2018 CVEs (page 111)
Page 111 of 162 — CVEs published in 2018, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2018-12589 | High | 7.8 | 2018-06-28 | Polaris Office 2017 8.1 allows attackers to execute arbitrary code via a Trojan horse puiframeworkproresenu.dll file in the current working directory. |
CVE-2018-11510 | Critical | 9.8 | 2018-06-28 | The ASUSTOR ADM 3.1.0.RFQ3 NAS portal suffers from an unauthenticated remote code execution vulnerability in the portal/apis/aggrecate_js.cgi file by embedding… |
CVE-2018-12927 | High | 7.5 | 2018-06-28 | Northern Electric & Power (NEP) inverter devices allow remote attackers to obtain potentially sensitive information via a direct request for the nep/status/ind… |
CVE-2018-12926 | High | 7.5 | 2018-06-28 | Pharos Controls devices allow remote attackers to obtain potentially sensitive information via a direct request for the default/index.lsp or default/log.lsp UR… |
CVE-2018-12925 | Critical | 9.8 | 2018-06-28 | Baseon Lantronix MSS devices do not require a password for TELNET access. |
CVE-2018-12924 | Critical | 9.8 | 2018-06-28 | Sollae Serial-Ethernet-Module and Remote-I/O-Device-Server devices have a default password of sollae for the TELNET service. |
CVE-2018-12923 | High | 7.5 | 2018-06-28 | BWS Systems HA-Bridge devices allow remote attackers to obtain potentially sensitive information via a direct request for the #!/system URI. |
CVE-2018-12922 | High | 7.5 | 2018-06-28 | Emerson Liebert IntelliSlot Web Card devices allow remote attackers to reconfigure access control via the config/configUser.htm or config/configTelnet.htm URI. |
CVE-2018-12921 | High | 7.5 | 2018-06-28 | Electro Industries GaugeTech Nexus devices allow remote attackers to obtain potentially sensitive information via a direct request for the meter_information.ht… |
CVE-2018-12920 | High | 7.5 | 2018-06-28 | Brickstream 2300 devices allow remote attackers to obtain potentially sensitive information via a direct request for the basic.html#ipsettings or basic.html#da… |
CVE-2018-5528 | Medium | 5.3 | 2018-06-27 | Under certain conditions, TMM may restart and produce a core file while processing APM data on BIG-IP 13.0.1 or 13.1.0.4-13.1.0.7. |
CVE-2018-5527 | High | 7.5 | 2018-06-27 | On BIG-IP 13.1.0-13.1.0.7, a remote attacker using undisclosed methods against virtual servers configured with a Client SSL or Server SSL profile that has the… |
CVE-2018-1355 | Medium | 6.1 | 2018-06-27 | An open redirect vulnerability in Fortinet FortiManager 6.0.0, 5.6.5 and below versions, FortiAnalyzer 6.0.0, 5.6.5 and below versions allows attacker to injec… |
CVE-2018-1354 | Medium | 6.5 | 2018-06-27 | An improper access control vulnerability in Fortinet FortiManager 6.0.0, 5.6.5 and below versions, FortiAnalyzer 6.0.0, 5.6.5 and below versions allows a regul… |
CVE-2018-1553 | Medium | 5.3 | 2018-06-27 | IBM WebSphere Application Server Liberty prior to 18.0.0.2 could allow a remote attacker to obtain sensitive information, caused by mishandling of exceptions b… |
CVE-2018-1543 | Medium | 5.9 | 2018-06-27 | IBM WebSphere MQ 8.0 and 9.0 could allow a remote attacker to obtain sensitive information, caused by the failure to properly validate the SSL certificate. An… |
CVE-2018-1507 | Medium | 5.4 | 2018-06-27 | IBM DOORS Next Generation (DNG/RRC) 6.0.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web… |
CVE-2018-1457 | Critical | 9.8 | 2018-06-27 | An undisclosed vulnerability in IBM Rational DOORS 9.5.1 through 9.6.1.10 application allows an attacker to gain DOORS administrator privileges. IBM X-Force ID… |
CVE-2018-1306 | High | 7.5 | 2018-06-27 | The PortletV3AnnotatedDemo Multipart Portlet war file code provided in Apache Pluto version 3.0.0 could allow a remote attacker to obtain sensitive information… |
CVE-2018-12919 | Medium | 6.1 | 2018-06-27 | In CraftedWeb through 2013-09-24, aasp_includes/pages/notice.php allows XSS via the e parameter. |
CVE-2018-12918 | Critical | 9.8 | 2018-06-27 | In libpbc.a in PBC through 2017-03-02, there is a Segmentation fault in _pbcB_register_fields in bootstrap.c. |
CVE-2018-12917 | Critical | 9.8 | 2018-06-27 | In libpbc.a in PBC through 2017-03-02, there is a heap-based buffer over-read in _pbcM_ip_new in map.c. |
CVE-2018-12916 | Critical | 9.8 | 2018-06-27 | In libpbc.a in PBC through 2017-03-02, there is a Segmentation fault in _pbcP_message_default in proto.c. |
CVE-2018-12915 | Critical | 9.8 | 2018-06-27 | In libpbc.a in PBC through 2017-03-02, there is a buffer over-read in calc_hash in map.c. |
CVE-2018-12914 | Critical | 9.8 | 2018-06-27 | A remote code execution issue was discovered in PublicCMS V4.0.20180210. An attacker can upload a ZIP archive that contains a .jsp file with a directory traver… |
CVE-2018-12913 | High | 7.5 | 2018-06-27 | In Miniz 2.0.7, tinfl_decompress in miniz_tinfl.c has an infinite loop because sym2 and counter can both remain equal to zero. |
CVE-2018-12912 | High | 7.2 | 2018-06-27 | An issue wan discovered in admin\controllers\database.php in HongCMS 3.0.0. There is a SQL Injection vulnerability via an admin/index.php/database/operate?dbac… |
CVE-2018-12536 | Medium | 5.3 | 2018-06-27 | In Eclipse Jetty Server, all 9.x versions, on webapps deployed using default Error Handling, when an intentionally bad query arrives that doesn't match a dynam… |
CVE-2018-5437 | Medium | 6.8 | 2018-06-27 | The TIBCO Spotfire Client and TIBCO Spotfire Web Player Client components of TIBCO Software Inc.'s TIBCO Spotfire Analyst, TIBCO Spotfire Analytics Platform fo… |
CVE-2018-5436 | Medium | 6.5 | 2018-06-27 | The Spotfire server component of TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace, and TIBCO Spotfire Server contain multiple vulner… |
CVE-2018-5435 | Critical | 9.6 | 2018-06-27 | The TIBCO Spotfire Client and TIBCO Spotfire Web Player Client components of TIBCO Software Inc.'s TIBCO Spotfire Analyst, TIBCO Spotfire Analytics Platform fo… |
CVE-2018-12909 | High | 7.5 | 2018-06-27 | Webgrind 1.5 relies on user input to display a file, which lets anyone view files from the local filesystem (that the webserver user has access to) via an inde… |
CVE-2018-12908 | Critical | 9.8 | 2018-06-27 | Brynamics "Online Trade - Online trading and cryptocurrency investment system" allows remote attackers to obtain sensitive information via a direct request for… |
CVE-2018-8025 | High | 8.1 | 2018-06-27 | CVE-2018-8025 describes an issue in Apache HBase that affects the optional "Thrift 1" API server when running over HTTP. There is a race-condition which could… |
CVE-2018-12907 | High | 7.5 | 2018-06-27 | In Rclone 1.42, use of "rclone sync" to migrate data between two Google Cloud Storage buckets might allow attackers to trigger the transmission of any URL's co… |
CVE-2018-12905 | Medium | 6.1 | 2018-06-27 | joyplus-cms 1.6.0 has XSS in admin_player.php, related to manager/index.php "system manage" and "add" actions. |
CVE-2018-12904 | Medium | 4.9 | 2018-06-27 | In arch/x86/kvm/vmx.c in the Linux kernel before 4.17.2, when nested virtualization is used, local attackers could cause L1 KVM guests to VMEXIT, potentially a… |
CVE-2018-12903 | Medium | 5.4 | 2018-06-26 | In CyberArk Endpoint Privilege Manager (formerly Viewfinity) 10.2.1.603, there is persistent XSS via an account name on the create token screen, the VfManager… |
CVE-2018-12902 | Medium | 6.1 | 2018-06-26 | In Easy Magazine through 2012-10-26, there is XSS in the search bar of the web site. |
CVE-2018-12900 | High | 8.8 | 2018-06-26 | Heap-based buffer overflow in the cpSeparateBufToContigBuf function in tiffcp.c in LibTIFF 3.9.3, 3.9.4, 3.9.5, 3.9.6, 3.9.7, 4.0.0beta7, 4.0.0alpha4, 4.0.0alp… |
CVE-2018-11053 | Medium | 6.5 | 2018-06-26 | Dell EMC iDRAC Service Module for all supported Linux and XenServer versions v3.0.1, v3.0.2, v3.1.0, v3.2.0, when started, changes the default file permission… |
CVE-2018-3841 | High | 7.5 | 2018-06-26 | A denial-of-service vulnerability exists in the Pixar Renderman IT Display Service 21.6 (0x69). The vulnerability is present in the parsing of a network packet… |
CVE-2018-3840 | High | 7.5 | 2018-06-26 | A denial-of-service vulnerability exists in the Pixar Renderman IT Display Service 21.6 (0x67). The vulnerability is present in the parsing of a network packet… |
CVE-2018-1614 | Medium | 5.8 | 2018-06-26 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 using malformed SAML responses from the SAML identity provider could allow a remote attacker to obtain… |
CVE-2018-1374 | Medium | 5.3 | 2018-06-26 | An IBM WebSphere MQ (Maintenance levels 7.1.0.0 - 7.1.0.9, 7.5.0.0 - 7.5.0.8, 8.0.0.0 - 8.0.0.8, 9.0.0.0 - 9.0.0.2, and 9.0.0 - 9.0.4) client connecting to a Q… |
CVE-2018-12895 | High | 8.8 | 2018-06-26 | WordPress through 4.9.6 allows Author users to execute arbitrary code by leveraging directory traversal in the wp-admin/post.php thumb parameter, which is pass… |
CVE-2018-10594 | Critical | 9.8 | 2018-06-26 | Delta Industrial Automation COMMGR from Delta Electronics versions 1.08 and prior with accompanying PLC Simulators (DVPSimulator EH2, EH3, ES2, SE, SS2 and AHS… |
CVE-2018-3760 | High | 7.5 | 2018-06-26 | There is an information leak vulnerability in Sprockets. Versions Affected: 4.0.0.beta7 and lower, 3.7.1 and lower, 2.12.4 and lower. Specially crafted request… |
CVE-2018-12712 | High | 8.8 | 2018-06-26 | An issue was discovered in Joomla! 2.5.0 through 3.8.8 before 3.8.9. The autoload code checks classnames to be valid, using the "class_exists" function in PHP… |
CVE-2018-12711 | Medium | 6.1 | 2018-06-26 | An XSS issue was discovered in the language switcher module in Joomla! 1.6.0 through 3.8.8 before 3.8.9. In some cases, the link of the current language might… |
CVE-2018-4861 | Medium | 4.9 | 2018-06-26 | A vulnerability has been identified in SCALANCE M875 (All versions). An authenticated remote attacker with access to the web interface (443/tcp), could potenti… |
CVE-2018-4860 | High | 7.2 | 2018-06-26 | A vulnerability has been identified in SCALANCE M875 (All versions). An authenticated remote attacker with access to the web interface (443/tcp), could execute… |
CVE-2018-4859 | High | 7.2 | 2018-06-26 | A vulnerability has been identified in SCALANCE M875 (All versions). An authenticated remote attacker with access to the web interface (443/tcp), could execute… |
CVE-2018-4846 | Critical | 9.8 | 2018-06-26 | A vulnerability has been identified in RAPIDLab 1200 systems / RAPIDPoint 400 systems / RAPIDPoint 500 systems (All versions_without_ use of Siemens Healthinee… |
CVE-2018-4845 | High | 8.8 | 2018-06-26 | A vulnerability has been identified in RAPIDLab 1200 systems / RAPIDPoint 400 systems / RAPIDPoint 500 systems (All versions_without_ use of Siemens Healthinee… |
CVE-2018-11449 | High | 7.8 | 2018-06-26 | A vulnerability has been identified in SCALANCE M875 (All versions). An attacker with access to the local file system might obtain passwords for administrative… |
CVE-2018-11448 | Medium | 4.8 | 2018-06-26 | A vulnerability has been identified in SCALANCE M875 (All versions). The web interface on port 443/tcp could allow a stored Cross-Site Scripting (XSS) attack i… |
CVE-2018-11447 | High | 8.8 | 2018-06-26 | A vulnerability has been identified in SCALANCE M875 (All versions). The web interface on port 443/tcp could allow a Cross-Site Request Forgery (CSRF) attack i… |
CVE-2018-1072 | Medium | 5.0 | 2018-06-26 | ovirt-engine before version ovirt 4.2.2 is vulnerable to an information exposure through log files. When engine-backup was run with one of the options "--provi… |
CVE-2018-10664 | High | 7.5 | 2018-06-26 | An issue was discovered in the httpd process in multiple models of Axis IP Cameras. There is Memory Corruption. |
CVE-2018-10663 | High | 7.5 | 2018-06-26 | An issue was discovered in multiple models of Axis IP Cameras. There is an Incorrect Size Calculation. |
CVE-2018-10662 | Critical | 9.8 | 2018-06-26 | An issue was discovered in multiple models of Axis IP Cameras. There is an Exposed Insecure Interface. |
CVE-2018-10661 | Critical | 9.8 | 2018-06-26 | An issue was discovered in multiple models of Axis IP Cameras. There is a bypass of access control. |
CVE-2018-10660 | Critical | 9.8 | 2018-06-26 | An issue was discovered in multiple models of Axis IP Cameras. There is Shell Command Injection. |
CVE-2018-10659 | High | 7.5 | 2018-06-26 | There was a Memory Corruption issue discovered in multiple models of Axis IP Cameras which allows remote attackers to cause a denial of service (crash) by send… |
CVE-2018-10658 | High | 7.5 | 2018-06-26 | There was a Memory Corruption issue discovered in multiple models of Axis IP Cameras which causes a denial of service (crash). The crash arises from code insid… |
CVE-2018-6667 | Critical | 10.0 | 2018-06-26 | Authentication Bypass vulnerability in the administrative user interface in McAfee Web Gateway 7.8.1.0 through 7.8.1.5 allows remote attackers to execute arbit… |
CVE-2018-1000610 | High | 8.8 | 2018-06-26 | A exposure of sensitive information vulnerability exists in Jenkins Configuration as Code Plugin 0.7-alpha and earlier in DataBoundConfigurator.java, Attribute… |
CVE-2018-1000609 | Medium | 6.5 | 2018-06-26 | A exposure of sensitive information vulnerability exists in Jenkins Configuration as Code Plugin 0.7-alpha and earlier in ConfigurationAsCode.java that allows… |
CVE-2018-1000608 | High | 7.2 | 2018-06-26 | A exposure of sensitive information vulnerability exists in Jenkins z/OS Connector Plugin 1.2.6.1 and earlier in SCLMSCM.java that allows an attacker with loca… |
CVE-2018-1000607 | Medium | 6.5 | 2018-06-26 | A arbitrary file write vulnerability exists in Jenkins Fortify CloudScan Plugin 1.5.1 and earlier in ArchiveUtil.java that allows attackers able to control rul… |
CVE-2018-1000606 | Medium | 6.5 | 2018-06-26 | A server-side request forgery vulnerability exists in Jenkins URLTrigger Plugin 0.41 and earlier in URLTrigger.java that allows attackers with Overall/Read acc… |
CVE-2018-1000605 | High | 7.4 | 2018-06-26 | A man in the middle vulnerability exists in Jenkins CollabNet Plugin 2.0.4 and earlier in CollabNetApp.java, CollabNetPlugin.java, CNFormFieldValidator.java th… |
CVE-2018-1000604 | Medium | 5.4 | 2018-06-26 | A persisted cross-site scripting vulnerability exists in Jenkins Badge Plugin 1.4 and earlier in BadgeSummaryAction.java, HtmlBadgeAction.java that allows atta… |
CVE-2018-1000603 | High | 8.8 | 2018-06-26 | A exposure of sensitive information vulnerability exists in Jenkins Openstack Cloud Plugin 2.35 and earlier in BootSource.java, InstancesToRun.java, JCloudsCle… |
CVE-2018-1000602 | Medium | 5.9 | 2018-06-26 | A session fixation vulnerability exists in Jenkins SAML Plugin 1.0.6 and earlier in SamlSecurityRealm.java that allows unauthorized attackers to impersonate an… |
CVE-2018-1000601 | Medium | 6.5 | 2018-06-26 | A arbitrary file read vulnerability exists in Jenkins SSH Credentials Plugin 1.13 and earlier in BasicSSHUserPrivateKey.java that allows attackers with a Jenki… |
CVE-2018-1000600 | High | 8.8 | 2018-06-26 | A exposure of sensitive information vulnerability exists in Jenkins GitHub Plugin 1.29.1 and earlier in GitHubTokenCredentialsCreator.java that allows attacker… |
CVE-2018-1000559 | Medium | 6.1 | 2018-06-26 | qutebrowser version introduced in v0.11.0 (1179ee7a937fb31414d77d9970bac21095358449) contains a Cross Site Scripting (XSS) vulnerability in history command, qu… |
CVE-2018-1000558 | Medium | 6.5 | 2018-06-26 | OCS Inventory NG ocsreports 2.4 and ocsreports 2.3.1 version 2.4 and 2.3.1 contains a SQL Injection vulnerability in web search that can result in An authentic… |
CVE-2018-1000557 | Medium | 6.1 | 2018-06-26 | OCS Inventory OCS Inventory NG version ocsreports 2.4 contains a Cross Site Scripting (XSS) vulnerability in login form and search functionality that can resul… |
CVE-2018-1000556 | Medium | 6.1 | 2018-06-26 | WordPress version 4.8 + contains a Cross Site Scripting (XSS) vulnerability in plugins.php or core wordpress on delete function that can result in An attacker… |
CVE-2018-1000554 | Critical | 9.8 | 2018-06-26 | Trovebox version <= 4.0.0-rc6 contains a Unsafe password reset token generation vulnerability in user component that can result in Password reset. This attack… |
CVE-2018-1000553 | High | 8.8 | 2018-06-26 | Trovebox version <= 4.0.0-rc6 contains a Server-Side request forgery vulnerability in webhook component that can result in read or update internal resources. T… |
CVE-2018-1000552 | High | 8.8 | 2018-06-26 | Trovebox version <= 4.0.0-rc6 contains a SQL Injection vulnerability in album component that can result in SQL code injection. This attack appear to be exploit… |
CVE-2018-1000551 | High | 8.8 | 2018-06-26 | Trovebox version <= 4.0.0-rc6 contains a PHP Type juggling vulnerability in album view component that can result in Authentication bypass. This attack appear t… |
CVE-2018-1000550 | Critical | 9.8 | 2018-06-26 | The Sympa Community Sympa version prior to version 6.2.32 contains a Directory Traversal vulnerability in wwsympa.fcgi template editing function that can resul… |
CVE-2018-1000549 | Medium | 5.3 | 2018-06-26 | Wekan version 1.04.0 contains a Email / Username Enumeration vulnerability in Register' and 'Forgot your password?' pages that can result in A remote attacker… |
CVE-2018-1000548 | High | 7.8 | 2018-06-26 | Umlet version < 14.3 contains a XML External Entity (XXE) vulnerability in File parsing that can result in disclosure of confidential data, denial of service… |
CVE-2018-1000547 | Medium | 5.3 | 2018-06-26 | coreBOS version 7.0 and earlier contains a Incorrect Access Control vulnerability in Module: Contacts that can result in The error allows you to access records… |
CVE-2018-1000546 | High | 7.8 | 2018-06-26 | Triplea version <= 1.9.0.0.10291 contains a XML External Entity (XXE) vulnerability in Importing game data that can result in Possible information disclosure… |
CVE-2018-1000544 | Critical | 9.8 | 2018-06-26 | rubyzip gem rubyzip version 1.2.1 and earlier contains a Directory Traversal vulnerability in Zip::File component that can result in write arbitrary files to t… |
CVE-2018-1000543 | Medium | 6.1 | 2018-06-26 | Akiee version 0.0.3 contains a XSS leading to code execution due to the use of node integration vulnerability in "Details" of a task is not validated that can… |
CVE-2018-1000542 | High | 7.8 | 2018-06-26 | netbeans-mmd-plugin version <= 1.4.3 contains a XML External Entity (XXE) vulnerability in MMD file import that can result in Possible information disclosure… |
CVE-2018-1000540 | High | 7.8 | 2018-06-26 | LoboEvolution version < 9b75694cedfa4825d4a2330abf2719d470c654cd contains a XML External Entity (XXE) vulnerability in XML Parsing when viewing the XML file in… |
CVE-2018-1000539 | Medium | 5.3 | 2018-06-26 | Nov json-jwt version >= 0.5.0 && < 1.9.4 contains a CWE-347: Improper Verification of Cryptographic Signature vulnerability in Decryption of AES-GCM encrypted… |
CVE-2018-1000538 | High | 7.5 | 2018-06-26 | Minio Inc. Minio S3 server version prior to RELEASE.2018-05-16T23-35-33Z contains a Allocation of Memory Without Limits or Throttling (similar to CWE-774) vuln… |
CVE-2018-1000537 | Critical | 9.8 | 2018-06-26 | Marlin Firmware Marlin version 1.1.x and earlier contains a Buffer Overflow vulnerability in cardreader.cpp (Depending on branch/version) that can result in Ar… |
CVE-2018-1000536 | Medium | 6.1 | 2018-06-26 | Medis version 0.6.1 and earlier contains a XSS vulnerability evolving into code execution due to enabled nodeIntegration for the renderer process vulnerability… |
CVE-2018-1000535 | High | 7.5 | 2018-06-26 | lms version <= LMS_011123 contains a Local File Disclosure vulnerability in File reading functionality in LMS module that can result in Possible to read files… |