020-01-22 | The PulseAudio system service in Tizen allows an unprivileged process to control its A2DP MediaEndpoint, due to improper D-Bus security policy configurations… |
CVE-2018-16262 | High | 8.8 | 2020-01-22 | The pkgmgr system service in Tizen allows an unprivileged process to perform package management actions, due to improper D-Bus security policy configurations… |
CVE-2018-17981 | Medium | 6.1 | 2020-01-22 | Lifesize Express ls ex2_4.7.10 2000 (14) devices allow XSS via the interface/interface.php brand parameter. |
CVE-2018-1002104 | Medium | 5.3 | 2020-01-14 | Versions < 1.5 of the Kubernetes ingress default backend, which handles invalid ingress traffic, exposed prometheus metrics publicly. |
CVE-2018-10465 | High | 8.8 | 2020-01-07 | Jamf Pro 10.x before 10.3.0 has Incorrect Access Control. Jamf Pro user accounts and groups with access to log in to Jamf Pro had full access to endpoints in t… |
CVE-2018-7794 | High | 7.5 | 2020-01-06 | A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists in Modicon M580, Modicon M340, Modicon Quantum, Modicon Premium (see secur… |
CVE-2018-19834 | High | 7.5 | 2019-12-31 | The quaker function of a smart contract implementation for BOMBBA (BOMB), an tradable Ethereum ERC20 token, allows attackers to change the owner of the contrac… |
CVE-2018-19833 | High | 7.5 | 2019-12-31 | The owned function of a smart contract implementation for DDQ, an tradable Ethereum ERC20 token, allows attackers to change the owner of the contract, because… |
CVE-2018-19832 | High | 7.5 | 2019-12-31 | The NETM() function of a smart contract implementation for NewIntelTechMedia (NETM), an tradable Ethereum ERC20 token, allows attackers to change the owner of… |
CVE-2018-19831 | High | 7.5 | 2019-12-31 | The ToOwner() function of a smart contract implementation for Cryptbond Network (CBN), an tradable Ethereum ERC20 token, allows attackers to change the owner o… |
CVE-2018-19830 | High | 7.5 | 2019-12-31 | The UBSexToken() function of a smart contract implementation for Business Alliance Financial Circle (BAFC), an tradable Ethereum ERC20 token, allows attackers… |
CVE-2018-14476 | Medium | 6.1 | 2019-12-31 | GeniXCMS 1.1.5 has XSS via the dbuser or dbhost parameter during step 1 of installation. |
CVE-2018-20507 | Medium | 5.3 | 2019-12-30 | An issue was discovered in GitLab Enterprise Edition 11.2.x through 11.4.x before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. It has Incorrect Acc… |
CVE-2018-20501 | Medium | 6.3 | 2019-12-30 | An issue was discovered in GitLab Community and Enterprise Edition before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. It has Incorrect Access Cont… |
CVE-2018-20499 | High | 7.2 | 2019-12-30 | An issue was discovered in GitLab Community and Enterprise Edition before 11.x before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. It allows SSRF. |
CVE-2018-20498 | Medium | 4.3 | 2019-12-30 | An issue was discovered in GitLab Community and Enterprise Edition before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. It has Incorrect Access Cont… |
CVE-2018-20497 | Medium | 5.0 | 2019-12-30 | An issue was discovered in GitLab Community and Enterprise Edition before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. It allows SSRF. |
CVE-2018-20496 | Medium | 5.4 | 2019-12-30 | An issue was discovered in GitLab Community and Enterprise Edition 11.2.x through 11.4.x before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. It all… |
CVE-2018-20495 | Medium | 5.3 | 2019-12-30 | An issue was discovered in GitLab Community and Enterprise Edition 11.3.x and 11.4.x before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. It allows… |
CVE-2018-20494 | High | 7.5 | 2019-12-30 | An issue was discovered in GitLab Community and Enterprise Edition before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. It has Incorrect Access Cont… |
CVE-2018-20493 | Medium | 4.3 | 2019-12-30 | An issue was discovered in GitLab Community and Enterprise Edition before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. It has Incorrect Access Cont… |
CVE-2018-20491 | Medium | 5.4 | 2019-12-30 | An issue was discovered in GitLab Enterprise Edition 11.3.x and 11.4.x before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. It allows XSS. |
CVE-2018-20490 | Medium | 5.4 | 2019-12-30 | An issue was discovered in GitLab Community and Enterprise Edition 11.2.x through 11.4.x before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. It all… |
CVE-2018-20489 | Medium | 5.3 | 2019-12-30 | An issue was discovered in GitLab Community and Enterprise Edition before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. It has Incorrect Access Cont… |
CVE-2018-20488 | Medium | 4.3 | 2019-12-30 | An issue was discovered in GitLab Community and Enterprise Edition before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. It allows Information Exposu… |
CVE-2018-7859 | Medium | 6.1 | 2019-12-30 | A security vulnerability in D-Link DGS-1510-series switches with firmware 1.20.011, 1.30.007, 1.31.B003 and older that may allow a remote attacker to inject ma… |
CVE-2018-1682 | Medium | 5.3 | 2019-12-30 | IBM Watson Studio Local 1.2.3 could disclose sensitive information over the network that an attacked could use in further attacks against the system. IBM X-For… |
CVE-2018-20492 | Medium | 5.3 | 2019-12-26 | An issue was discovered in GitLab Community and Enterprise Edition before 11.4.13, 11.5.x before 11.5.6, and 11.6.x before 11.6.1. It has Incorrect Access Cont… |
CVE-2018-18288 | Medium | 6.1 | 2019-12-26 | CrushFTP through 8.3.0 is vulnerable to credentials theft via URL redirection. |
CVE-2018-10389 | Critical | 9.8 | 2019-12-23 | Format string vulnerability in the logMess function in TFTP Server MT 1.65 and earlier allows remote attackers to perform a denial of service or execute arbitr… |
CVE-2018-10388 | Critical | 9.8 | 2019-12-23 | Format string vulnerability in the logMess function in TFTP Server SP 1.66 and earlier allows remote attackers to perform a denial of service or execute arbitr… |
CVE-2018-10387 | Critical | 9.8 | 2019-12-23 | Heap-based overflow vulnerability in TFTP Server SP 1.66 and earlier allows remote attackers to perform a denial of service or possibly execute arbitrary code… |
CVE-2018-1934 | High | 8.8 | 2019-12-20 | IBM Cognos Business Intelligence 10.2.2 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions… |
CVE-2018-1311 | High | 8.1 | 2019-12-18 | The Apache Xerces-C 3.0.0 to 3.2.3 XML parser contains a use-after-free error triggered during the scanning of external DTDs. This flaw has not been addressed… |
CVE-2018-11980 | High | 7.8 | 2019-12-18 | When a fake broadcast/multicast 11w rmf without mmie received, since no proper length check in wma_process_bip, buffer overflow will happen in both cds_is_mmie… |
CVE-2018-11751 | Medium | 5.4 | 2019-12-16 | Previous versions of Puppet Agent didn't verify the peer in the SSL connection prior to downloading the CRL. This issue is resolved in Puppet Agent 6.4.0. |
CVE-2018-11805 | Medium | 6.7 | 2019-12-12 | In Apache SpamAssassin before 3.4.3, nefarious CF files can be configured to run system commands without any output or errors. With this, exploits can be injec… |
CVE-2018-7282 | Critical | 9.8 | 2019-12-06 | The username parameter of the TITool PrintMonitor solution during the login request is vulnerable to and/or time-based blind SQLi. |
CVE-2018-1002102 | Low | 2.6 | 2019-12-05 | Improper validation of URL redirection in the Kubernetes API server in versions prior to v1.14.0 allows an attacker-controlled Kubelet to redirect API server r… |
CVE-2018-0730 | Critical | 9.8 | 2019-12-04 | This command injection vulnerability in File Station allows attackers to execute commands on the affected device. To fix the vulnerability, QNAP recommend upda… |
CVE-2018-0729 | Critical | 9.8 | 2019-12-04 | This command injection vulnerability in Music Station allows attackers to execute commands on the affected device. To fix the vulnerability, QNAP recommend upd… |
CVE-2018-0728 | High | 7.5 | 2019-12-04 | This improper access control vulnerability in Helpdesk allows attackers to access the system logs. To fix the vulnerability, QNAP recommend updating QTS and He… |
CVE-2018-20090 | High | 8.3 | 2019-11-26 | An issue was discovered in Cloudera Data Science Workbench (CDSW) 1.4.0 through 1.4.2. Authenticated users can bypass project permission checks and gain read-w… |
CVE-2018-17860 | High | 7.2 | 2019-11-26 | Cloudera CDH has Insecure Permissions because ALL cannot be revoked.This affects 5.x through 5.15.1 and 6.x through 6.0.1. |
CVE-2018-2025 | Medium | 4.4 | 2019-11-25 | IBM Spectrum Protect Backup-Archive Client and IBM Spectrum Protect for Virtual Environments 7.1 and 8.1 creates directories/files in the CIT sub directory tha… |
CVE-2018-10854 | Medium | 5.4 | 2019-11-22 | cloudforms version, cloudforms 5.8 and cloudforms 5.9, is vulnerable to a cross-site-scripting. A flaw was found in CloudForms's v2v infrastructure mapping del… |
CVE-2018-8879 | Critical | 9.8 | 2019-11-21 | Stack-based buffer overflow in Asuswrt-Merlin firmware for ASUS devices older than 384.4 and ASUS firmware before 3.0.0.4.382.50470 for devices allows remote a… |
CVE-2018-9195 | Medium | 5.9 | 2019-11-21 | Use of a hardcoded cryptographic key in the FortiGuard services communication protocol may allow a Man in the middle with knowledge of the key to eavesdrop on… |
CVE-2018-13916 | High | 7.8 | 2019-11-21 | Out-of-bounds memory access in Qurt kernel function when using the identifier to access Qurt kernel buffer to retrieve thread data. in Snapdragon Auto, Snapdra… |
CVE-2018-20687 | Critical | 9.8 | 2019-11-18 | An XML external entity (XXE) vulnerability in CommandCenterWebServices/.*?wsdl in Raritan CommandCenter Secure Gateway before 8.0.0 allows remote unauthenticat… |
CVE-2018-21031 | Medium | 6.5 | 2019-11-18 | Tautulli versions 2.1.38 and below allows remote attackers to bypass intended access control in Plex Media Server because the X-Plex-Token is mishandled and ca… |
CVE-2018-13257 | Medium | 6.1 | 2019-11-18 | The bb-auth-provider-cas authentication module within Blackboard Learn 2018-07-02 is susceptible to HTTP host header spoofing during Central Authentication Ser… |
CVE-2018-18368 | High | 7.8 | 2019-11-15 | Symantec Endpoint Protection Manager (SEPM), prior to 14.2 RU1, may be susceptible to a privilege escalation vulnerability, which is a type of issue whereby an… |
CVE-2018-12207 | Medium | 6.5 | 2019-11-14 | Improper invalidation for page table updates by a virtual guest operating system for multiple Intel(R) Processors may allow an authenticated user to potentiall… |
CVE-2018-21026 | High | 7.5 | 2019-11-12 | A vulnerability in Hitachi Command Suite 7.x and 8.x before 8.6.5-00 allows an unauthenticated remote user to read internal information. |
CVE-2018-18819 | Medium | 5.3 | 2019-11-12 | A vulnerability in the web conference chat component of MiCollab, versions 7.3 PR6 (7.3.0.601) and earlier, and 8.0 (8.0.0.40) through 8.0 SP2 FP2 (8.0.2.202)… |
CVE-2018-1721 | High | 8.8 | 2019-11-09 | IBM Cognos Analytics 11.0 and 11.1 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this… |
CVE-2018-18674 | Medium | 6.1 | 2019-11-07 | GNUBOARD5 5.3.1.9 has XSS that allows remote attackers to inject arbitrary web script or HTML via the "board tail contents" parameter, aka the adm/board_form_u… |
CVE-2018-20853 | Medium | 5.3 | 2019-11-06 | An issue was discovered in the MailPoet Newsletters (aka wysija-newsletters) plugin before 2.8.2 for WordPress. The plugin is vulnerable to SPAM attacks. |
CVE-2018-19167 | High | 7.5 | 2019-11-05 | CloakCoin through 2.2.2.0 (a chain-based proof-of-stake cryptocurrency) allows a remote denial of service, exploitable by an attacker who acquires even a small… |
CVE-2018-19166 | High | 7.5 | 2019-11-05 | peercoin through 0.6.4 (a chain-based proof-of-stake cryptocurrency) allows a remote denial of service, exploitable by an attacker who acquires even a small am… |
CVE-2018-19165 | High | 7.5 | 2019-11-05 | neblio through 1.5.1 (a chain-based proof-of-stake cryptocurrency) allows a remote denial of service, exploitable by an attacker who acquires even a small amou… |
CVE-2018-19164 | High | 7.5 | 2019-11-05 | reddcoin through 2.1.0.5 (a chain-based proof-of-stake cryptocurrency) allows a remote denial of service, exploitable by an attacker who acquires even a small… |
CVE-2018-19163 | High | 7.5 | 2019-11-05 | stratisX through 2.0.0.5 (a chain-based proof-of-stake cryptocurrency) allows a remote denial of service, exploitable by an attacker who acquires even a small… |
CVE-2018-19162 | High | 7.5 | 2019-11-05 | Divi through 4.0.5 (a chain-based proof-of-stake cryptocurrency) allows a remote denial of service, exploitable by an attacker who acquires even a small amount… |
CVE-2018-19161 | High | 7.5 | 2019-11-05 | alqo through 4.1 (a chain-based proof-of-stake cryptocurrency) allows a remote denial of service, exploitable by an attacker who acquires even a small amount o… |
CVE-2018-19160 | High | 7.5 | 2019-11-05 | Diamond through 3.0.1.2 (a chain-based proof-of-stake cryptocurrency) allows a remote denial of service, exploitable by an attacker who acquires even a small a… |
CVE-2018-19159 | High | 7.5 | 2019-11-05 | lux through 5.2.2 (a chain-based proof-of-stake cryptocurrency) allows a remote denial of service, exploitable by an attacker who acquires even a small amount… |
CVE-2018-19157 | High | 7.5 | 2019-11-05 | Phore through 1.3.3.1 (a chain-based proof-of-stake cryptocurrency) allows a remote denial of service, exploitable by an attacker who acquires even a small amo… |
CVE-2018-19156 | High | 7.5 | 2019-11-05 | PIVX through 3.1.03 (a chain-based proof-of-stake cryptocurrency) allows a remote denial of service, exploitable by an attacker who acquires even a small amoun… |
CVE-2018-19155 | High | 7.5 | 2019-11-05 | navcoin through 4.3.0 (a chain-based proof-of-stake cryptocurrency) allows a remote denial of service. The attacker sends invalid headers/blocks. The attack re… |
CVE-2018-19154 | High | 7.5 | 2019-11-05 | HTMLCOIN through 2.12 (a chain-based proof-of-stake cryptocurrency) allows a remote denial of service. The attacker sends invalid headers/blocks. The attack re… |
CVE-2018-19153 | High | 7.5 | 2019-11-05 | particl through 0.17 (a chain-based proof-of-stake cryptocurrency) allows a remote denial of service. The attacker sends invalid headers/blocks. The attack req… |
CVE-2018-19152 | High | 7.5 | 2019-11-05 | emercoin through 0.7 (a chain-based proof-of-stake cryptocurrency) allows a remote denial of service. The attacker sends invalid headers/blocks. The attack req… |
CVE-2018-19031 | High | 8.8 | 2019-11-04 | A command injection vulnerability exists when the authorized user passes crafted parameter to background process in the router. This affects 360 router series… |
CVE-2018-4064 | High | 7.1 | 2019-10-31 | An exploitable unverified password change vulnerability exists in the ACEManager upload.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. A speciall… |
CVE-2018-4031 | Critical | 10.0 | 2019-10-31 | An exploitable vulnerability exists in the safe browsing function of the CUJO Smart Firewall, version 7003. The flaw lies in the way the safe browsing function… |
CVE-2018-4002 | High | 7.5 | 2019-10-31 | An exploitable denial-of-service vulnerability exists in the mdnscap binary of the CUJO Smart Firewall running firmware 7003. When parsing labels in mDNS packe… |
CVE-2018-3983 | High | 7.8 | 2019-10-31 | An exploitable uninitialized pointer vulnerability exists in the Word document parser of the the Atlantis Word Processor. A specially crafted document can caus… |
CVE-2018-21030 | Medium | 5.3 | 2019-10-31 | Jupyter Notebook before 5.5.0 does not use a CSP header to treat served files as belonging to a separate origin. Thus, for example, an XSS payload can be place… |
CVE-2018-21029 | Critical | 9.8 | 2019-10-30 | systemd 239 through 245 accepts any certificate signed by a trusted certificate authority for DNS Over TLS. Server Name Indication (SNI) is not sent, and there… |
CVE-2018-18678 | Medium | 6.1 | 2019-10-30 | GNUBOARD5 before 5.3.2.0 has XSS that allows remote attackers to inject arbitrary web script or HTML via the "board group extra contents" parameter, aka the ad… |
CVE-2018-16417 | High | 7.5 | 2019-10-30 | Aruba Instant 4.x prior to 6.4.4.8-4.2.4.12, 6.5.x prior to 6.5.4.11, 8.3.x prior to 8.3.0.6, and 8.4.x prior to 8.4.0.1 allows Command injection. |
CVE-2018-5742 | High | 7.5 | 2019-10-30 | While backporting a feature for a newer branch of BIND9, RedHat introduced a path leading to an assertion failure in buffer.c:420. Affects RedHat versions bind… |
CVE-2018-5735 | High | 7.5 | 2019-10-30 | The Debian backport of the fix for CVE-2017-3137 leads to assertion failure in validator.c:1858; Affects Debian versions 9.9.5.dfsg-9+deb8u15; 9.9.5.dfsg-9+deb… |
CVE-2018-19151 | High | 7.5 | 2019-10-29 | qtum through 0.16 (a chain-based proof-of-stake cryptocurrency) allows a remote denial of service. The attacker sends invalid headers/blocks. The attack requir… |
CVE-2018-18931 | High | 8.8 | 2019-10-29 | An issue was discovered in the Tightrope Media Carousel digital signage product 7.0.4.104. Due to insecure default permissions on the C:\TRMS\Services director… |
CVE-2018-18930 | High | 8.8 | 2019-10-29 | The Tightrope Media Carousel digital signage product 7.0.4.104 contains an arbitrary file upload vulnerability in the Manage Bulletins/Upload feature, which ca… |
CVE-2018-18929 | High | 8.8 | 2019-10-29 | The Tightrope Media Carousel Seneca HDn Windows-based appliance 7.0.4.104 is shipped with a default local administrator username and password. This can be foun… |