2018 CVEs (page 120)

Page 120 of 162 — CVEs published in 2018, newest first, with CVSS severity and publication dates.

All CVEs published in 2018 — newest first (page 120 of 162)
CVESeverityScorePublishedSummary
CVE-2018-7510Critical9.82018-06-06In the web application in BeaconMedaes TotalAlert Scroll Medical Air Systems running software versions prior to 4107600010.23, passwords are presented in plain…
CVE-2018-1269Medium6.52018-06-06Cloud Foundry Loggregator, versions 89.x prior to 89.5 or 96.x prior to 96.1 or 99.x prior to 99.1 or 101.x prior to 101.9 or 102.x prior to 102.2, does not ha…
CVE-2018-1268Medium6.82018-06-06Cloud Foundry Loggregator, versions 89.x prior to 89.5 or 96.x prior to 96.1 or 99.x prior to 99.1 or 101.x prior to 101.9 or 102.x prior to 102.2, does not va…
CVE-2018-1265High7.22018-06-06Cloud Foundry Diego, release versions prior to 2.8.0, does not properly sanitize file paths in tar and zip files headers. A remote attacker with CF admin privi…
CVE-2018-10198Medium4.32018-06-06An issue was discovered in OTRS 6.0.x before 6.0.7. An attacker who is logged into OTRS as a customer can use the ticket overview screen to disclose internal a…
CVE-2018-1000203High7.52018-06-06Soar Labs Soar Coin version up to and including git commit 4a2aa71ee21014e2880a3f7aad11091ed6ad434f (latest release as of Sept 2017) contains an intentional ba…
CVE-2018-1456High7.12018-06-06IBM Rhapsody DM 5.0 through 5.0.2 and 6.0 through 6.0.5 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attack…
CVE-2018-11813High7.52018-06-06libjpeg 9c has a large loop because read_pixel in rdtarga.c mishandles EOF.
CVE-2018-11808Critical9.12018-06-06Incorrect Access Control in CustomFieldsFeedServlet in Zoho ManageEngine Applications Manager Version 13 before build 13740 allows an attacker to delete any fi…
CVE-2018-11553Medium6.12018-06-06SGIN.CN xiangyun platform V9.4.10 has XSS via the login_url parameter to /login.php.
CVE-2018-7884High7.82018-06-05An issue was discovered in DisplayLink Core Software Cleaner Application 8.2.1956. When the drivers are updated to a newer version, the product launches a proc…
CVE-2018-3691Medium4.72018-06-05Some implementations in Intel Integrated Performance Primitives Cryptography Library before version 2018 U3.1 do not properly ensure constant execution time.
CVE-2018-11586Critical9.82018-06-05XML external entity (XXE) vulnerability in api/rest/status in SearchBlox 8.6.7 allows remote unauthenticated users to read arbitrary files or conduct server-si…
CVE-2018-10058High8.82018-06-05The remote management interface of cgminer 4.10.0 and bfgminer 5.5.0 allows an authenticated remote attacker to execute arbitrary code due to a stack-based buf…
CVE-2018-10057Medium6.52018-06-05The remote management interface of cgminer 4.10.0 and bfgminer 5.5.0 allows an authenticated remote attacker to write the miner configuration file to arbitrary…
CVE-2018-1000202Medium5.42018-06-05A persisted cross-site scripting vulnerability exists in Jenkins Groovy Postbuild Plugin 2.3.1 and older in various Jelly files that allows attackers able to c…
CVE-2018-1000198Medium6.52018-06-05A XML external entity processing vulnerability exists in Jenkins Black Duck Hub Plugin 3.1.0 and older in PostBuildScanDescriptor.java that allows attackers wi…
CVE-2018-1000197High8.12018-06-05An improper authorization vulnerability exists in Jenkins Black Duck Hub Plugin 3.0.3 and older in PostBuildScanDescriptor.java that allows users with Overall/…
CVE-2018-1000196Medium6.52018-06-05A exposure of sensitive information vulnerability exists in Jenkins Gitlab Hook Plugin 1.4.2 and older in gitlab_notifier.rb, views/gitlab_notifier/global.erb…
CVE-2018-1000195Medium4.32018-06-05A server-side request forgery vulnerability exists in Jenkins 2.120 and older, LTS 2.107.2 and older in ZipExtractionInstaller.java that allows users with Over…
CVE-2018-1000194High8.12018-06-05A path traversal vulnerability exists in Jenkins 2.120 and older, LTS 2.107.2 and older in FilePath.java, SoloFilePathFilter.java that allows malicious agents…
CVE-2018-1000193Medium4.32018-06-05A improper neutralization of control sequences vulnerability exists in Jenkins 2.120 and older, LTS 2.107.2 and older in HudsonPrivateSecurityRealm.java that a…
CVE-2018-1000192Medium4.32018-06-05A information exposure vulnerability exists in Jenkins 2.120 and older, LTS 2.107.2 and older in AboutJenkins.java, ListPluginsCommand.java that allows users w…
CVE-2018-10601High8.22018-06-05IntelliVue Patient Monitors MP Series (including MP2/X2/MP30/MP50/MP70/NP90/MX700/800) Rev B-M, IntelliVue Patient Monitors MX (MX400-550) Rev J-M and (X3/MX10…
CVE-2018-10599Medium5.32018-06-05IntelliVue Patient Monitors MP Series (including MP2/X2/MP30/MP50/MP70/NP90/MX700/800) Rev B-M, IntelliVue Patient Monitors MX (MX400-550) Rev J-M and (X3/MX10…
CVE-2018-10597High8.32018-06-05IntelliVue Patient Monitors MP Series (including MP2/X2/MP30/MP50/MP70/NP90/MX700/800) Rev B-M, IntelliVue Patient Monitors MX (MX400-550) Rev J-M and (X3/MX10…
CVE-2018-1000191Medium6.52018-06-05A exposure of sensitive information vulnerability exists in Jenkins Black Duck Detect Plugin 1.4.0 and older in DetectPostBuildStepDescriptor.java that allows…
CVE-2018-1000190Medium6.52018-06-05A exposure of sensitive information vulnerability exists in Jenkins Black Duck Hub Plugin 4.0.0 and older in PostBuildScanDescriptor.java that allows attackers…
CVE-2018-1000189High8.82018-06-05A command execution vulnerability exists in Jenkins Absint Astree Plugin 1.0.5 and older in AstreeBuilder.java that allows attackers with Overall/Read access t…
CVE-2018-1000188Medium5.42018-06-05A server-side request forgery vulnerability exists in Jenkins CAS Plugin 1.4.1 and older in CasSecurityRealm.java that allows attackers with Overall/Read acces…
CVE-2018-1000187Medium6.52018-06-05A exposure of sensitive information vulnerability exists in Jenkins Kubernetes Plugin 1.7.0 and older in ContainerExecDecorator.java that results in sensitive…
CVE-2018-1000186Medium6.52018-06-05A exposure of sensitive information vulnerability exists in Jenkins GitHub Pull Request Builder Plugin 1.41.0 and older in GhprbGitHubAuth.java that allows att…
CVE-2018-1000185Medium4.32018-06-05A server-side request forgery vulnerability exists in Jenkins GitHub Branch Source Plugin 2.3.4 and older in Endpoint.java that allows attackers with Overall/R…
CVE-2018-1000184Medium5.42018-06-05A server-side request forgery vulnerability exists in Jenkins GitHub Plugin 1.29.0 and older in GitHubPluginConfig.java that allows attackers with Overall/Read…
CVE-2018-1000183Medium6.52018-06-05A exposure of sensitive information vulnerability exists in Jenkins GitHub Plugin 1.29.0 and older in GitHubServerConfig.java that allows attackers with Overal…
CVE-2018-1000182Medium6.42018-06-05A server-side request forgery vulnerability exists in Jenkins Git Plugin 3.9.0 and older in AssemblaWeb.java, GitBlitRepositoryBrowser.java, Gitiles.java, TFS2…
CVE-2018-8008Medium5.52018-06-05Apache Storm version 1.0.6 and earlier, 1.2.1 and earlier, and version 1.1.2 and earlier expose an arbitrary file write vulnerability, that can be achieved usi…
CVE-2018-1332Medium6.52018-06-05Apache Storm version 1.0.6 and earlier, 1.2.1 and earlier, and version 1.1.2 and earlier expose a vulnerability that could allow a user to impersonate another…
CVE-2018-7943High8.82018-06-05There is an authentication bypass vulnerability in some Huawei servers. A remote attacker with low privilege may bypass the authentication by some special oper…
CVE-2018-1454Medium5.92018-06-05IBM InfoSphere Information Server 11.3, 11.5, and 11.7 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable…
CVE-2018-1432Medium6.12018-06-05IBM InfoSphere Information Server 9.1, 11.3, 11.5, and 11.7 is vulnerable to cross-frame scripting which is a vulnerability that allows an attacker to load Inf…
CVE-2018-10966High7.32018-06-05An issue was discovered in GamerPolls 0.4.6, related to config/environments/all.js and config/initializers/02_passport.js. An attacker can edit the Passport.js…
CVE-2018-10813High7.32018-06-05In Dedos-web 1.0, the cookie and session secrets used in the Express.js application have hardcoded values that are visible in the source code published on GitH…
CVE-2018-8924Medium6.52018-06-05Cross-site scripting (XSS) vulnerability in Title Tootip in Synology Office before 3.0.3-2143 allows remote authenticated users to inject arbitrary web script…
CVE-2018-8923Medium6.52018-06-05Cross-site scripting (XSS) vulnerability in Attachment Preview in Synology File Station before 1.1.4-0122 allows remote authenticated users to inject arbitrary…
CVE-2018-6662High7.82018-06-05Privilege Escalation vulnerability in McAfee Management of Native Encryption (MNE) before 4.1.4 allows local users to gain elevated privileges via a crafted us…
CVE-2018-11743Critical9.82018-06-05The init_copy function in kernel.c in mruby 1.4.1 makes initialize_copy calls for TT_ICLASS objects, which allows attackers to cause a denial of service (mrb_h…
CVE-2018-1000200Medium5.52018-06-05The Linux Kernel versions 4.14, 4.15, and 4.16 has a null pointer dereference which can result in an out of memory (OOM) killing of large mlocked processes. Th…
CVE-2018-1000181High7.52018-06-05Kitura 2.3.0 and earlier have an unintended read access to unauthorised files and folders that can be exploited by a crafted URL resulting in information discl…
CVE-2018-1000180High7.52018-06-05Bouncy Castle BC 1.54 - 1.59, BC-FJA 1.0.0, BC-FJA 1.0.1 and earlier have a flaw in the Low-level interface to RSA key pair generator, specifically RSA Key Pai…
CVE-2018-1252High8.82018-06-05RSA Web Threat Detection versions prior to 6.4, contain an SQL injection vulnerability in the Administration and Forensics applications. An authenticated malic…
CVE-2018-11722Critical9.82018-06-05WUZHI CMS 4.1.0 has a SQL Injection in api/uc.php via the 'code' parameter, because 'UC_KEY' is hard coded.
CVE-2018-11740High8.12018-06-05An issue was discovered in libtskbase.a in The Sleuth Kit (TSK) from release 4.0.2 through to 4.6.1. An out-of-bounds read of a memory region was found in the…
CVE-2018-11739High8.12018-06-05An issue was discovered in libtskimg.a in The Sleuth Kit (TSK) from release 4.0.2 through to 4.6.1. An out-of-bounds read of a memory region was found in the f…
CVE-2018-11738High8.12018-06-05An issue was discovered in libtskfs.a in The Sleuth Kit (TSK) from release 4.0.2 through to 4.6.1. An out-of-bounds read of a memory region was found in the fu…
CVE-2018-11737High8.12018-06-05An issue was discovered in libtskfs.a in The Sleuth Kit (TSK) from release 4.0.2 through to 4.6.1. An out-of-bounds read of a memory region was found in the fu…
CVE-2018-11678Critical9.82018-06-05plugins/box/users/users.plugin.php in Monstra CMS 3.0.4 allows Login Rate Limiting Bypass via manipulation of the login_attempts cookie.
CVE-2018-11554Critical9.82018-06-05The forgotten-password feature in index.php/member/reset/reset_email.html in YzmCMS v3.2 through v3.7 has a Response Discrepancy Information Exposure issue and…
CVE-2018-11736Critical9.82018-06-05An issue was discovered in Pluck before 4.7.7-dev2. /data/inc/images.php allows remote attackers to upload and execute arbitrary PHP code by using the image/jp…
CVE-2018-11735Medium6.12018-06-05index.php?action=createaccount in Ximdex 4.0 has XSS via the sname or fname parameter.
CVE-2018-3853High8.82018-06-04An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Software Foxit PDF Reader version 9.0.1.1049. A specially crafted PDF docu…
CVE-2018-1600High8.62018-06-04IBM BigFix Platform 9.2 and 9.5 transmits sensitive or security-critical data in clear text in a communication channel that can be sniffed by unauthorized acto…
CVE-2018-11715Medium5.42018-06-04The Recent Threads plugin before 1.1 for MyBB allows XSS via a thread subject.
CVE-2018-11714Critical9.82018-06-04An issue was discovered on TP-Link TL-WR840N v5 00000005 0.9.1 3.16 v0001.0 Build 170608 Rel.58696n and TL-WR841N v13 00000013 0.9.1 4.16 v0001.0 Build 170622…
CVE-2018-11713Medium6.52018-06-04WebCore/platform/network/soup/SocketStreamHandleImplSoup.cpp in the libsoup network backend of WebKit, as used in WebKitGTK+ prior to version 2.20.0 or without…
CVE-2018-11712High7.52018-06-04WebCore/platform/network/soup/SocketStreamHandleImplSoup.cpp in the libsoup network backend of WebKit, as used in WebKitGTK+ versions 2.20.0 and 2.20.1, failed…
CVE-2018-10615High8.12018-06-04Directory traversal may lead to files being exfiltrated or deleted on the GE MDS PulseNET and MDS PulseNET Enterprise version 3.2.1 and prior host platform.
CVE-2018-10613High7.52018-06-04Multiple variants of XML External Entity (XXE) attacks may be used to exfiltrate data from the host Windows platform in GE MDS PulseNET and MDS PulseNET Enterp…
CVE-2018-10611Critical9.82018-06-04Java remote method invocation (RMI) input port in GE MDS PulseNET and MDS PulseNET Enterprise version 3.2.1 and prior may be exploited to allow unauthenticated…
CVE-2018-11711Critical9.82018-06-04A remote attacker can bypass the System Manager Mode on the Canon MF210 and MF220 web interface without knowing the PIN for /login.html via vectors involving /…
CVE-2018-11710High8.82018-06-04soundlib/pattern.h in libopenmpt before 0.3.9 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impac…
CVE-2018-11709Medium6.12018-06-04wpforo_get_request_uri in wpf-includes/functions.php in the wpForo Forum plugin before 1.4.12 for WordPress allows Unauthenticated Reflected Cross-Site Scripti…
CVE-2018-11698High8.12018-06-04An issue was discovered in LibSass through 3.5.4. An out-of-bounds read of a memory region was found in the function Sass::handle_error which could be leverage…
CVE-2018-11697High8.12018-06-04An issue was discovered in LibSass through 3.5.4. An out-of-bounds read of a memory region was found in the function Sass::Prelexer::exactly() which could be l…
CVE-2018-11696High8.82018-06-04An issue was discovered in LibSass through 3.5.4. A NULL pointer dereference was found in the function Sass::Inspect::operator which could be leveraged by an a…
CVE-2018-11695High8.82018-06-04An issue was discovered in LibSass <3.5.3. A NULL pointer dereference was found in the function Sass::Expand::operator which could be leveraged by an attacker…
CVE-2018-11694High8.82018-06-04An issue was discovered in LibSass through 3.5.4. A NULL pointer dereference was found in the function Sass::Functions::selector_append which could be leverage…
CVE-2018-11693High8.12018-06-04An issue was discovered in LibSass through 3.5.4. An out-of-bounds read of a memory region was found in the function Sass::Prelexer::skip_over_scopes which cou…
CVE-2018-11692Critical9.82018-06-04An issue was discovered on Canon LBP6650, LBP3370, LBP3460, and LBP7750C devices. It is possible to bypass the Administrator Mode authentication for /tlogin.cg…
CVE-2018-11685High8.82018-06-04Liblouis 3.5.0 has a stack-based Buffer Overflow in the function compileHyphenation in compileTranslationTable.c.
CVE-2018-11684High8.82018-06-04Liblouis 3.5.0 has a stack-based Buffer Overflow in the function includeFile in compileTranslationTable.c.
CVE-2018-11683High8.82018-06-04Liblouis 3.5.0 has a stack-based Buffer Overflow in the function parseChars in compileTranslationTable.c, a different vulnerability than CVE-2018-11440.
CVE-2018-11682Critical9.82018-06-02Default and unremovable support credentials allow attackers to gain total super user control of an IoT device through a TELNET session to products using the St…
CVE-2018-11681Critical9.82018-06-02Default and unremovable support credentials (user:nwk password:nwk2) allow attackers to gain total super user control of an IoT device through a TELNET session…
CVE-2018-11629Critical9.82018-06-02Default and unremovable support credentials (user:lutron password:integration) allow attackers to gain total super user control of an IoT device through a TELN…
CVE-2018-11680Medium6.52018-06-02An issue was discovered in CmsEasy 6.1_20180508. There is a CSRF vulnerability in the rich text editor that can add an IFRAME element. This might be used in a…
CVE-2018-11679High8.82018-06-02An issue was discovered in CmsEasy 6.1_20180508. There is a CSRF vulnerability that can add an article via /index.php?case=table&act=add&table=archive&admin_di…
CVE-2018-11564Medium4.82018-06-02Stored XSS in YOOtheme Pagekit 1.0.13 and earlier allows a user to upload malicious code via the picture upload feature. A user with elevated privileges could…
CVE-2018-11522Medium6.12018-06-02Yosoro 1.0.4 has stored XSS.
CVE-2018-11194High8.82018-06-02Quest DR Series Disk Backup software version before 4.0.3.1 allows privilege escalation (issue 6 of 6).
CVE-2018-11193High8.82018-06-02Quest DR Series Disk Backup software version before 4.0.3.1 allows privilege escalation (issue 5 of 6).
CVE-2018-11192High8.82018-06-02Quest DR Series Disk Backup software version before 4.0.3.1 allows privilege escalation (issue 4 of 6).
CVE-2018-11191High8.82018-06-02Quest DR Series Disk Backup software version before 4.0.3.1 allows privilege escalation (issue 3 of 6).
CVE-2018-11190High8.82018-06-02Quest DR Series Disk Backup software version before 4.0.3.1 allows privilege escalation (issue 2 of 6).
CVE-2018-11189High8.82018-06-02Quest DR Series Disk Backup software version before 4.0.3.1 allows privilege escalation (issue 1 of 6).
CVE-2018-11188High8.82018-06-02Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 46 of 46).
CVE-2018-11187High8.82018-06-02Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 45 of 46).
CVE-2018-11186High8.82018-06-02Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 44 of 46).
CVE-2018-11185High8.82018-06-02Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 43 of 46).
CVE-2018-11184High7.22018-06-02Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 42 of 46).