2018 CVEs (page 113)
Page 113 of 162 — CVEs published in 2018, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2018-12063 | High | 7.5 | 2018-06-25 | The sell function of a smart contract implementation for Internet Node Token (INT), a tradable Ethereum ERC20 token, allows a potential trap that could be used… |
CVE-2018-12062 | High | 7.5 | 2018-06-25 | The sell function of a smart contract implementation for SwftCoin (SWFTC), a tradable Ethereum ERC20 token, allows a potential trap that could be used to cause… |
CVE-2018-11446 | High | 7.5 | 2018-06-25 | The buy function of a smart contract implementation for Gold Reward (GRX), an Ethereum ERC20 token, allows a potential trap that could be used to cause financi… |
CVE-2018-12703 | High | 7.5 | 2018-06-25 | The approveAndCallcode function of a smart contract implementation for Block 18 (18T), an tradable Ethereum ERC20 token, allows attackers to steal assets (e.g… |
CVE-2018-12702 | High | 7.5 | 2018-06-25 | The approveAndCallcode function of a smart contract implementation for Globalvillage ecosystem (GVE), an Ethereum ERC20 token, allows attackers to steal assets… |
CVE-2018-12716 | Medium | 4.3 | 2018-06-25 | The API service on Google Home and Chromecast devices before mid-July 2018 does not prevent DNS rebinding attacks from reading the scan_results JSON data, whic… |
CVE-2018-12714 | Critical | 9.8 | 2018-06-24 | An issue was discovered in the Linux kernel through 4.17.2. The filter parsing in kernel/trace/trace_events_filter.c could be called with no filter, which is a… |
CVE-2018-12706 | Critical | 9.8 | 2018-06-24 | DIGISOL DG-BR4000NG devices have a Buffer Overflow via a long Authorization HTTP header. |
CVE-2018-12705 | Medium | 6.1 | 2018-06-24 | DIGISOL DG-BR4000NG devices have XSS via the SSID (it is validated only on the client side). |
CVE-2018-12713 | Critical | 9.1 | 2018-06-24 | GIMP through 2.10.2 makes g_get_tmp_dir calls to establish temporary filenames, which may result in a filename that already exists, as demonstrated by the gimp… |
CVE-2018-12699 | Critical | 9.8 | 2018-06-23 | finish_stab in stabs.c in GNU Binutils 2.30 allows attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impac… |
CVE-2018-12698 | High | 7.5 | 2018-06-23 | demangle_template in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.30, allows attackers to trigger excessive memory consumption (aka OOM) duri… |
CVE-2018-12697 | High | 7.5 | 2018-06-23 | A NULL pointer dereference (aka SEGV on unknown address 0x000000000000) was discovered in work_stuff_copy_to_from in cplus-dem.c in GNU libiberty, as distribut… |
CVE-2018-12640 | Critical | 9.8 | 2018-06-23 | The webService binary on Insteon HD IP Camera White 2864-222 devices has a Buffer Overflow via a crafted pid, pwd, or usr key in a GET request on port 34100. |
CVE-2018-11560 | Critical | 9.8 | 2018-06-23 | The webService binary on Insteon HD IP Camera White 2864-222 devices has a stack-based Buffer Overflow leading to Control-Flow Hijacking via a crafted usr key… |
CVE-2018-12696 | Medium | 6.1 | 2018-06-23 | mao10cms 6 allows XSS via the article page. |
CVE-2018-12695 | Medium | 6.1 | 2018-06-23 | mao10cms 6 allows XSS via the m=bbs&a=index page. |
CVE-2018-12694 | High | 7.5 | 2018-06-23 | TP-Link TL-WA850RE Wi-Fi Range Extender with hardware version 5 allows remote attackers to cause a denial of service (reboot) via data/reboot.json. |
CVE-2018-12693 | Medium | 6.5 | 2018-06-23 | Stack-based buffer overflow in TP-Link TL-WA850RE Wi-Fi Range Extender with hardware version 5 allows remote authenticated users to cause a denial of service (… |
CVE-2018-12692 | High | 8.8 | 2018-06-23 | TP-Link TL-WA850RE Wi-Fi Range Extender with hardware version 5 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the… |
CVE-2018-7682 | Medium | 6.5 | 2018-06-22 | Micro Focus Solutions Business Manager versions prior to 11.4 allows a user to invoke SBM RESTful services across domains. |
CVE-2018-12689 | Critical | 9.8 | 2018-06-22 | phpLDAPadmin 1.2.2 allows LDAP injection via a crafted server_id parameter in a cmd.php?cmd=login_form request, or a crafted username and password in the login… |
CVE-2018-12688 | Critical | 9.8 | 2018-06-22 | tinyexr 0.9.5 has a segmentation fault in the wav2Decode function. |
CVE-2018-12687 | High | 7.5 | 2018-06-22 | tinyexr 0.9.5 has an assertion failure in DecodePixelData in tinyexr.h. |
CVE-2018-12684 | High | 7.1 | 2018-06-22 | Out-of-bounds Read in the send_ssi_file function in civetweb.c in CivetWeb through 1.10 allows attackers to cause a Denial of Service or Information Disclosure… |
CVE-2018-12538 | High | 8.8 | 2018-06-22 | In Eclipse Jetty versions 9.4.0 through 9.4.8, when using the optional Jetty provided FileSessionDataStore for persistent storage of HttpSession details, it is… |
CVE-2018-12678 | Critical | 9.8 | 2018-06-22 | Portainer before 1.18.0 supports unauthenticated requests to the websocket endpoint with an unvalidated id query parameter for the /websocket/exec endpoint, wh… |
CVE-2018-1000201 | High | 7.8 | 2018-06-22 | ruby-ffi version 1.9.23 and earlier has a DLL loading issue which can be hijacked on Windows OS, when a Symbol is used as DLL name instead of a String This vul… |
CVE-2018-12636 | High | 7.2 | 2018-06-22 | The iThemes Security (better-wp-security) plugin before 7.0.3 for WordPress allows SQL Injection (by attackers with Admin privileges) via the logs page. |
CVE-2018-12659 | High | 8.8 | 2018-06-22 | SLiMS 8 Akasia 8.3.1 allows remote attackers to bypass the CSRF protection mechanism and obtain admin access by omitting the csrf_token parameter. |
CVE-2018-12658 | Medium | 6.1 | 2018-06-22 | Reflected Cross-Site Scripting (XSS) exists in the Stock Take module in SLiMS 8 Akasia 8.3.1 via an admin/modules/stock_take/index.php?keywords= URI. |
CVE-2018-12657 | Medium | 6.1 | 2018-06-22 | Reflected Cross-Site Scripting (XSS) exists in the Master File module in SLiMS 8 Akasia 8.3.1 via an admin/modules/master_file/rda_cmc.php?keywords= URI. |
CVE-2018-12656 | Medium | 6.1 | 2018-06-22 | Reflected Cross-Site Scripting (XSS) exists in the Membership module in SLiMS 8 Akasia 8.3.1 via an admin/modules/membership/index.php?keywords= URI. |
CVE-2018-12655 | Medium | 6.1 | 2018-06-22 | Reflected Cross-Site Scripting (XSS) exists in the Circulation module in SLiMS 8 Akasia 8.3.1 via an admin/modules/circulation/loan_rules.php?keywords= URI, a… |
CVE-2018-12654 | Medium | 6.1 | 2018-06-22 | Reflected Cross-Site Scripting (XSS) exists in the Bibliography module in SLiMS 8 Akasia 8.3.1 via an admin/modules/bibliography/index.php?keywords= URI. |
CVE-2018-1655 | Medium | 4.0 | 2018-06-22 | IBM AIX 5.3, 6.1, 7.1, and 7.2 contains a vulnerability in the rmsock command that may be used to expose kernel memory. IBM X-Force ID: 144748. |
CVE-2018-12649 | Critical | 9.8 | 2018-06-22 | An issue was discovered in app/Controller/UsersController.php in MISP 2.4.92. An adversary can bypass the brute-force protection by using a PUT HTTP method ins… |
CVE-2018-12648 | High | 7.5 | 2018-06-22 | The WEBP::GetLE32 function in XMPFiles/source/FormatSupport/WEBP_Support.hpp in Exempi 2.4.5 has a NULL pointer dereference. |
CVE-2018-12642 | High | 7.5 | 2018-06-22 | Froxlor through 0.9.39.5 has Incorrect Access Control for tickets not owned by the current user. |
CVE-2018-12641 | Medium | 5.5 | 2018-06-22 | An issue was discovered in arm_pt in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.30. Stack Exhaustion occurs in the C++ demangling functions… |
CVE-2018-12635 | High | 7.5 | 2018-06-22 | CirCarLife Scada v4.2.4 allows unauthorized upgrades via requests to the html/upgrade.html and services/system/firmware.upgrade URIs. |
CVE-2018-12634 | Critical | 9.8 | 2018-06-22 | CirCarLife Scada before 4.3 allows remote attackers to obtain sensitive information via a direct request for the html/log or services/system/info.html URI. |
CVE-2018-12633 | Medium | 6.3 | 2018-06-22 | An issue was discovered in the Linux kernel through 4.17.2. vbg_misc_device_ioctl() in drivers/virt/vboxguest/vboxguest_linux.c reads the same user data twice… |
CVE-2018-12632 | Medium | 5.3 | 2018-06-21 | Redatam7 (formerly Redatam WebServer) allows remote attackers to discover the installation path via an invalid LFN parameter to the /redbin/rpwebutilities.exe/… |
CVE-2018-12631 | High | 7.5 | 2018-06-21 | Redatam7 (formerly Redatam WebServer) allows remote attackers to read arbitrary files via /redbin/rpwebutilities.exe/text?LFN=../ directory traversal. |
CVE-2018-12630 | Critical | 9.8 | 2018-06-21 | NEWMARK (aka New Mark) NMCMS 2.1 allows SQL Injection via the sect_id parameter to the /catalog URI. |
CVE-2018-3665 | Medium | 5.6 | 2018-06-21 | System software utilizing Lazy FP state restore technique on systems using Intel Core-based microprocessors may potentially allow a local process to infer data… |
CVE-2018-12613 | High | 8.8 | 2018-06-21 | An issue was discovered in phpMyAdmin 4.8.x before 4.8.2, in which an attacker can include (view and potentially execute) files on the server. The vulnerabilit… |
CVE-2018-12581 | Medium | 6.1 | 2018-06-21 | An issue was discovered in js/designer/move.js in phpMyAdmin before 4.8.2. A Cross-Site Scripting vulnerability has been found where an attacker can use a craf… |
CVE-2018-7683 | High | 7.5 | 2018-06-21 | Micro Focus Solutions Business Manager versions prior to 11.4 might reveal certain sensitive information in server log files. |
CVE-2018-7681 | Medium | 4.8 | 2018-06-21 | Micro Focus Solutions Business Manager versions prior to 11.4 allows JavaScript to be embedded in URLs placed in "Favorites" folder. If the user has certain ad… |
CVE-2018-7680 | Medium | 6.1 | 2018-06-21 | Micro Focus Solutions Business Manager versions prior to 11.4 can reflect back HTTP header values. |
CVE-2018-7679 | Critical | 9.8 | 2018-06-21 | Micro Focus Solutions Business Manager versions prior to 11.4 when ASP.NET is configured with execute permission on the virtual directories and does not valida… |
CVE-2018-12617 | High | 7.5 | 2018-06-21 | qmp_guest_file_read in qga/commands-posix.c and qga/commands-win32.c in qemu-ga (aka QEMU Guest Agent) in QEMU 2.12.50 has an integer overflow causing a g_mall… |
CVE-2018-12615 | Medium | 5.3 | 2018-06-21 | An issue was discovered in switchGroup() in agent/ExecHelper/ExecHelperMain.cpp in Phusion Passenger before 5.3.2. The set of groups (gidset) is not set correc… |
CVE-2018-1254 | Medium | 6.1 | 2018-06-21 | RSA Authentication Manager Security Console, versions 8.3 P1 and earlier, contains a reflected cross-site scripting vulnerability. A remote unauthenticated att… |
CVE-2018-1253 | Medium | 6.1 | 2018-06-21 | RSA Authentication Manager Operation Console, versions 8.3 P1 and earlier, contains a stored cross-site scripting vulnerability. A malicious Operations Console… |
CVE-2018-12526 | Critical | 9.8 | 2018-06-21 | Telesquare SDT-CS3B1 and SDT-CW3B1 devices through 1.2.0 have a default factory account. Remote attackers can obtain access to the device via TELNET using a ha… |
CVE-2018-0712 | Critical | 9.8 | 2018-06-21 | Command injection vulnerability in LDAP Server in QNAP QTS 4.2.6 build 20171208, QTS 4.3.3 build 20180402, QTS 4.3.4 build 20180413 and their earlier versions… |
CVE-2018-0373 | Medium | 5.5 | 2018-06-21 | A vulnerability in vpnva-6.sys for 32-bit Windows and vpnva64-6.sys for 64-bit Windows of Cisco AnyConnect Secure Mobility Client for Windows Desktop could all… |
CVE-2018-0371 | Medium | 6.5 | 2018-06-21 | A vulnerability in the Web Admin Interface of Cisco Meeting Server could allow an authenticated, remote attacker to cause a denial of service (DoS) condition… |
CVE-2018-0365 | High | 8.8 | 2018-06-21 | A vulnerability in the web-based management interface of Cisco Firepower Management Center could allow an unauthenticated, remote attacker to conduct a cross-s… |
CVE-2018-0364 | High | 8.8 | 2018-06-21 | A vulnerability in the web-based management interface of Cisco Unified Communications Domain Manager could allow an unauthenticated, remote attacker to conduct… |
CVE-2018-0363 | High | 8.8 | 2018-06-21 | A vulnerability in the web-based management interface of Cisco Unified Communications Manager IM & Presence Service (formerly CUPS) could allow an unauthentica… |
CVE-2018-0362 | Medium | 4.3 | 2018-06-21 | A vulnerability in BIOS authentication management of Cisco 5000 Series Enterprise Network Compute System and Cisco Unified Computing (UCS) E-Series Servers cou… |
CVE-2018-0359 | Medium | 5.5 | 2018-06-21 | A vulnerability in the session identification management functionality of the web-based management interface for Cisco Meeting Server could allow an unauthenti… |
CVE-2018-0358 | High | 7.5 | 2018-06-21 | A vulnerability in the file descriptor handling of Cisco TelePresence Video Communication Server (VCS) Expressway could allow an unauthenticated, remote attack… |
CVE-2018-0337 | High | 7.8 | 2018-06-21 | A vulnerability in the role-based access-checking mechanisms of Cisco NX-OS Software could allow an authenticated, local attacker to execute arbitrary commands… |
CVE-2018-0331 | Medium | 6.5 | 2018-06-21 | A vulnerability in the Cisco Discovery Protocol (formerly known as CDP) subsystem of devices running, or based on, Cisco NX-OS Software contain a vulnerability… |
CVE-2018-0313 | High | 8.8 | 2018-06-21 | A vulnerability in the NX-API feature of Cisco NX-OS Software could allow an authenticated, remote attacker to send a malicious packet to the management interf… |
CVE-2018-0311 | High | 7.5 | 2018-06-21 | A vulnerability in the Cisco Fabric Services component of Cisco FXOS Software and Cisco NX-OS Software could allow an unauthenticated, remote attacker to cause… |
CVE-2018-0310 | Critical | 9.8 | 2018-06-21 | A vulnerability in the Cisco Fabric Services component of Cisco FXOS Software and Cisco NX-OS Software could allow an unauthenticated, remote attacker to obtai… |
CVE-2018-0309 | High | 7.7 | 2018-06-21 | A vulnerability in the implementation of a specific CLI command and the associated Simple Network Management Protocol (SNMP) MIB for Cisco NX-OS (in standalone… |
CVE-2018-0306 | High | 7.8 | 2018-06-21 | A vulnerability in the CLI parser of Cisco NX-OS Software could allow an authenticated, local attacker to perform a command-injection attack on an affected dev… |
CVE-2018-0305 | High | 8.6 | 2018-06-21 | A vulnerability in the Cisco Fabric Services component of Cisco FXOS Software and Cisco NX-OS Software could allow an unauthenticated, remote attacker to cause… |
CVE-2018-0303 | High | 8.8 | 2018-06-21 | A vulnerability in the Cisco Discovery Protocol component of Cisco FXOS Software and Cisco NX-OS Software could allow an unauthenticated, adjacent attacker to… |
CVE-2018-0302 | High | 7.8 | 2018-06-21 | A vulnerability in the CLI parser of Cisco FXOS Software and Cisco UCS Fabric Interconnect Software could allow an authenticated, local attacker to cause a buf… |
CVE-2018-0300 | High | 7.2 | 2018-06-21 | A vulnerability in the process of uploading new application images to Cisco FXOS on the Cisco Firepower 4100 Series Next-Generation Firewall (NGFW) and Firepow… |
CVE-2018-0299 | Medium | 6.5 | 2018-06-21 | A vulnerability in the Simple Network Management Protocol (SNMP) feature of Cisco NX-OS on the Cisco Nexus 4000 Series Switch could allow an authenticated, rem… |
CVE-2018-0298 | High | 7.5 | 2018-06-21 | A vulnerability in the web UI of Cisco FXOS and Cisco UCS Fabric Interconnect Software could allow an unauthenticated, remote attacker to cause a buffer overfl… |
CVE-2018-0330 | High | 8.8 | 2018-06-20 | A vulnerability in the NX-API management application programming interface (API) in devices running, or based on, Cisco NX-OS Software could allow an authentic… |
CVE-2018-0314 | Critical | 9.8 | 2018-06-20 | A vulnerability in the Cisco Fabric Services (CFS) component of Cisco FXOS Software and Cisco NX-OS Software could allow an unauthenticated, remote attacker to… |
CVE-2018-0312 | Critical | 9.8 | 2018-06-20 | A vulnerability in the Cisco Fabric Services component of Cisco FXOS Software and Cisco NX-OS Software could allow an unauthenticated, remote attacker to execu… |
CVE-2018-0308 | Critical | 9.8 | 2018-06-20 | A vulnerability in the Cisco Fabric Services component of Cisco FXOS Software and Cisco NX-OS Software could allow an unauthenticated, remote attacker to execu… |
CVE-2018-0307 | High | 7.8 | 2018-06-20 | A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, local attacker to perform a command-injection attack on an affected device. Th… |
CVE-2018-0304 | Critical | 9.8 | 2018-06-20 | A vulnerability in the Cisco Fabric Services component of Cisco FXOS Software and Cisco NX-OS Software could allow an unauthenticated, remote attacker to read… |
CVE-2018-0301 | Critical | 9.8 | 2018-06-20 | A vulnerability in the NX-API feature of Cisco NX-OS Software could allow an unauthenticated, remote attacker to craft a packet to the management interface on… |
CVE-2018-0295 | High | 7.5 | 2018-06-20 | A vulnerability in the Border Gateway Protocol (BGP) implementation of Cisco NX-OS Software could allow an unauthenticated, remote attacker to cause a denial o… |
CVE-2018-0294 | Medium | 6.7 | 2018-06-20 | A vulnerability in the write-erase feature of Cisco FXOS Software and Cisco NX-OS Software could allow an authenticated, local attacker to configure an unautho… |
CVE-2018-0293 | High | 8.8 | 2018-06-20 | A vulnerability in role-based access control (RBAC) for Cisco NX-OS Software could allow an authenticated, remote attacker to execute CLI commands that should… |
CVE-2018-0292 | High | 8.8 | 2018-06-20 | A vulnerability in the Internet Group Management Protocol (IGMP) Snooping feature of Cisco NX-OS Software could allow an unauthenticated, adjacent attacker to… |
CVE-2018-0291 | Medium | 6.5 | 2018-06-20 | A vulnerability in the Simple Network Management Protocol (SNMP) input packet processor of Cisco NX-OS Software could allow an authenticated, remote attacker t… |
CVE-2018-12604 | High | 7.5 | 2018-06-20 | GreenCMS 2.3.0603 allows remote attackers to obtain sensitive information via a direct request for Data/Log/year_month_day.log. |
CVE-2018-5428 | High | 8.8 | 2018-06-20 | The version control adapters component of TIBCO Data Virtualization (formerly known as Cisco Information Server) contains vulnerabilities that may allow for ar… |
CVE-2018-12601 | Critical | 9.8 | 2018-06-20 | There is a heap-based buffer overflow in ReadImage in input-tga.ci in sam2p 0.49.4 that leads to a denial of service or possibly unspecified other impact. |
CVE-2018-12600 | High | 8.8 | 2018-06-20 | In ImageMagick 7.0.8-3 Q16, ReadDIBImage and WriteDIBImage in coders/dib.c allow attackers to cause an out of bounds write via a crafted file. |
CVE-2018-12599 | High | 8.8 | 2018-06-20 | In ImageMagick 7.0.8-3 Q16, ReadBMPImage and WriteBMPImage in coders/bmp.c allow attackers to cause an out of bounds write via a crafted file. |
CVE-2018-10841 | High | 8.8 | 2018-06-20 | glusterfs is vulnerable to privilege escalation on gluster server nodes. An authenticated gluster client via TLS could use gluster cli with --remote-host comma… |
CVE-2018-6213 | Critical | 9.8 | 2018-06-20 | In the web server on D-Link DIR-620 devices with a certain customized (by ISP) variant of firmware 1.0.3, 1.0.37, 1.3.1, 1.3.3, 1.3.7, 1.4.0, and 2.0.22, there… |
CVE-2018-6212 | Medium | 6.1 | 2018-06-20 | On D-Link DIR-620 devices with a certain customized (by ISP) variant of firmware 1.0.3, 1.0.37, 1.3.1, 1.3.3, 1.3.7, 1.4.0, and 2.0.22, a reflected Cross-Site… |