2018 CVEs (page 112)
Page 112 of 162 — CVEs published in 2018, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2018-1000534 | Medium | 6.1 | 2018-06-26 | Joplin version prior to 1.0.90 contains a XSS evolving into code execution due to enabled nodeIntegration for that particular BrowserWindow instance where XSS… |
CVE-2018-1000533 | Critical | 9.8 | 2018-06-26 | klaussilveira GitList version <= 0.6 contains a Passing incorrectly sanitized input to system function vulnerability in `searchTree` function that can result i… |
CVE-2018-1000532 | Medium | 4.7 | 2018-06-26 | beep version 1.3 and up contains a External Control of File Name or Path vulnerability in --device option that can result in Local unprivileged user can inhibi… |
CVE-2018-1000531 | High | 7.5 | 2018-06-26 | inversoft prime-jwt version prior to commit abb0d479389a2509f939452a6767dc424bb5e6ba contains a CWE-20 vulnerability in JWTDecoder.decode that can result in an… |
CVE-2018-1000529 | Medium | 6.1 | 2018-06-26 | Grails Fields plugin version 2.2.7 contains a Cross Site Scripting (XSS) vulnerability in Using the display tag that can result in XSS . This vulnerability app… |
CVE-2018-1000528 | Medium | 6.1 | 2018-06-26 | GONICUS GOsa version before commit 56070d6289d47ba3f5918885954dcceb75606001 contains a Cross Site Scripting (XSS) vulnerability in change password form (html/p… |
CVE-2018-1000527 | High | 7.2 | 2018-06-26 | Froxlor version <= 0.9.39.5 contains a PHP Object Injection vulnerability in Domain name form that can result in Possible information disclosure and remote cod… |
CVE-2018-1000526 | High | 7.5 | 2018-06-26 | Openpsa contains a XML Injection vulnerability in RSS file upload feature that can result in Remote denial of service. This attack appear to be exploitable via… |
CVE-2018-1000525 | Critical | 9.8 | 2018-06-26 | openpsa contains a PHP Object Injection vulnerability in Form data passed as GET request variables that can result in Possible information disclosure and remot… |
CVE-2018-1000524 | Medium | 5.5 | 2018-06-26 | miniSphere version 5.2.9 and earlier contains a Integer Overflow vulnerability in layer_resize() function in map_engine.c that can result in remote denial of s… |
CVE-2018-1000523 | High | 8.1 | 2018-06-26 | topydo contains a CWE-20: Improper Input Validation vulnerability in ListFormatParser::parse, file topydo/lib/ListFormat.py line 292 as of d4f843dac71308b2f29a… |
CVE-2018-1000521 | Medium | 6.1 | 2018-06-26 | BigTree-CMS contains a Cross Site Scripting (XSS) vulnerability in /users/create that can result in The low-privileged users can use this vulnerability to atta… |
CVE-2018-1000520 | High | 7.5 | 2018-06-26 | ARM mbedTLS version 2.7.0 and earlier contains a Ciphersuite Allows Incorrectly Signed Certificates vulnerability in mbedtls_ssl_get_verify_result() that can r… |
CVE-2018-1000519 | Medium | 6.5 | 2018-06-26 | aio-libs aiohttp-session contains a Session Fixation vulnerability in load_session function for RedisStorage (see: https://github.com/aio-libs/aiohttp-session/… |
CVE-2018-1000518 | High | 7.5 | 2018-06-26 | aaugustin websockets version 4 contains a CWE-409: Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Servers and clients, unles… |
CVE-2018-1000517 | Critical | 9.8 | 2018-06-26 | BusyBox project BusyBox wget version prior to commit 8e2174e9bd836e53c8b9c6e00d1bc6e2a718686e contains a Buffer Overflow vulnerability in Busybox wget that can… |
CVE-2018-1000516 | Medium | 6.1 | 2018-06-26 | The Galaxy Project Galaxy version v14.10 contains a CWE-79: Improper Neutralization of Input During Web Page Generation vulnerability in Many templates used in… |
CVE-2018-1000515 | High | 7.5 | 2018-06-26 | ventrian News-Articles version NewsArticles.00.09.11 contains a XML External Entity (XXE) vulnerability in News-Articles/API/MetaWebLog/Handler.ashx.vb that ca… |
CVE-2018-1000514 | Medium | 4.3 | 2018-06-26 | LimeSurvey version 3.0.0-beta.3+17110 contains a Cross ite Request Forgery (CSRF) vulnerability in Boxes that can result in CSRF admins to delete boxes. This v… |
CVE-2018-1000513 | Medium | 4.8 | 2018-06-26 | LimeSurvey version 3.0.0-beta.3+17110 contains a Cross Site Scripting (XSS) vulnerability in Boxes that can result in JS code execution against LimeSurvey admi… |
CVE-2018-1000512 | Medium | 6.1 | 2018-06-26 | Tooltipy Tooltipy (tooltips for WP) version 5 contains a Cross Site Scripting (XSS) vulnerability in Glossary shortcode that can result in could allow anybody… |
CVE-2018-1000511 | High | 7.5 | 2018-06-26 | WP ULike version 2.8.1, 3.1 contains a Incorrect Access Control vulnerability in AJAX that can result in allows anybody to delete any row in certain tables. Th… |
CVE-2018-1000510 | Medium | 6.5 | 2018-06-26 | WP Image Zoom version 1.23 contains a Incorrect Access Control vulnerability in AJAX settings that can result in allows anybody to cause denial of service. Thi… |
CVE-2018-1000509 | High | 7.2 | 2018-06-26 | Redirection version 2.7.1 contains a Serialisation vulnerability possibly allowing ACE vulnerability in Settings page AJAX that can result in could allow admin… |
CVE-2018-1000508 | Medium | 4.8 | 2018-06-26 | WP ULike version 2.8.1, 3.1 contains a Cross Site Scripting (XSS) vulnerability in Settings screen that can result in allows unauthorised users to do almost an… |
CVE-2018-1000507 | Medium | 6.5 | 2018-06-26 | WP User Groups version 2.0.0 contains a Cross ite Request Forgery (CSRF) vulnerability in Settings page that can result in allows anybody to modify user groups… |
CVE-2018-1000506 | High | 8.8 | 2018-06-26 | Metronet Tag Manager version 1.2.7 contains a Cross ite Request Forgery (CSRF) vulnerability in Settings page /wp-admin/options-general.php?page=metronet-tag-m… |
CVE-2018-1000505 | Medium | 6.5 | 2018-06-26 | Tooltipy (tooltips for WP) version 5 contains a Cross ite Request Forgery (CSRF) vulnerability in Settings page that can result in could allow anybody to dupli… |
CVE-2018-1000504 | High | 7.2 | 2018-06-26 | Redirection version 2.7.3 contains a ACE via file inclusion vulnerability in Pass-through mode that can result in allows admins to execute any PHP file in the… |
CVE-2018-1000503 | Medium | 4.3 | 2018-06-26 | MyBB Group MyBB contains a Incorrect Access Control vulnerability in Private forums that can result in Users can view posts from private forums without having… |
CVE-2018-1000502 | High | 7.2 | 2018-06-26 | MyBB Group MyBB contains a File Inclusion vulnerability in Admin panel (Tools and Maintenance -> Task Manager -> Add New Task) that can result in Allows Local… |
CVE-2018-1000501 | Critical | 9.8 | 2018-06-26 | Instant Update CMS contains a Password Reset Vulnerability vulnerability in /iu-application/controllers/administration/auth.php that can result in Account Tack… |
CVE-2018-1000500 | High | 8.1 | 2018-06-26 | Busybox contains a Missing SSL certificate validation vulnerability in The "busybox wget" applet that can result in arbitrary code execution. This attack appea… |
CVE-2018-1000205 | Medium | 5.5 | 2018-06-26 | U-Boot contains a CWE-20: Improper Input Validation vulnerability in Verified boot signature validation that can result in Bypass verified boot. This attack ap… |
CVE-2018-10852 | Low | 3.8 | 2018-06-26 | The UNIX pipe which sudo uses to contact SSSD and read the available sudo rules from SSSD has too wide permissions, which means that anyone who can send a mess… |
CVE-2018-1000204 | Medium | 5.3 | 2018-06-26 | Linux Kernel version 3.18 to 4.16 incorrectly handles an SG_IO ioctl on /dev/sg0 with dxfer_direction=SG_DXFER_FROM_DEV and an empty 6-byte cmdp. This may lead… |
CVE-2018-0612 | Medium | 6.1 | 2018-06-26 | Cross-site scripting vulnerability in 5000 trillion yen converter v1.0.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. |
CVE-2018-0611 | High | 7.4 | 2018-06-26 | The ANA App for iOS version 4.0.22 and earlier does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers a… |
CVE-2018-0610 | High | 7.2 | 2018-06-26 | Local file inclusion vulnerability in Zenphoto 1.4.14 and earlier allows a remote attacker with an administrative privilege to execute arbitrary code or obtain… |
CVE-2018-0609 | High | 7.8 | 2018-06-26 | Untrusted search path vulnerability in LINE for Windows versions before 5.8.0 allows an attacker to gain privileges via a Trojan horse DLL in an unspecified di… |
CVE-2018-0608 | Critical | 9.8 | 2018-06-26 | Buffer overflow in H2O version 2.2.4 and earlier allows remote attackers to execute arbitrary code or cause a denial of service (DoS) via unspecified vectors. |
CVE-2018-0606 | High | 7.2 | 2018-06-26 | SQL injection vulnerability in the Pixelpost v1.7.3 and earlier allows remote authenticated attackers to execute arbitrary SQL commands via unspecified vectors. |
CVE-2018-0605 | Medium | 6.1 | 2018-06-26 | Cross-site scripting vulnerability in Pixelpost v1.7.3 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. |
CVE-2018-0604 | High | 7.2 | 2018-06-26 | Pixelpost v1.7.3 and earlier allows remote code execution via unspecified vectors. |
CVE-2018-0603 | Medium | 6.1 | 2018-06-26 | Cross-site scripting vulnerability in Site Reviews versions prior to 2.15.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vect… |
CVE-2018-0602 | Medium | 6.1 | 2018-06-26 | Cross-site scripting vulnerability in Email Subscribers & Newsletters versions prior to 3.5.0 allows remote attackers to inject arbitrary web script or HTML vi… |
CVE-2018-0601 | High | 7.8 | 2018-06-26 | Untrusted search path vulnerability in axpdfium v0.01 allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory. |
CVE-2018-0600 | High | 7.8 | 2018-06-26 | Untrusted search path vulnerability in the installer of PlayMemories Home for Windows ver.5.5.01 and earlier allows an attacker to gain privileges via a Trojan… |
CVE-2018-0599 | High | 7.8 | 2018-06-26 | Untrusted search path vulnerability in the installer of Visual C++ Redistributable allows an attacker to gain privileges via a Trojan horse DLL in an unspecifi… |
CVE-2018-0598 | High | 7.8 | 2018-06-26 | Untrusted search path vulnerability in Self-extracting archive files created by IExpress bundled with Microsoft Windows allows an attacker to gain privileges v… |
CVE-2018-0597 | High | 7.8 | 2018-06-26 | Untrusted search path vulnerability in the installer of Visual Studio Code allows an attacker to gain privileges via a Trojan horse DLL in an unspecified direc… |
CVE-2018-0596 | High | 7.8 | 2018-06-26 | Untrusted search path vulnerability in the installer of Visual Studio Community allows an attacker to gain privileges via a Trojan horse DLL in an unspecified… |
CVE-2018-0595 | High | 7.8 | 2018-06-26 | Untrusted search path vulnerability in the installer of Skype for Windows allows an attacker to gain privileges via a Trojan horse DLL in an unspecified direct… |
CVE-2018-0594 | High | 7.8 | 2018-06-26 | Untrusted search path vulnerability in Skype for Windows allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory. |
CVE-2018-0593 | High | 7.8 | 2018-06-26 | Untrusted search path vulnerability in the installer of Microsoft OneDrive allows an attacker to gain privileges via a Trojan horse DLL in an unspecified direc… |
CVE-2018-0592 | High | 7.8 | 2018-06-26 | Untrusted search path vulnerability in Microsoft OneDrive allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory. |
CVE-2018-0584 | High | 7.5 | 2018-06-26 | IIJ SmartKey App for Android version 2.1.0 and earlier allows remote attackers to bypass authentication [effect_of_bypassing_authentication] via unspecified ve… |
CVE-2018-0575 | Medium | 5.3 | 2018-06-26 | baserCMS (baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions) allows remote attackers to bypass access restriction in mail form to vie… |
CVE-2018-0574 | Medium | 6.1 | 2018-06-26 | Cross-site scripting vulnerability in baserCMS (baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions) allows remote attackers to inject… |
CVE-2018-0573 | Medium | 5.3 | 2018-06-26 | baserCMS (baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions) allows remote attackers to bypass access restriction for a content to vi… |
CVE-2018-0572 | High | 8.1 | 2018-06-26 | baserCMS (baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions) allows remote authenticated attackers to bypass access restriction to vi… |
CVE-2018-0571 | Medium | 4.3 | 2018-06-26 | baserCMS (baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions) allows remote attackers with a site operator privilege to upload arbitra… |
CVE-2018-0570 | Medium | 5.4 | 2018-06-26 | Cross-site scripting vulnerability in baserCMS (baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions) allows remote authenticated attack… |
CVE-2018-0569 | High | 8.8 | 2018-06-26 | baserCMS (baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions) allows remote authenticated attackers to execute arbitrary OS commands v… |
CVE-2018-0567 | Medium | 6.3 | 2018-06-26 | Cybozu Office 10.0.0 to 10.8.0 allows authenticated attackers to bypass access restriction to access and write non-public data via unspecified vectors. |
CVE-2018-0566 | Medium | 4.3 | 2018-06-26 | Cybozu Office 10.0.0 to 10.8.0 allows authenticated attackers to bypass authentication to obtain the schedules without access privilege via unspecified vectors. |
CVE-2018-0565 | Medium | 6.1 | 2018-06-26 | Cross-site scripting vulnerability in Cybozu Office 10.0.0 to 10.8.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. |
CVE-2018-0563 | High | 7.8 | 2018-06-26 | Untrusted search path vulnerability in the installer of FLET'S VIRUS CLEAR Easy Setup & Application Tool ver.13.0 and earlier versions and FLET'S VIRUS CLEAR v… |
CVE-2018-0559 | Medium | 6.1 | 2018-06-26 | Cross-site scripting vulnerability in Cybozu Mailwise 5.0.0 to 5.4.1 allows remote attackers to inject arbitrary web script or HTML 'Address' via unspecified v… |
CVE-2018-0558 | Medium | 6.1 | 2018-06-26 | Reflected cross-site scripting vulnerability in Cybozu Mailwise 5.0.0 to 5.4.1 allows remote attackers to inject arbitrary web script or HTML in 'System settin… |
CVE-2018-0557 | Medium | 6.1 | 2018-06-26 | Stored cross-site scripting vulnerability in Cybozu Mailwise 5.0.0 to 5.4.1 allows remote attackers to inject arbitrary web script or HTML 'E-mail Details Scre… |
CVE-2018-0529 | Medium | 4.3 | 2018-06-26 | Cybozu Office 10.0.0 to 10.7.0 allows remote attackers to cause a denial of service via unspecified vectors. |
CVE-2018-0528 | Medium | 4.3 | 2018-06-26 | Cybozu Office 10.0.0 to 10.7.0 allows authenticated attackers to bypass authentication to view the schedules that are not permitted to access via unspecified v… |
CVE-2018-0527 | Medium | 6.1 | 2018-06-26 | Cross-site scripting vulnerability in Cybozu Office 10.0.0 to 10.7.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. |
CVE-2018-0526 | Medium | 4.3 | 2018-06-26 | Cybozu Office 10.0.0 to 10.7.0 allow remote attackers to display an image located in an external server via unspecified vectors. |
CVE-2018-12889 | Critical | 9.8 | 2018-06-26 | An issue was discovered in CCN-lite 2.0.1. There is a heap-based buffer overflow in mkAddToRelayCacheRequest and in ccnl_populate_cache for an array lacking '\… |
CVE-2018-12884 | Medium | 6.5 | 2018-06-26 | In Octopus Deploy 3.0 onwards (before 2018.6.7), an authenticated user with incorrect permissions may be able to create Accounts under the Infrastructure menu. |
CVE-2018-12882 | Critical | 9.8 | 2018-06-26 | exif_read_from_impl in ext/exif/exif.c in PHP 7.2.x through 7.2.7 allows attackers to trigger a use-after-free (in exif_read_from_file) because it closes a str… |
CVE-2018-12603 | High | 8.8 | 2018-06-25 | Cross-site request forgery (CSRF) vulnerability in admin.php in LFCMS 3.7.0 allows remote attackers to hijack the authentication of unspecified users for reque… |
CVE-2018-11589 | Critical | 9.8 | 2018-06-25 | Multiple SQL injection vulnerabilities in Centreon 3.4.6 including Centreon Web 2.8.23 allow attacks via the searchU parameter in viewLogs.php, the id paramete… |
CVE-2018-11588 | Medium | 5.4 | 2018-06-25 | Centreon 3.4.6 including Centreon Web 2.8.23 is vulnerable to an authenticated user injecting a payload into the username or command description, resulting in… |
CVE-2018-11587 | Critical | 9.8 | 2018-06-25 | There is Remote Code Execution in Centreon 3.4.6 including Centreon Web 2.8.23 via the RPN value in the Virtual Metric form in centreonGraph.class.php. |
CVE-2018-12735 | High | 7.5 | 2018-06-25 | SAJ Solar Inverter allows remote attackers to obtain potentially sensitive information via a direct request for the inverter_info.htm or english_main.htm URI. |
CVE-2018-8755 | Critical | 9.8 | 2018-06-25 | NuCom WR644GACV devices before STA006 allow an attacker to download the configuration file without credentials. By downloading this file, an attacker can acces… |
CVE-2018-12602 | High | 8.8 | 2018-06-25 | A CSRF vulnerability exists in LFCMS 3.7.0: users can be added arbitrarily. |
CVE-2018-11046 | Medium | 6.5 | 2018-06-25 | Pivotal Operations Manager, versions 2.1.x prior to 2.1.6 and version 2.0.14, includes NGINX packages that lacks security vulnerability patches. An attacker wi… |
CVE-2018-11041 | Medium | 6.1 | 2018-06-25 | Cloud Foundry UAA, versions later than 4.6.0 and prior to 4.19.0 except 4.10.1 and 4.7.5 and uaa-release versions later than v48 and prior to v60 except v55.1… |
CVE-2018-11040 | High | 7.5 | 2018-06-25 | Spring Framework, versions 5.0.x prior to 5.0.7 and 4.3.x prior to 4.3.18 and older unsupported versions, allows web applications to enable cross-domain reques… |
CVE-2018-11039 | Medium | 5.9 | 2018-06-25 | Spring Framework (versions 5.0.x prior to 5.0.7, versions 4.3.x prior to 4.3.18, and older unsupported versions) allow web applications to change the HTTP requ… |
CVE-2018-10956 | High | 7.5 | 2018-06-25 | IPConfigure Orchid Core VMS 2.0.5 allows Directory Traversal. |
CVE-2018-12084 | High | 7.5 | 2018-06-25 | The mintToken function of a smart contract implementation for BitAsean (BAS), a tradable Ethereum ERC20 token, has no period constraint, which allows the owner… |
CVE-2018-12083 | High | 7.5 | 2018-06-25 | The mintToken function of a smart contract implementation for GOAL Bonanza (GOAL), a tradable Ethereum ERC20 token, has no period constraint, which allows the… |
CVE-2018-12082 | High | 7.5 | 2018-06-25 | The mintToken function of a smart contract implementation for Fujinto (NTO), a tradable Ethereum ERC20 token, has no period constraint, which allows the owner… |
CVE-2018-12081 | High | 7.5 | 2018-06-25 | The mintToken function of a smart contract implementation for Target Coin (TGT), a tradable Ethereum ERC20 token, has no period constraint, which allows the ow… |
CVE-2018-12080 | High | 7.5 | 2018-06-25 | The mintToken function of a smart contract implementation for Internet Node Token (INT), a tradable Ethereum ERC20 token, has no period constraint, which allow… |
CVE-2018-12079 | High | 7.5 | 2018-06-25 | The mintToken function of a smart contract implementation for Substratum (SUB), a tradable Ethereum ERC20 token, has no period constraint, which allows the own… |
CVE-2018-12078 | High | 7.5 | 2018-06-25 | The mintToken function of a smart contract implementation for PolyAI (AI), a tradable Ethereum ERC20 token, has no period constraint, which allows the owner to… |
CVE-2018-12070 | High | 7.5 | 2018-06-25 | The sell function of a smart contract implementation for SEC, a tradable Ethereum ERC20 token, allows a potential trap that could be used to cause financial da… |
CVE-2018-12068 | High | 7.5 | 2018-06-25 | The sell function of a smart contract implementation for Target Coin (TGT), a tradable Ethereum ERC20 token, allows a potential trap that could be used to caus… |
CVE-2018-12067 | High | 7.5 | 2018-06-25 | The sell function of a smart contract implementation for Substratum (SUB), a tradable Ethereum ERC20 token, allows a potential trap that could be used to cause… |