2018 CVEs (page 127)
Page 127 of 162 — CVEs published in 2018, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2018-0289 | Medium | 6.1 | 2018-05-17 | A vulnerability in the logs component of Cisco Identity Services Engine could allow an unauthenticated, remote attacker to conduct cross-site scripting attacks… |
CVE-2018-0280 | High | 7.5 | 2018-05-17 | A vulnerability in the Real-Time Transport Protocol (RTP) bitstream processing of the Cisco Meeting Server could allow an unauthenticated, remote attacker to c… |
CVE-2018-0279 | High | 8.8 | 2018-05-17 | A vulnerability in the Secure Copy Protocol (SCP) server of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, remote attacker… |
CVE-2018-0277 | High | 8.6 | 2018-05-17 | A vulnerability in the Extensible Authentication Protocol-Transport Layer Security (EAP-TLS) certificate validation during EAP authentication for the Cisco Ide… |
CVE-2018-0271 | Critical | 9.8 | 2018-05-17 | A vulnerability in the API gateway of the Cisco Digital Network Architecture (DNA) Center could allow an unauthenticated, remote attacker to bypass authenticat… |
CVE-2018-0270 | High | 8.8 | 2018-05-17 | A vulnerability in the web-based management interface of Cisco IoT Field Network Director (IoT-FND) could allow an unauthenticated, remote attacker to conduct… |
CVE-2018-0268 | Critical | 10.0 | 2018-05-17 | A vulnerability in the container management subsystem of Cisco Digital Network Architecture (DNA) Center could allow an unauthenticated, remote attacker to byp… |
CVE-2018-0222 | Critical | 10.0 | 2018-05-17 | A vulnerability in Cisco Digital Network Architecture (DNA) Center could allow an unauthenticated, remote attacker to log in to an affected system by using an… |
CVE-2018-1172 | Medium | 5.9 | 2018-05-16 | This vulnerability allows remote attackers to deny service on vulnerable installations of The Squid Software Foundation Squid 3.5.27-20180318. Authentication i… |
CVE-2018-4850 | High | 7.5 | 2018-05-16 | A vulnerability has been identified in SIMATIC S7-400 (incl. F) CPU hardware version 4.0 and below (All versions), SIMATIC S7-400 (incl. F) CPU hardware versio… |
CVE-2018-11214 | Medium | 6.5 | 2018-05-16 | An issue was discovered in libjpeg 9a. The get_text_rgb_row function in rdppm.c allows remote attackers to cause a denial of service (Segmentation fault) via a… |
CVE-2018-11213 | Medium | 6.5 | 2018-05-16 | An issue was discovered in libjpeg 9a. The get_text_gray_row function in rdppm.c allows remote attackers to cause a denial of service (Segmentation fault) via… |
CVE-2018-11212 | Medium | 6.5 | 2018-05-16 | An issue was discovered in libjpeg 9a and 9d. The alloc_sarray function in jmemmgr.c allows remote attackers to cause a denial of service (divide-by-zero error… |
CVE-2018-8014 | Critical | 9.8 | 2018-05-16 | The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.88 are insecure and… |
CVE-2018-11210 | Critical | 9.8 | 2018-05-16 | TinyXML2 6.2.0 has a heap-based buffer over-read in the XMLDocument::Parse function in libtinyxml2.so. NOTE: The tinyxml2 developers have determined that the r… |
CVE-2018-11209 | High | 7.2 | 2018-05-16 | An issue was discovered in Z-BlogPHP 2.0.0. zb_system/cmd.php?act=verify relies on MD5 for the password parameter, which might make it easier for attackers to… |
CVE-2018-11208 | Medium | 4.8 | 2018-05-16 | An issue was discovered in Z-BlogPHP 2.0.0. There is a persistent XSS that allows remote attackers to inject arbitrary web script or HTML into background web s… |
CVE-2018-11207 | Medium | 6.5 | 2018-05-16 | A division by zero was discovered in H5D__chunk_init in H5Dchunk.c in the HDF HDF5 1.10.2 library. It could allow a remote denial of service attack. |
CVE-2018-11206 | High | 8.1 | 2018-05-16 | An out of bounds read was discovered in H5O_fill_new_decode and H5O_fill_old_decode in H5Ofill.c in the HDF HDF5 1.10.2 library. It could allow a remote denial… |
CVE-2018-11205 | High | 8.1 | 2018-05-16 | A out of bounds read was discovered in H5VM_memcpyvv in H5VM.c in the HDF HDF5 1.10.2 library. It could allow a remote denial of service or information disclos… |
CVE-2018-11204 | Medium | 6.5 | 2018-05-16 | A NULL pointer dereference was discovered in H5O__chunk_deserialize in H5Ocache.c in the HDF HDF5 1.10.2 library. It could allow a remote denial of service att… |
CVE-2018-11203 | Medium | 6.5 | 2018-05-16 | A division by zero was discovered in H5D__btree_decode_key in H5Dbtree.c in the HDF HDF5 1.10.2 library. It could allow a remote denial of service attack. |
CVE-2018-11202 | Medium | 6.5 | 2018-05-16 | A NULL pointer dereference was discovered in H5S_hyper_make_spans in H5Shyper.c in the HDF HDF5 1.10.2 library. It could allow a remote denial of service attac… |
CVE-2018-10760 | High | 8.8 | 2018-05-16 | Unrestricted file upload vulnerability in the Files plugin in ProjectPier 0.88 and earlier allows remote authenticated users to execute arbitrary PHP code by u… |
CVE-2018-10759 | Critical | 9.8 | 2018-05-16 | PHP remote file inclusion vulnerability in public/patch/patch.php in Project Pier 0.8.8 and earlier allows remote attackers to execute arbitrary commands or SQ… |
CVE-2018-10241 | Medium | 6.5 | 2018-05-16 | A denial of service vulnerability in SolarWinds Serv-U before 15.1.6 HFv1 allows an authenticated user to crash the application (with a NULL pointer dereferenc… |
CVE-2018-10240 | High | 7.3 | 2018-05-16 | SolarWinds Serv-U MFT before 15.1.6 HFv1 assigns authenticated users a low-entropy session token that can be included in requests to the application as a URL p… |
CVE-2018-5231 | High | 7.5 | 2018-05-16 | The ForgotLoginDetails resource in Atlassian Jira before version 7.6.6, from version 7.7.0 before version 7.7.4, from version 7.8.0 before version 7.8.4 and fr… |
CVE-2018-10810 | Medium | 6.1 | 2018-05-16 | chat/mobile/index.php in LiveZilla Live Chat 7.0.9.5 and prior is affected by Cross-Site Scripting via the Accept-Language HTTP header. |
CVE-2018-10738 | High | 7.2 | 2018-05-16 | A SQL injection issue was discovered in Nagios XI before 5.4.13 via the admin/menuaccess.php chbKey1 parameter. |
CVE-2018-10737 | High | 7.2 | 2018-05-16 | A SQL injection issue was discovered in Nagios XI before 5.4.13 via the admin/logbook.php txtSearch parameter. |
CVE-2018-10736 | High | 7.2 | 2018-05-16 | A SQL injection issue was discovered in Nagios XI before 5.4.13 via the admin/info.php key1 parameter. |
CVE-2018-10735 | High | 7.2 | 2018-05-16 | A SQL injection issue was discovered in Nagios XI before 5.4.13 via the admin/commandline.php cname parameter. |
CVE-2018-10123 | High | 8.8 | 2018-05-16 | p910nd on Inteno IOPSYS 2.0 through 4.2.0 allows remote attackers to read, or append data to, arbitrary files via requests on TCP port 9100. |
CVE-2018-8845 | Critical | 9.8 | 2018-05-15 | In Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versions V.2.0.15 and prior, WebAccess Scada… |
CVE-2018-8841 | High | 7.8 | 2018-05-15 | In Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versions V.2.0.15 and prior, WebAccess Scada… |
CVE-2018-7505 | Critical | 9.8 | 2018-05-15 | In Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versions V.2.0.15 and prior, WebAccess Scada… |
CVE-2018-7503 | High | 7.5 | 2018-05-15 | In Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versions V.2.0.15 and prior, WebAccess Scada… |
CVE-2018-7501 | High | 7.5 | 2018-05-15 | In Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versions V.2.0.15 and prior, WebAccess Scada… |
CVE-2018-7499 | Critical | 9.8 | 2018-05-15 | In Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versions V.2.0.15 and prior, WebAccess Scada… |
CVE-2018-7497 | Critical | 9.8 | 2018-05-15 | In Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versions V.2.0.15 and prior, WebAccess Scada… |
CVE-2018-7495 | High | 7.5 | 2018-05-15 | In Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versions V.2.0.15 and prior, WebAccess Scada… |
CVE-2018-10591 | Medium | 6.1 | 2018-05-15 | In Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versions V.2.0.15 and prior, WebAccess Scada… |
CVE-2018-10590 | High | 7.5 | 2018-05-15 | In Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versions V.2.0.15 and prior, WebAccess Scada… |
CVE-2018-10589 | Critical | 9.8 | 2018-05-15 | In Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versions V.2.0.15 and prior, WebAccess Scada… |
CVE-2018-1263 | Medium | 4.7 | 2018-05-15 | Addresses partial fix in CVE-2018-1261. Pivotal spring-integration-zip, versions prior to 1.0.2, exposes an arbitrary file write vulnerability, that can be ach… |
CVE-2018-1262 | High | 7.2 | 2018-05-15 | Cloud Foundry Foundation UAA, versions 4.12.X and 4.13.X, introduced a feature which could allow privilege escalation across identity zones for clients perform… |
CVE-2018-11094 | Critical | 9.8 | 2018-05-15 | An issue was discovered on Intelbras NCLOUD 300 1.0 devices. /cgi-bin/ExportSettings.sh, /goform/updateWPS, /goform/RebootSystem, and /goform/vpnBasicSettings… |
CVE-2018-11127 | Medium | 6.5 | 2018-05-15 | e107 2.1.7 has CSRF resulting in arbitrary user deletion. |
CVE-2018-11126 | High | 8.8 | 2018-05-15 | dg-user/?controller=users&action=add in doorGets 7.0 has CSRF that results in adding an administrator account. |
CVE-2018-1087 | High | 8.0 | 2018-05-15 | kernel KVM before versions kernel 4.16, kernel 4.16-rc7, kernel 4.17-rc1, kernel 4.17-rc2 and kernel 4.17-rc3 is vulnerable to a flaw in the way the Linux kern… |
CVE-2018-11105 | Medium | 6.1 | 2018-05-15 | There is stored cross site scripting in the wp-live-chat-support plugin before 8.0.08 for WordPress via the "name" (aka wplc_name) and "email" (aka wplc_email)… |
CVE-2018-3661 | Medium | 5.5 | 2018-05-15 | Buffer overflow in Intel system Configuration utilities selview.exe and syscfg.exe before version 14 build 11 allows a local user to crash these services poten… |
CVE-2018-3634 | Medium | 5.5 | 2018-05-15 | Parameter corruption in NDIS filter driver in Intel Online Connect Access 1.9.22.0 allows an attacker to cause a denial of service via local access. |
CVE-2018-3611 | Medium | 6.5 | 2018-05-15 | Bounds check vulnerability in User Mode Driver in Intel Graphics Driver 15.40.x.4 and 21.20.x.x allows unprivileged user to cause a denial of service via local… |
CVE-2018-1131 | High | 8.8 | 2018-05-15 | Infinispan permits improper deserialization of trusted data via XML and JSON transcoders under certain server configurations. A user with authenticated access… |
CVE-2018-10825 | Medium | 5.3 | 2018-05-15 | Mimo Baby 2 devices do not use authentication or encryption for the Bluetooth Low Energy (BLE) communication from a Turtle to a Lilypad, which allows attackers… |
CVE-2018-11102 | High | 7.5 | 2018-05-15 | An issue was discovered in Libav 12.3. A read access violation in the mov_probe function in libavformat/mov.c allows remote attackers to cause a denial of serv… |
CVE-2018-11100 | High | 8.8 | 2018-05-15 | The decompileSETTARGET function in decompile.c in libming through 0.4.8 mishandles cases where the header indicates a file size greater than the actual size, w… |
CVE-2018-11098 | High | 7.2 | 2018-05-15 | An issue was discovered in Frog CMS 0.9.5. There is a file upload vulnerability via the admin/?/plugin/file_manager/upload URI, a similar issue to CVE-2014-491… |
CVE-2018-11097 | High | 7.5 | 2018-05-15 | An issue was discovered in cloudwu/cstring through 2016-11-09. There is a memory leak vulnerability that could lead to a program crash. |
CVE-2018-11095 | High | 8.8 | 2018-05-15 | The decompileJUMP function in decompile.c in libming through 0.4.8 mishandles cases where the header indicates a file size greater than the actual size, which… |
CVE-2018-11091 | Critical | 9.9 | 2018-05-14 | An issue was discovered in MyBiz MyProcureNet 5.0.0. A malicious file can be uploaded to the webserver by an attacker. It is possible for an attacker to upload… |
CVE-2018-11090 | Medium | 6.1 | 2018-05-14 | An XSS issue was discovered in MyBiz MyProcureNet 5.0.0. This vulnerability within "ProxyPage.aspx" allows an attacker to inject malicious client side scriptin… |
CVE-2018-10994 | Medium | 6.1 | 2018-05-14 | js/views/message_view.js in Open Whisper Signal (aka Signal-Desktop) before 1.10.1 allows XSS via a URL. |
CVE-2018-8843 | Medium | 5.5 | 2018-05-14 | Rockwell Automation Arena versions 15.10.00 and prior contains a use after free vulnerability caused by processing specially crafted Arena Simulation Software… |
CVE-2018-10990 | High | 8.0 | 2018-05-14 | On Arris Touchstone Telephony Gateway TG1682G 9.1.103J6 devices, a logout action does not immediately destroy all state on the device related to the validity o… |
CVE-2018-10989 | Medium | 6.6 | 2018-05-14 | Arris Touchstone Telephony Gateway TG1682G 9.1.103J6 devices are distributed by some ISPs with a default password of "password" for the admin account that is u… |
CVE-2018-10252 | High | 8.1 | 2018-05-14 | An issue was discovered on Actiontec WCB6200Q before 1.1.10.20a devices. The admin login session cookie is insecurely generated making admin session hijacking… |
CVE-2018-5230 | Medium | 6.1 | 2018-05-14 | The issue collector in Atlassian Jira before version 7.6.6, from version 7.7.0 before version 7.7.4, from version 7.8.0 before version 7.8.4 and from version 7… |
CVE-2018-0591 | Medium | 5.9 | 2018-05-14 | The KINEPASS App for Android Ver 3.1.1 and earlier, and for iOS Ver 3.1.2 and earlier do not verify X.509 certificates from SSL servers, which allows man-in-th… |
CVE-2018-0590 | Medium | 4.3 | 2018-05-14 | Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote authenticated attackers to bypass access restriction to modify the other users profil… |
CVE-2018-0589 | Medium | 4.3 | 2018-05-14 | Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote authenticated attackers to bypass access restriction to add a new form in the 'Forms'… |
CVE-2018-0588 | High | 7.5 | 2018-05-14 | Directory traversal vulnerability in the AJAX function of Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote attackers to read arbitrary… |
CVE-2018-0587 | Medium | 4.3 | 2018-05-14 | Unrestricted file upload vulnerability in Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote authenticated users to upload arbitrary ima… |
CVE-2018-0586 | Medium | 4.3 | 2018-05-14 | Directory traversal vulnerability in the shortcodes function of Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote authenticated attacke… |
CVE-2018-0585 | Medium | 5.4 | 2018-05-14 | Cross-site scripting vulnerability in Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote attackers to inject arbitrary web script or HTM… |
CVE-2018-0583 | Medium | 6.1 | 2018-05-14 | Cross-site scripting vulnerability in ASUS RT-AC1200HP Firmware version prior to 3.0.0.4.380.4180 allows remote attackers to inject arbitrary web script or HTM… |
CVE-2018-0582 | Medium | 6.1 | 2018-05-14 | Cross-site scripting vulnerability in ASUS RT-AC68U Firmware version prior to 3.0.0.4.380.1031 allows remote attackers to inject arbitrary web script or HTML v… |
CVE-2018-0581 | Medium | 6.1 | 2018-05-14 | Cross-site scripting vulnerability in ASUS RT-AC87U Firmware version prior to 3.0.0.4.378.9383 allows remote attackers to inject arbitrary web script or HTML v… |
CVE-2018-0580 | High | 7.8 | 2018-05-14 | Untrusted search path vulnerability in CELSYS, Inc CLIP STUDIO series (CLIP STUDIO PAINT (for Windows) EX/PRO/DEBUT Ver.1.7.3 and earlier, CLIP STUDIO ACTION (… |
CVE-2018-0579 | Medium | 6.1 | 2018-05-14 | Cross-site scripting vulnerability in Open Graph for Facebook, Google+ and Twitter Card Tags plugin prior to version 2.2.4.1 for WordPress allows remote attack… |
CVE-2018-0578 | Medium | 5.4 | 2018-05-14 | Cross-site scripting vulnerability in PixelYourSite plugin prior to version 5.3.0 for WordPress allows remote attackers to inject arbitrary web script or HTML… |
CVE-2018-0577 | Medium | 5.4 | 2018-05-14 | Cross-site scripting vulnerability in WP Google Map Plugin prior to version 4.0.4 for WordPress allows remote attackers to inject arbitrary web script or HTML… |
CVE-2018-0576 | Medium | 5.4 | 2018-05-14 | Cross-site scripting vulnerability in Events Manager plugin prior to version 5.9 for WordPress allows remote attackers to inject arbitrary web script or HTML v… |
CVE-2018-0568 | High | 8.8 | 2018-05-14 | Unrestricted file upload vulnerability in SiteBridge Inc. Joruri Gw Ver 3.2.0 and earlier allows remote authenticated users to execute arbitrary PHP code via u… |
CVE-2018-11037 | Medium | 6.5 | 2018-05-14 | In Exiv2 0.26, the Exiv2::PngImage::printStructure function in pngimage.cpp allows remote attackers to cause an information leak via a crafted file. |
CVE-2018-11035 | High | 7.8 | 2018-05-14 | In 2345 Security Guard 3.7, the driver file (2345NsProtect.sys, X64 version) allows local users to cause a denial of service (BSOD) or possibly have unspecifie… |
CVE-2018-11034 | High | 7.8 | 2018-05-14 | In 2345 Security Guard 3.7, the driver file (2345NsProtect.sys, X64 version) allows local users to cause a denial of service (BSOD) or possibly have unspecifie… |
CVE-2018-10944 | Medium | 5.9 | 2018-05-14 | The request_dividend function of a smart contract implementation for ROC (aka Rasputin Online Coin), an Ethereum ERC20 token, allows attackers to steal all of… |
CVE-2018-11033 | High | 7.8 | 2018-05-14 | The DCTStream::readHuffSym function in Stream.cc in the DCT decoder in xpdf before 4.00 allows remote attackers to cause a denial of service (application crash… |
CVE-2018-11032 | Critical | 9.8 | 2018-05-14 | PHPRAP 1.0.4 through 1.0.8 has SQL Injection via the application/home/controller/project.php search() function. |
CVE-2018-11031 | Critical | 9.8 | 2018-05-14 | application/home/controller/debug.php in PHPRAP 1.0.4 through 1.0.8 has SSRF via the /debug URI, as demonstrated by an api[url]=file:////etc/passwd&api[method]… |
CVE-2018-11018 | High | 8.8 | 2018-05-13 | An issue was discovered in PbootCMS v1.0.7. Cross-site request forgery (CSRF) vulnerability in apps/admin/controller/system/RoleController.php allows remote at… |
CVE-2018-11017 | High | 8.8 | 2018-05-13 | The newVar_N function in decompile.c in libming through 0.4.8 mishandles cases where the header indicates a file size greater than the actual size, which allow… |
CVE-2018-10678 | Medium | 6.1 | 2018-05-13 | MyBB 1.8.15, when accessed with Microsoft Edge, mishandles 'target="_blank" rel="noopener"' in A elements, which makes it easier for remote attackers to conduc… |
CVE-2018-11013 | Critical | 9.8 | 2018-05-13 | Stack-based buffer overflow in the websRedirect function in GoAhead on D-Link DIR-816 A2 (CN) routers with firmware version 1.10B05 allows unauthenticated remo… |
CVE-2018-11012 | Medium | 6.1 | 2018-05-12 | ruibaby Halo 0.0.2 has stored XSS via the loginName and loginPwd parameters in a failed login attempt to AdminController.java. |
CVE-2018-11011 | Medium | 6.1 | 2018-05-12 | ruibaby Halo 0.0.2 has stored XSS via the commentAuthor field to FrontCommentController.java. |
CVE-2018-11004 | High | 8.8 | 2018-05-12 | An issue was discovered in SDcms v1.5. Cross-site request forgery (CSRF) vulnerability in /WWW//app/admin/controller/admincontroller.php allows remote attacker… |