2018 CVEs (page 121)

Page 121 of 162 — CVEs published in 2018, newest first, with CVSS severity and publication dates.

All CVEs published in 2018 — newest first (page 121 of 162)
CVESeverityScorePublishedSummary
CVE-2018-11183High8.82018-06-02Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 41 of 46).
CVE-2018-11182High8.82018-06-02Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 40 of 46).
CVE-2018-11181High8.82018-06-02Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 39 of 46).
CVE-2018-11180High8.82018-06-02Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 38 of 46).
CVE-2018-11179High8.82018-06-02Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 37 of 46).
CVE-2018-11178High8.82018-06-02Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 36 of 46).
CVE-2018-11177High8.82018-06-02Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 35 of 46).
CVE-2018-11176High8.82018-06-02Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 34 of 46).
CVE-2018-11175High8.82018-06-02Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 33 of 46).
CVE-2018-11174High8.82018-06-02Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 32 of 46).
CVE-2018-11173High8.82018-06-02Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 31 of 46).
CVE-2018-11172High8.82018-06-02Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 30 of 46).
CVE-2018-11171High8.82018-06-02Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 29 of 46).
CVE-2018-11170High8.82018-06-02Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 28 of 46).
CVE-2018-11169High8.82018-06-02Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 27 of 46).
CVE-2018-11168High8.82018-06-02Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 26 of 46).
CVE-2018-11167High8.82018-06-02Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 25 of 46).
CVE-2018-11166High8.82018-06-02Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 24 of 46).
CVE-2018-11165High8.82018-06-02Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 23 of 46).
CVE-2018-11164High8.82018-06-02Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 22 of 46).
CVE-2018-11163High7.22018-06-02Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 21 of 46).
CVE-2018-11162High8.82018-06-02Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 20 of 46).
CVE-2018-11161High8.82018-06-02Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 19 of 46).
CVE-2018-11160High8.82018-06-02Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 18 of 46).
CVE-2018-11159High8.82018-06-02Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 17 of 46).
CVE-2018-11158High8.82018-06-02Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 16 of 46).
CVE-2018-11157High8.82018-06-02Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 15 of 46).
CVE-2018-11156High8.82018-06-02Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 14 of 46).
CVE-2018-11155High8.82018-06-02Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 13 of 46).
CVE-2018-11154High8.82018-06-02Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 12 of 46).
CVE-2018-11153High8.82018-06-02Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 11 of 46).
CVE-2018-11152High8.82018-06-02Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 10 of 46).
CVE-2018-11151High7.22018-06-02Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 9 of 46).
CVE-2018-11150High8.82018-06-02Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 8 of 46).
CVE-2018-11149High8.82018-06-02Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 7 of 46).
CVE-2018-11148High8.82018-06-02Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 6 of 46).
CVE-2018-11147High8.82018-06-02Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 5 of 46).
CVE-2018-11146High8.82018-06-02Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 4 of 46).
CVE-2018-11145High8.82018-06-02Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 3 of 46).
CVE-2018-11144High8.82018-06-02Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 2 of 46).
CVE-2018-11143Critical9.82018-06-02Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 1 of 46).
CVE-2018-1002100Medium4.22018-06-02In Kubernetes versions 1.5.x, 1.6.x, 1.7.x, 1.8.x, and prior to version 1.9.6, the kubectl cp command insecurely handles tar data returned from the container…
CVE-2018-3809Medium5.32018-06-01Information exposure through directory listings in serve 6.5.3 allows directory listing and file access even when they have been set to be ignored.
CVE-2018-3757Critical9.82018-06-01Command injection exists in pdf-image v2.0.0 due to an unescaped string parameter.
CVE-2018-3756High7.52018-06-01Hyperledger Iroha versions v1.0_beta and v1.0.0_beta-1 are vulnerable to transaction and block signature verification bypass in the transaction and block valid…
CVE-2018-11538High8.82018-06-01servlet/UserServlet in SearchBlox 8.6.6 has CSRF via the u_name, u_passwd1, u_passwd2, role, and X-XSRF-TOKEN POST parameters because of CSRF Token Bypass.
CVE-2018-11196High7.52018-06-01Mahara 17.04 before 17.04.8 and 17.10 before 17.10.5 and 18.04 before 18.04.1 can be used as medium to transmit viruses by placing infected files into a Leap2A…
CVE-2018-11195Medium6.82018-06-01Mahara 17.04 before 17.04.8 and 17.10 before 17.10.5 and 18.04 before 18.04.1 are vulnerable to the browser "back and refresh" attack. This allows malicious us…
CVE-2018-3755Medium6.12018-06-01XSS in sexstatic <=0.6.2 causes HTML injection in directory name(s) leads to Stored XSS when malicious file is embed with <iframe> element used in directory na…
CVE-2018-3746Critical9.82018-06-01The pdfinfojs NPM module versions <= 0.3.6 has a command injection vulnerability that allows an attacker to execute arbitrary commands on the victim's machine.
CVE-2018-3743Medium6.12018-06-01Open redirect in hekto <=0.2.3 when target domain name is used as html filename on server.
CVE-2018-11671High8.82018-06-01An issue was discovered in GreenCMS v2.3.0603. There is a CSRF vulnerability that can add an admin account via index.php?m=admin&c=access&a=adduserhandle.
CVE-2018-11670High8.82018-06-01An issue was discovered in GreenCMS v2.3.0603. There is a CSRF vulnerability that allows attackers to execute arbitrary PHP code via the content parameter to i…
CVE-2018-11581Medium4.82018-06-01Cross-site scripting (XSS) vulnerability on Brother HL series printers allows remote attackers to inject arbitrary web script or HTML via the url parameter to…
CVE-2018-11552Medium6.12018-06-01There is a reflected XSS vulnerability in AXON PBX 2.02 via the "AXON->Auto-Dialer->Agents->Name" field. The vulnerability exists due to insufficient filtratio…
CVE-2018-11551High7.82018-06-01AXON PBX 2.02 contains a DLL hijacking vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary code on a targeted system. The v…
CVE-2018-10382Medium5.42018-06-01MODX Revolution 2.6.3 has XSS.
CVE-2018-11657High7.52018-06-01ngiflib.c in MiniUPnP ngiflib 0.4 has an infinite loop in DecodeGifImg and LoadGif.
CVE-2018-11656Medium6.52018-06-01In ImageMagick 7.0.7-20 Q16 x86_64, a memory leak vulnerability was found in the function ReadDCMImage in coders/dcm.c, which allows attackers to cause a denia…
CVE-2018-11655Medium6.52018-06-01In ImageMagick 7.0.7-20 Q16 x86_64, a memory leak vulnerability was found in the function GetImagePixelCache in MagickCore/cache.c, which allows attackers to c…
CVE-2018-11652Critical9.82018-06-01CSV Injection vulnerability in Nikto 2.1.6 and earlier allows remote attackers to inject arbitrary OS commands via the Server field in an HTTP response header…
CVE-2018-11628Medium6.12018-06-01Data input into EMS Master Calendar before 8.0.0.201805210 via URL parameters is not properly sanitized, allowing malicious attackers to send a crafted URL for…
CVE-2018-11486Medium6.12018-06-01An issue was discovered in the MULTIDOTS Advance Search for WooCommerce plugin 1.0.9 and earlier for WordPress. This plugin is vulnerable to a stored Cross-sit…
CVE-2018-11485Medium6.12018-06-01The MULTIDOTS WooCommerce Quick Reports plugin 1.0.6 and earlier for WordPress is vulnerable to Stored XSS. It allows an attacker to inject malicious JavaScrip…
CVE-2018-7976Medium5.42018-06-01There is a stored cross-site scripting (XSS) vulnerability in Huawei eSpace Desktop V300R001C00 and V300R001C50 version. Due to the insufficient validation of…
CVE-2018-7951High8.82018-06-01The iBMC (Intelligent Baseboard Management Controller) of some Huawei servers have a JSON injection vulnerability due to insufficient input validation. An auth…
CVE-2018-7950High8.82018-06-01The iBMC (Intelligent Baseboard Management Controller) of some Huawei servers have a JSON injection vulnerability due to insufficient input validation. An auth…
CVE-2018-7949High8.82018-06-01The iBMC (Intelligent Baseboard Management Controller) of some Huawei servers have a privilege escalation vulnerability. A remote attacker may send some specia…
CVE-2018-5526Medium6.52018-06-01Under certain conditions, on F5 BIG-IP ASM 13.1.0-13.1.0.5, Behavioral DOS (BADOS) protection may fail during an attack.
CVE-2018-5525Medium4.32018-06-01A local file vulnerability exists in the F5 BIG-IP Configuration utility on versions 13.0.0, 12.1.0-12.1.2, 11.6.1-11.6.3.1, 11.5.1-11.5.5, or 11.2.1 that expo…
CVE-2018-5524Medium5.32018-06-01Under certain conditions, on F5 BIG-IP 13.0.0-13.1.0.5, 12.1.0-12.1.3.1, or 11.6.1 HF2-11.6.3.1, virtual servers configured with Client SSL or Server SSL profi…
CVE-2018-5523High7.22018-06-01On F5 BIG-IP 13.1.0-13.1.0.3, 13.0.0, 12.1.0-12.1.3.1, 11.6.1-11.6.3.1, 11.5.1-11.5.5, or 11.2.1 and Enterprise Manager 3.1.1, when authenticated administrativ…
CVE-2018-5522Medium5.92018-06-01On F5 BIG-IP 13.0.0, 12.0.0-12.1.2, 11.6.1-11.6.3.1, 11.5.1-11.5.5, or 11.2.1, when processing DIAMETER transactions with carefully crafted attribute-value pai…
CVE-2018-5521Medium6.12018-06-01On F5 BIG-IP 12.1.0-12.1.3.1, 11.6.1-11.6.3.1, 11.5.1-11.5.5, or 11.2.1, carefully crafted URLs can be used to reflect arbitrary content into GeoIP lookup resp…
CVE-2018-5513High7.52018-06-01On F5 BIG-IP 13.1.0-13.1.0.3, 13.0.0, 12.1.0-12.1.3.3, 11.6.1-11.6.3.1, 11.5.1-11.5.5, or 11.2.1, a malformed TLS handshake causes TMM to crash leading to a di…
CVE-2018-11651Medium6.12018-06-01Graylog before v2.4.4 has an XSS security issue with unescaped text in dashboard names, related to components/dashboard/Dashboard.jsx, components/dashboard/Edi…
CVE-2018-11650Medium6.12018-06-01Graylog before v2.4.4 has an XSS security issue with unescaped text in notifications, related to toastr and util/UserNotification.js.
CVE-2018-11649Medium6.12018-06-01Hue 3.12 has XSS via the /pig/save/ name and script parameters.
CVE-2018-8922Medium6.52018-06-01Improper access control vulnerability in Synology Drive before 1.0.2-10275 allows remote authenticated users to access non-shared files or folders via unspecif…
CVE-2018-8921Medium6.52018-06-01Cross-site scripting (XSS) vulnerability in File Sharing Notify Toast in Synology Drive before 1.0.2-10275 allows remote authenticated users to inject arbitrar…
CVE-2018-11646High7.52018-06-01webkitFaviconDatabaseSetIconForPageURL and webkitFaviconDatabaseSetIconURLForPageURL in UIProcess/API/glib/WebKitFaviconDatabase.cpp in WebKit, as used in WebK…
CVE-2018-11645Medium5.32018-06-01psi/zfile.c in Artifex Ghostscript before 9.21rc1 permits the status command even if -dSAFER is used, which might allow remote attackers to determine the exist…
CVE-2018-9186Medium6.12018-05-31A cross-site scripting (XSS) vulnerability in Fortinet FortiAuthenticator in versions 4.0.0 to before 5.3.0 "CSRF validation failure" page allows attacker to e…
CVE-2018-6552High7.82018-05-31Apport does not properly handle crashes originating from a PID namespace allowing local users to create certain files as root which an attacker could leverage…
CVE-2018-1532Medium4.32018-05-31IBM API Connect 5.0.0.0 through 5.0.8.2 does not properly update the SESSIONID with each request, which could allow a user to obtain the ID in further attacks…
CVE-2018-1496Medium5.42018-05-31IBM Content Navigator 2.0.3, 3.0.0, 3.0.1, 3.0.2, and 3.0.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScrip…
CVE-2018-10379Medium6.12018-05-31An issue was discovered in GitLab Community Edition (CE) and Enterprise Edition (EE) before 10.5.8, 10.6.x before 10.6.5, and 10.7.x before 10.7.2. The Move Is…
CVE-2018-11633Medium6.52018-05-31An issue was discovered in the MULTIDOTS Woo Checkout for Digital Goods plugin 2.1 for WordPress. If an admin user can be tricked into visiting a crafted URL c…
CVE-2018-11632Medium6.52018-05-31An issue was discovered in the MULTIDOTS Add Social Share Messenger Buttons Whatsapp and Viber plugin 1.0.8 for WordPress. If an admin user can be tricked into…
CVE-2018-11631Medium4.32018-05-31Rondaful M1 Wristband Smart Band 1 devices allow remote attackers to send an arbitrary number of call or SMS notifications via crafted Bluetooth Low Energy (BL…
CVE-2018-11627Medium6.12018-05-31Sinatra before 2.0.2 has XSS via the 400 Bad Request page that occurs upon a params parser exception.
CVE-2018-11626High7.52018-05-31SELA (aka SimplE Lossless Audio) v0.1.2-alpha has a stack-based buffer overflow in the core/apev2.c init_apev2_keys function.
CVE-2018-11142Medium5.52018-05-31The 'systemui/settings_network.php' and 'systemui/settings_patching.php' scripts in the Quest KACE System Management Appliance 8.0.318 are accessible only from…
CVE-2018-11141Critical9.82018-05-31The 'IMAGES_JSON' and 'attachments_to_remove[]' parameters of the '/adminui/advisory.php' script in the Quest KACE System Management Virtual Appliance 8.0.318…
CVE-2018-11140Critical9.82018-05-31The 'reportID' parameter received by the '/common/run_report.php' script in the Quest KACE System Management Appliance 8.0.318 is not sanitized, leading to SQL…
CVE-2018-11139High8.82018-05-31The '/common/ajax_email_connection_test.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by any authenticated user and can be ab…
CVE-2018-11138Critical9.82018-05-31The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by anonymous users and can be abused to e…
CVE-2018-11137Medium6.52018-05-31The 'checksum' parameter of the '/common/download_attachment.php' script in the Quest KACE System Management Appliance 8.0.318 can be abused to read arbitrary…
CVE-2018-11136Critical9.82018-05-31The 'orgID' parameter received by the '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is not sanitized, lea…
CVE-2018-11135High8.82018-05-31The script '/adminui/error_details.php' in the Quest KACE System Management Appliance 8.0.318 allows authenticated users to conduct PHP object injection attack…