2018 CVEs (page 110)
Page 110 of 162 — CVEs published in 2018, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2018-13074 | High | 7.5 | 2018-07-03 | The mintToken function of a smart contract implementation for FIBToken (FIB), an Ethereum token, has an integer overflow that allows the owner of the contract… |
CVE-2018-13073 | High | 7.5 | 2018-07-03 | The mintToken function of a smart contract implementation for ETHEREUMBLACK (ETCBK), an Ethereum token, has an integer overflow that allows the owner of the co… |
CVE-2018-13072 | High | 7.5 | 2018-07-03 | The mintToken function of a smart contract implementation for Coffeecoin (COFFEE), an Ethereum token, has an integer overflow that allows the owner of the cont… |
CVE-2018-13071 | High | 7.5 | 2018-07-03 | The mintToken function of a smart contract implementation for CCindex10 (T10), an Ethereum token, has an integer overflow that allows the owner of the contract… |
CVE-2018-13070 | High | 7.5 | 2018-07-03 | The mintToken function of a smart contract implementation for EncryptedToken (ECC), an Ethereum token, has an integer overflow that allows the owner of the con… |
CVE-2018-13069 | High | 7.5 | 2018-07-03 | The mintToken function of a smart contract implementation for DYchain (DYC), an Ethereum token, has an integer overflow that allows the owner of the contract t… |
CVE-2018-13068 | High | 7.5 | 2018-07-03 | The mintToken function of a smart contract implementation for AzurionToken (AZU), an Ethereum token, has an integer overflow that allows the owner of the contr… |
CVE-2018-1113 | Medium | 4.8 | 2018-07-03 | setup before version 2.11.4-1.fc28 in Fedora and Red Hat Enterprise Linux added /sbin/nologin and /usr/sbin/nologin to /etc/shells. This violates security assu… |
CVE-2018-10856 | Medium | 5.3 | 2018-07-03 | It has been discovered that podman before version 0.6.1 does not drop capabilities when executing a container as a non-root user. This results in unnecessary p… |
CVE-2018-10855 | Medium | 5.9 | 2018-07-03 | Ansible 2.5 prior to 2.5.5, and 2.4 prior to 2.4.5, do not honor the no_log task flag for failed tasks. When the no_log flag has been used to protect sensitive… |
CVE-2018-1080 | High | 7.5 | 2018-07-03 | Dogtag PKI, through version 10.6.1, has a vulnerability in AAclAuthz.java that, under certain configurations, causes the application of ACL allow and deny rule… |
CVE-2018-10596 | High | 7.1 | 2018-07-03 | Medtronic 2090 CareLink Programmer uses a virtual private network connection to securely download updates. It does not verify it is still connected to this v… |
CVE-2018-13067 | High | 8.8 | 2018-07-02 | /upload/catalog/controller/account/password.php in OpenCart through 3.0.2.0 has CSRF via the index.php?route=account/password URI to change a user's password. |
CVE-2018-13066 | High | 7.5 | 2018-07-02 | There is a memory leak in util/parser.c in libming 0.4.8, which will lead to a denial of service via parseSWF_DEFINEBUTTON2, parseSWF_DEFINEFONT, parseSWF_DEFI… |
CVE-2018-12896 | Medium | 5.5 | 2018-07-02 | An issue was discovered in the Linux kernel through 4.17.3. An Integer Overflow in kernel/time/posix-timers.c in the POSIX timer code is caused by the way the… |
CVE-2018-12893 | Medium | 6.5 | 2018-07-02 | An issue was discovered in Xen through 4.10.x. One of the fixes in XSA-260 added some safety checks to help prevent Xen livelocking with debug exceptions. Unfo… |
CVE-2018-12892 | Critical | 9.9 | 2018-07-02 | An issue was discovered in Xen 4.7 through 4.10.x. libxl fails to pass the readonly flag to qemu when setting up a SCSI disk, due to what was probably an erron… |
CVE-2018-12891 | Medium | 6.5 | 2018-07-02 | An issue was discovered in Xen through 4.10.x. Certain PV MMU operations may take a long time to process. For that reason Xen explicitly checks for the need to… |
CVE-2018-1249 | Medium | 6.5 | 2018-07-02 | Dell EMC iDRAC9 versions prior to 3.21.21.21 did not enforce the use of TLS/SSL for a connection to iDRAC web server for certain URLs. A man-in-the-middle atta… |
CVE-2018-1244 | High | 8.8 | 2018-07-02 | Dell EMC iDRAC7/iDRAC8, versions prior to 2.60.60.60, and iDRAC9 versions prior to 3.21.21.21 contain a command injection vulnerability in the SNMP agent. A re… |
CVE-2018-1243 | High | 7.5 | 2018-07-02 | Dell EMC iDRAC6, versions prior to 2.91, iDRAC7/iDRAC8, versions prior to 2.60.60.60 and iDRAC9, versions prior to 3.21.21.21, contain a weak CGI session ID vu… |
CVE-2018-12426 | Critical | 9.8 | 2018-07-02 | The WP Live Chat Support Pro plugin before 8.0.07 for WordPress is vulnerable to unauthenticated Remote Code Execution due to client-side validation of allowed… |
CVE-2018-1212 | High | 8.8 | 2018-07-02 | The web-based diagnostics console in Dell EMC iDRAC6 (Monolithic versions prior to 2.91 and Modular all versions) contains a command injection vulnerability. A… |
CVE-2018-10843 | High | 8.5 | 2018-07-02 | source-to-image component of Openshift Container Platform before versions atomic-openshift 3.7.53, atomic-openshift 3.9.31 is vulnerable to a privilege escalat… |
CVE-2018-9276 | High | 7.2 | 2018-07-02 | An issue was discovered in PRTG Network Monitor before 18.2.39. An attacker who has access to the PRTG System Administrator web console with administrative pri… |
CVE-2018-12577 | High | 8.8 | 2018-07-02 | The Ping and Traceroute features on TP-Link TL-WR841N v13 00000001 0.9.1 4.16 v0001.0 Build 180119 Rel.65243n devices allow authenticated blind Command Injecti… |
CVE-2018-12576 | Medium | 4.3 | 2018-07-02 | TP-Link TL-WR841N v13 00000001 0.9.1 4.16 v0001.0 Build 180119 Rel.65243n devices allow clickjacking. |
CVE-2018-12575 | Critical | 9.8 | 2018-07-02 | On TP-Link TL-WR841N v13 00000001 0.9.1 4.16 v0001.0 Build 171019 Rel.55346n devices, all actions in the web interface are affected by bypass of authentication… |
CVE-2018-12574 | High | 8.8 | 2018-07-02 | CSRF exists for all actions in the web interface on TP-Link TL-WR841N v13 00000001 0.9.1 4.16 v0001.0 Build 180119 Rel.65243n devices. |
CVE-2018-12529 | High | 8.8 | 2018-07-02 | An issue was discovered on Intex N150 devices. The router firmware suffers from multiple CSRF injection point vulnerabilities including changing user passwords… |
CVE-2018-12528 | High | 8.1 | 2018-07-02 | An issue was discovered on Intex N150 devices. The backup/restore option does not check the file extension uploaded for importing a configuration files backup… |
CVE-2018-12499 | High | 7.4 | 2018-07-02 | The Motorola MBP853 firmware does not correctly validate server certificates. This allows for a Man in The Middle (MiTM) attack to take place between a Motorol… |
CVE-2018-10076 | Medium | 6.1 | 2018-07-02 | An issue was discovered in Zoho ManageEngine EventLog Analyzer 11.12. A Cross-Site Scripting vulnerability allows a remote attacker to inject arbitrary web scr… |
CVE-2018-10075 | Medium | 6.1 | 2018-07-02 | Cross-site scripting (XSS) vulnerability in Zoho ManageEngine EventLog Analyzer 11.12 allows remote attackers to inject arbitrary web script or HTML via the im… |
CVE-2018-13056 | High | 7.5 | 2018-07-02 | An issue was discovered on zzcms 8.3. There is a vulnerability at /user/del.php that can delete any file by placing its relative path into the zzcms_main table… |
CVE-2018-13054 | High | 8.1 | 2018-07-02 | An issue was discovered in Cinnamon 1.9.2 through 3.8.6. The cinnamon-settings-users.py GUI runs as root and allows configuration of (for example) other users'… |
CVE-2018-8039 | High | 8.1 | 2018-07-02 | It is possible to configure Apache CXF to use the com.sun.net.ssl implementation via 'System.setProperty("java.protocol.handler.pkgs", "com.sun.net.ssl.interna… |
CVE-2018-10874 | High | 7.8 | 2018-07-02 | In ansible it was found that inventory variables are loaded from current working directory when running ad-hoc command which are under attacker's control, allo… |
CVE-2018-13053 | Low | 3.3 | 2018-07-02 | The alarm_timer_nsleep function in kernel/time/alarmtimer.c in the Linux kernel through 4.17.3 has an integer overflow via a large relative timeout because kti… |
CVE-2018-0499 | Medium | 6.1 | 2018-07-02 | A cross-site scripting vulnerability in queryparser/termgenerator_internal.cc in Xapian xapian-core before 1.4.6 exists due to incomplete HTML escaping by Xapi… |
CVE-2018-13050 | Critical | 9.8 | 2018-07-02 | A SQL Injection vulnerability exists in Zoho ManageEngine Applications Manager 13.x before build 13800 via the j_username parameter in a /j_security_check POST… |
CVE-2018-13049 | High | 8.8 | 2018-07-02 | The constructSQL function in inc/search.class.php in GLPI 9.2.x through 9.3.0 allows SQL Injection, as demonstrated by triggering a crafted LIMIT clause to fro… |
CVE-2018-13043 | Critical | 9.8 | 2018-07-01 | scripts/grep-excuses.pl in Debian devscripts through 2.18.3 allows code execution through unsafe YAML loading because YAML::Syck is used without a configuratio… |
CVE-2018-13041 | High | 7.5 | 2018-07-01 | The mint function of a smart contract implementation for Link Platform (LNK), an Ethereum ERC20 token, has an integer overflow that allows the owner of the con… |
CVE-2018-13040 | High | 8.8 | 2018-07-01 | OpenSID 18.06-pasca has a CSRF vulnerability. This vulnerability can add an account (at the admin level) via the index.php/man_user/insert URI. |
CVE-2018-13039 | Medium | 6.1 | 2018-07-01 | OpenSID 18.06-pasca has reflected Cross Site Scripting (XSS) via the cari parameter, aka an index.php/first?cari= URI. |
CVE-2018-13038 | Critical | 9.8 | 2018-07-01 | OpenSID 18.06-pasca has an Unrestricted File Upload vulnerability via an Attachment Document in the article feature. This vulnerability leads to uploading arbi… |
CVE-2018-13037 | High | 7.8 | 2018-07-01 | An issue was discovered in jpeg-compressor 0.1. The bmp_load function in stb_image.c allows remote attackers to cause a denial of service (heap-based buffer ov… |
CVE-2018-13033 | Medium | 5.5 | 2018-07-01 | The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, allows remote attackers to cause a denial of service (excessive mem… |
CVE-2018-13032 | High | 8.8 | 2018-07-01 | ECESSA ShieldLink SL175EHQ 10.7.4 devices have CSRF to add superuser accounts via the cgi-bin/pl_web.cgi/util_configlogin_act URI. |
CVE-2018-7475 | Medium | 6.1 | 2018-06-30 | Cross-site scripting (XSS) vulnerability for webdav/ticket/ URIs in IceWarp Mail Server 12.0.3 allows remote attackers to inject arbitrary web script or HTML. |
CVE-2018-12990 | Medium | 5.3 | 2018-06-30 | phpwcms 1.8.9 allows remote attackers to discover the installation path via an invalid csrf_token_value field. |
CVE-2018-13030 | High | 7.8 | 2018-06-30 | An issue was discovered in jpeg-compressor 0.1. The build_huffman function in stb_image.c allows remote attackers to cause a denial of service (stack-based buf… |
CVE-2018-13026 | Critical | 9.8 | 2018-06-30 | An issue was discovered in gpmf-parser 1.1.2. There is a heap-based buffer over-read in GPMF_parser.c in the function GPMF_Type. |
CVE-2018-10860 | Medium | 5.4 | 2018-06-29 | perl-archive-zip is vulnerable to a directory traversal in Archive::Zip. It was found that the Archive::Zip module did not properly sanitize paths while extrac… |
CVE-2018-13025 | Medium | 4.9 | 2018-06-29 | protected/apps/admin/controller/photoController.php in YXcms 1.4.7 allows remote attackers to delete arbitrary files via the index.php?r=admin/photo/delpic pic… |
CVE-2018-13024 | High | 7.2 | 2018-06-29 | Metinfo v6.0.0 allows remote attackers to write code into a .php file, and execute that code, via the module parameter to admin/column/save.php in an editor up… |
CVE-2018-13021 | High | 7.2 | 2018-06-29 | An issue was discovered in HongCMS 3.0.0. There is an Arbitrary Script File Upload issue that can result in PHP code execution via the admin/index.php/template… |
CVE-2018-12465 | Critical | 9.1 | 2018-06-29 | An OS command injection vulnerability in the web administration component of Micro Focus Secure Messaging Gateway (SMG) allows a remote attacker authenticated… |
CVE-2018-12464 | Critical | 10.0 | 2018-06-29 | A SQL injection vulnerability in the web administration and quarantine components of Micro Focus Secure Messaging Gateway allows an unauthenticated remote atta… |
CVE-2018-8902 | Medium | 6.5 | 2018-06-29 | An issue was discovered in Ivanti Avalanche for all versions between 5.3 and 6.2. The impacted products used a single shared key encryption model to encrypt da… |
CVE-2018-8901 | High | 7.8 | 2018-06-29 | An issue was discovered in Ivanti Avalanche for all versions between 5.3 and 6.2. A local user with database access privileges can read the encrypted passwords… |
CVE-2018-13014 | High | 7.8 | 2018-06-29 | Storing password in recoverable format in safensec.com (SysWatch service) in SAFE'N'SEC SoftControl/SafenSoft SysWatch, SoftControl/SafenSoft TPSecure, and Sof… |
CVE-2018-13013 | High | 7.8 | 2018-06-29 | Improper check of unusual conditions when launching msiexec.exe in safensec.com (SysWatch service) in SAFE'N'SEC SoftControl/SafenSoft SysWatch, SoftControl/Sa… |
CVE-2018-13012 | High | 8.1 | 2018-06-29 | Download of code with improper integrity check in snsupd.exe and upd.exe in SAFE'N'SEC SoftControl/SafenSoft SysWatch, SoftControl/SafenSoft TPSecure, and Soft… |
CVE-2018-13011 | Critical | 9.8 | 2018-06-29 | An issue was discovered in gpmf-parser 1.1.2. There is a heap-based buffer over-read in GPMF_parser.c in the function GPMF_Validate. |
CVE-2018-13010 | High | 8.8 | 2018-06-29 | WSTMall v1.9.1_170316 has CSRF via the index.php?m=Admin&c=Users&a=edit URI to add a user account. |
CVE-2018-13009 | Critical | 9.8 | 2018-06-29 | An issue was discovered in gpmf-parser 1.1.2. There is a heap-based buffer over-read in GPMF_parser.c in the function GPMF_Next, related to certain checks for… |
CVE-2018-13008 | Critical | 9.8 | 2018-06-29 | An issue was discovered in gpmf-parser 1.1.2. There is a heap-based buffer over-read in GPMF_parser.c in the function GPMF_Next, related to certain checks for… |
CVE-2018-13007 | Critical | 9.8 | 2018-06-29 | An issue was discovered in gpmf-parser 1.1.2. There is a heap-based buffer over-read in GPMF_parser.c in the function GPMF_Next, related to certain checks for… |
CVE-2018-13006 | Critical | 9.8 | 2018-06-29 | An issue was discovered in MP4Box in GPAC 0.7.1. There is a heap-based buffer over-read in the isomedia/box_dump.c function hdlr_dump. |
CVE-2018-13005 | Critical | 9.8 | 2018-06-29 | An issue was discovered in MP4Box in GPAC 0.7.1. The function urn_Read in isomedia/box_code_base.c has a heap-based buffer over-read. |
CVE-2018-13003 | Medium | 6.1 | 2018-06-29 | An issue was discovered in OpenTSDB 2.3.0. There is XSS in parameter 'type' to the /suggest URI. |
CVE-2018-13002 | Medium | 4.8 | 2018-06-29 | An XSS issue was discovered in Inhaltsprojekte in Weblication CMS Core & Grid v12.6.24. The vulnerability is located in the `wFilemanager.php` and `index.php`… |
CVE-2018-13001 | Medium | 6.1 | 2018-06-29 | An XSS issue was discovered in Sandoba CP:Shop v2016.1. The vulnerability is located in the `admin.php` file of the `./cpshop/` module. Remote attackers are ab… |
CVE-2018-13000 | Medium | 4.8 | 2018-06-29 | An XSS issue was discovered in Advanced Electron Forum (AEF) v1.0.9. A persistent XSS vulnerability is located in the `FTP Link` element of the `Private Messag… |
CVE-2018-12999 | High | 7.5 | 2018-06-29 | Incorrect Access Control in AgentTrayIconServlet in Zoho ManageEngine Desktop Central 10.0.255 allows attackers to delete certain files on the web server witho… |
CVE-2018-12998 | Medium | 6.1 | 2018-06-29 | A reflected Cross-site scripting (XSS) vulnerability in Zoho ManageEngine Netflow Analyzer before build 123137, Network Configuration Manager before build 1231… |
CVE-2018-12997 | High | 7.5 | 2018-06-29 | Incorrect Access Control in FailOverHelperServlet in Zoho ManageEngine Netflow Analyzer before build 123137, Network Configuration Manager before build 123128… |
CVE-2018-12996 | Medium | 6.1 | 2018-06-29 | A reflected Cross-site scripting (XSS) vulnerability in Zoho ManageEngine Applications Manager before 13 (Build 13800) allows remote attackers to inject arbitr… |
CVE-2018-12995 | High | 8.8 | 2018-06-29 | onefilecms.php in OneFileCMS through 2012-04-14 might allow attackers to execute arbitrary PHP code via a .php filename on the Upload screen. |
CVE-2018-12994 | High | 8.8 | 2018-06-29 | onefilecms.php in OneFileCMS through 2012-04-14 might allow attackers to execute arbitrary PHP code via a .php filename on the New File screen. |
CVE-2018-12993 | Critical | 9.8 | 2018-06-29 | onefilecms.php in OneFileCMS through 2012-04-14 might allow attackers to conduct brute-force attacks via the onefilecms_username and onefilecms_password fields. |
CVE-2018-12992 | Medium | 4.8 | 2018-06-29 | An issue was discovered CMS MaeloStore V.1.5.0. There is stored XSS in the Telephone field of the admin interface. |
CVE-2018-12988 | High | 7.5 | 2018-06-29 | GreenCMS 2.3.0603 has an arbitrary file download vulnerability via an index.php?m=admin&c=media&a=downfile URI. |
CVE-2018-12984 | Critical | 9.8 | 2018-06-29 | Hycus CMS 1.0.4 allows Authentication Bypass via "'=' 'OR'" credentials. |
CVE-2018-12983 | High | 7.8 | 2018-06-29 | A stack-based buffer over-read in the PdfEncryptMD5Base::ComputeEncryptionKey() function in PdfEncrypt.cpp in PoDoFo 0.9.6-rc1 could be leveraged by remote att… |
CVE-2018-12982 | Medium | 5.5 | 2018-06-29 | Invalid memory read in the PoDoFo::PdfVariant::DelayedLoad() function in PdfVariant.h in PoDoFo 0.9.6-rc1 allows remote attackers to have denial-of-service imp… |
CVE-2018-12973 | Medium | 6.1 | 2018-06-29 | An issue was discovered in OpenTSDB 2.3.0. There is XSS in parameter 'json' to the /q URI. |
CVE-2018-12972 | Critical | 9.8 | 2018-06-29 | An issue was discovered in OpenTSDB 2.3.0. Many parameters to the /q URI can execute commands, including o, key, style, and yrange and y2range and their JSON i… |
CVE-2018-12971 | Medium | 6.5 | 2018-06-29 | EasyCMS 1.3 has CSRF via the index.php?s=/admin/user/delAll URI to delete users. |
CVE-2018-8016 | Critical | 9.8 | 2018-06-28 | The default configuration in Apache Cassandra 3.8 through 3.11.1 binds an unauthenticated JMX/RMI interface to all network interfaces, which allows remote atta… |
CVE-2018-1351 | Medium | 4.8 | 2018-06-28 | A Cross-site Scripting (XSS) vulnerability in Fortinet FortiManager 6.0.0, 5.6.6 and below versions allows attacker to execute HTML/javascript code via managed… |
CVE-2018-12934 | High | 7.5 | 2018-06-28 | remember_Ktype in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.30, allows attackers to trigger excessive memory consumption (aka OOM). This c… |
CVE-2018-12933 | Critical | 9.8 | 2018-06-28 | PlayEnhMetaFileRecord in enhmetafile.c in Wine 3.7 allows attackers to cause a denial of service (out-of-bounds write) or possibly have unspecified other impac… |
CVE-2018-12932 | Critical | 9.8 | 2018-06-28 | PlayEnhMetaFileRecord in enhmetafile.c in Wine 3.7 allows attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified othe… |
CVE-2018-12931 | High | 7.8 | 2018-06-28 | ntfs_attr_find in the ntfs.ko filesystem driver in the Linux kernel 4.15.0 allows attackers to trigger a stack-based out-of-bounds write and cause a denial of… |
CVE-2018-12930 | High | 7.8 | 2018-06-28 | ntfs_end_buffer_async_read in the ntfs.ko filesystem driver in the Linux kernel 4.15.0 allows attackers to trigger a stack-based out-of-bounds write and cause… |
CVE-2018-12929 | Medium | 5.5 | 2018-06-28 | ntfs_read_locked_inode in the ntfs.ko filesystem driver in the Linux kernel 4.15.0 allows attackers to trigger a use-after-free read and possibly cause a denia… |
CVE-2018-12928 | Medium | 5.5 | 2018-06-28 | In the Linux kernel 4.15.0, a NULL pointer dereference was discovered in hfs_ext_read_extent in hfs.ko. This can occur during a mount of a crafted hfs filesyst… |