2018 CVEs (page 133)
Page 133 of 162 — CVEs published in 2018, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2018-10173 | High | 8.8 | 2018-04-20 | Digital Guardian Management Console 7.1.2.0015 allows authenticated remote code execution because of Arbitrary File Upload functionality. |
CVE-2018-10079 | High | 7.8 | 2018-04-20 | Geist WatchDog Console 3.2.2 uses a weak ACL for the C:\ProgramData\WatchDog Console directory, which allows local users to modify configuration data by updati… |
CVE-2018-10078 | Medium | 4.8 | 2018-04-20 | Cross-site scripting (XSS) vulnerability in Geist WatchDog Console 3.2.2 allows remote authenticated administrators to inject arbitrary web script or HTML via… |
CVE-2018-10077 | Medium | 4.9 | 2018-04-20 | XML external entity (XXE) vulnerability in Geist WatchDog Console 3.2.2 allows remote authenticated administrators to read arbitrary files via crafted XML data. |
CVE-2018-8826 | Critical | 9.8 | 2018-04-20 | ASUS RT-AC51U, RT-AC58U, RT-AC66U, RT-AC1750, RT-ACRH13, and RT-N12 D1 routers with firmware before 3.0.0.4.380.8228; RT-AC52U B1, RT-AC1200 and RT-N600 router… |
CVE-2018-10249 | High | 8.8 | 2018-04-20 | baijiacms V3 has CSRF via index.php?mod=site&op=edituser&name=manager&do=user to add an administrator account. |
CVE-2018-1292 | High | 8.1 | 2018-04-20 | Within the 'getReportType' method in Apache Fineract 1.0.0, 0.6.0-incubating, 0.5.0-incubating, 0.4.0-incubating, a hacker could inject SQL to read/update data… |
CVE-2018-1291 | High | 8.1 | 2018-04-20 | Apache Fineract 1.0.0, 0.6.0-incubating, 0.5.0-incubating, 0.4.0-incubating exposes different REST end points to query domain specific entities with a Query Pa… |
CVE-2018-1290 | Critical | 9.8 | 2018-04-20 | In Apache Fineract versions 1.0.0, 0.6.0-incubating, 0.5.0-incubating, 0.4.0-incubating, Using a single quotation escape with two continuous SQL parameters can… |
CVE-2018-1289 | High | 8.8 | 2018-04-20 | In Apache Fineract versions 1.0.0, 0.6.0-incubating, 0.5.0-incubating, 0.4.0-incubating, the system exposes different REST end points to query domain specific… |
CVE-2018-10250 | Medium | 5.4 | 2018-04-20 | iCMS V7.0.8 has XSS via the admincp.php keywords parameter in a weixin_category action, aka a WeChat Classified Management keyword search. |
CVE-2018-10248 | Medium | 6.5 | 2018-04-20 | An issue was discovered in WUZHI CMS 4.1.0. There is a CSRF vulnerability that can delete any article via index.php?m=content&f=content&v=recycle_delete. |
CVE-2018-10245 | Medium | 5.3 | 2018-04-20 | A Full Path Disclosure vulnerability in AWStats through 7.6 allows remote attackers to know where the config file is allocated, obtaining the full path of the… |
CVE-2018-6960 | High | 8.8 | 2018-04-20 | VMware Horizon DaaS (7.x before 8.0.0) contains a broken authentication vulnerability that may allow an attacker to bypass two-factor authentication. Note: In… |
CVE-2018-0564 | High | 8.1 | 2018-04-20 | Session fixation vulnerability in EC-CUBE (EC-CUBE 3.0.0, EC-CUBE 3.0.1, EC-CUBE 3.0.2, EC-CUBE 3.0.3, EC-CUBE 3..4, EC-CUBE 3.0.5, EC-CUBE 3.0.6, EC-CUBE 3.0… |
CVE-2018-10201 | High | 7.5 | 2018-04-20 | An issue was discovered in NcMonitorServer.exe in NC Monitor Server in NComputing vSpace Pro 10 and 11. It is possible to read arbitrary files outside the root… |
CVE-2018-10238 | Critical | 9.8 | 2018-04-20 | bvlc.c in skarg BACnet Protocol Stack bacserv 0.9.1 and 0.8.5 is affected by a Buffer Overflow because of a lack of packet-size validation. The affected compon… |
CVE-2018-0276 | Medium | 6.1 | 2018-04-19 | A vulnerability in Cisco WebEx Connect IM could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of an a… |
CVE-2018-0275 | Medium | 6.7 | 2018-04-19 | A vulnerability in the support tunnel feature of Cisco Identity Services Engine (ISE) could allow an authenticated, local attacker to access the device's shell… |
CVE-2018-0273 | Medium | 5.3 | 2018-04-19 | A vulnerability in the IPsec Manager of Cisco StarOS for Cisco Aggregation Services Router (ASR) 5000 Series Routers and Virtualized Packet Core (VPC) System S… |
CVE-2018-0272 | Medium | 5.9 | 2018-04-19 | A vulnerability in the Secure Sockets Layer (SSL) Engine of Cisco Firepower System Software could allow an unauthenticated, remote attacker to cause a denial o… |
CVE-2018-0269 | Medium | 4.3 | 2018-04-19 | A vulnerability in the web framework of the Cisco Digital Network Architecture Center (DNA Center) could allow an unauthenticated, remote attacker to communica… |
CVE-2018-0267 | Medium | 6.5 | 2018-04-19 | A vulnerability in the web framework of Cisco Unified Communications Manager could allow an authenticated, local attacker to view sensitive data that should be… |
CVE-2018-0266 | Medium | 4.3 | 2018-04-19 | A vulnerability in the web framework of Cisco Unified Communications Manager could allow an authenticated, remote attacker to view sensitive data. The vulnerab… |
CVE-2018-0260 | Medium | 5.3 | 2018-04-19 | A vulnerability in the web interface of Cisco MATE Live could allow an unauthenticated, remote attacker to view and download the contents of certain web applic… |
CVE-2018-0259 | High | 8.8 | 2018-04-19 | A vulnerability in the web-based management interface of Cisco MATE Collector could allow an unauthenticated, remote attacker to conduct a cross-site request f… |
CVE-2018-0257 | Medium | 4.3 | 2018-04-19 | A vulnerability in Cisco IOS XE Software running on Cisco cBR Series Converged Broadband Routers could allow an unauthenticated, adjacent attacker to cause hig… |
CVE-2018-0256 | Medium | 5.8 | 2018-04-19 | A vulnerability in the peer-to-peer message processing functionality of Cisco Packet Data Network Gateway could allow an unauthenticated, remote attacker to ca… |
CVE-2018-0255 | High | 8.8 | 2018-04-19 | A vulnerability in the device manager web interface of Cisco Industrial Ethernet Switches could allow an unauthenticated, remote attacker to conduct a cross-si… |
CVE-2018-0254 | Medium | 5.3 | 2018-04-19 | A vulnerability in the detection engine of Cisco Firepower System Software could allow an unauthenticated, remote attacker to bypass configured file action pol… |
CVE-2018-0251 | Medium | 6.1 | 2018-04-19 | A vulnerability in the Web Server Authentication Required screen of the Clientless Secure Sockets Layer (SSL) VPN portal of Cisco Adaptive Security Appliance (… |
CVE-2018-0244 | Medium | 5.8 | 2018-04-19 | A vulnerability in the detection engine of Cisco Firepower System Software could allow an unauthenticated, remote attacker to bypass a configured file action p… |
CVE-2018-0243 | Medium | 5.8 | 2018-04-19 | A vulnerability in the detection engine of Cisco Firepower System Software could allow an unauthenticated, remote attacker to bypass a configured file action p… |
CVE-2018-0242 | Medium | 6.1 | 2018-04-19 | A vulnerability in the WebVPN web-based management interface of Cisco Adaptive Security Appliance could allow an unauthenticated, remote attacker to conduct a… |
CVE-2018-0241 | High | 7.4 | 2018-04-19 | A vulnerability in the UDP broadcast forwarding function of Cisco IOS XR Software could allow an unauthenticated, adjacent attacker to cause a denial of servic… |
CVE-2018-0240 | High | 8.6 | 2018-04-19 | Multiple vulnerabilities in the Application Layer Protocol Inspection feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat De… |
CVE-2018-0239 | High | 7.5 | 2018-04-19 | A vulnerability in the egress packet processing functionality of the Cisco StarOS operating system for Cisco Aggregation Services Router (ASR) 5700 Series devi… |
CVE-2018-0238 | Critical | 9.9 | 2018-04-19 | A vulnerability in the role-based resource checking functionality of the Cisco Unified Computing System (UCS) Director could allow an authenticated, remote att… |
CVE-2018-0237 | Medium | 5.8 | 2018-04-19 | A vulnerability in the file type detection mechanism of the Cisco Advanced Malware Protection (AMP) for Endpoints macOS Connector could allow an unauthenticate… |
CVE-2018-0233 | High | 8.6 | 2018-04-19 | A vulnerability in the Secure Sockets Layer (SSL) packet reassembly functionality of the detection engine in Cisco Firepower System Software could allow an una… |
CVE-2018-0231 | High | 8.6 | 2018-04-19 | A vulnerability in the Transport Layer Security (TLS) library of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Soft… |
CVE-2018-0230 | High | 8.6 | 2018-04-19 | A vulnerability in the internal packet-processing functionality of Cisco Firepower Threat Defense (FTD) Software for Cisco Firepower 2100 Series Security Appli… |
CVE-2018-0229 | Medium | 6.5 | 2018-04-19 | A vulnerability in the implementation of Security Assertion Markup Language (SAML) Single Sign-On (SSO) authentication for Cisco AnyConnect Secure Mobility Cli… |
CVE-2018-0228 | High | 8.6 | 2018-04-19 | A vulnerability in the ingress flow creation functionality of Cisco Adaptive Security Appliance (ASA) could allow an unauthenticated, remote attacker to cause… |
CVE-2018-0227 | High | 7.5 | 2018-04-19 | A vulnerability in the Secure Sockets Layer (SSL) Virtual Private Network (VPN) Client Certificate Authentication feature for Cisco Adaptive Security Appliance… |
CVE-2018-0112 | Critical | 9.0 | 2018-04-19 | A vulnerability in Cisco WebEx Business Suite clients, Cisco WebEx Meetings, and Cisco WebEx Meetings Server could allow an authenticated, remote attacker to e… |
CVE-2018-3843 | High | 8.8 | 2018-04-19 | An exploitable type confusion vulnerability exists in the way Foxit PDF Reader version 9.0.1.1049 parses files with associated file annotations. A specially cr… |
CVE-2018-3842 | High | 8.8 | 2018-04-19 | An exploitable use of an uninitialized pointer vulnerability exists in the JavaScript engine in Foxit PDF Reader version 9.0.1.1049. A specially crafted PDF do… |
CVE-2018-10236 | High | 7.2 | 2018-04-19 | POSCMS 3.2.18 allows remote attackers to execute arbitrary PHP code via the diy\dayrui\controllers\admin\Syscontroller.php 'add' function because an attacker c… |
CVE-2018-10235 | High | 7.2 | 2018-04-19 | POSCMS 3.2.10 allows remote attackers to execute arbitrary PHP code via the diy\module\member\controllers\admin\Setting.php 'index' function because an attacke… |
CVE-2018-9861 | Medium | 6.1 | 2018-04-19 | Cross-site scripting (XSS) vulnerability in the Enhanced Image (aka image2) plugin for CKEditor (in versions 4.5.10 through 4.9.1; fixed in 4.9.2), as used in… |
CVE-2018-8118 | High | 7.5 | 2018-04-19 | A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, aka "Internet Explorer Memory Corruption Vulnerabili… |
CVE-2018-10230 | Medium | 6.1 | 2018-04-19 | Zend Debugger in Zend Server before 9.1.3 has XSS, aka ZSR-2455. |
CVE-2018-7920 | High | 7.5 | 2018-04-19 | Huawei AR1200 V200R006C10SPC300, AR160 V200R006C10SPC300, AR200 V200R006C10SPC300, AR2200 V200R006C10SPC300, AR3200 V200R006C10SPC300 devices have an improper… |
CVE-2018-7899 | Medium | 5.5 | 2018-04-19 | The Mali Driver of Huawei Berkeley-AL20 and Berkeley-BD smart phones with software Berkeley-AL20 8.0.0.105(C00), 8.0.0.111(C00), 8.0.0.112D(C00), 8.0.0.116(C00… |
CVE-2018-10188 | High | 8.8 | 2018-04-19 | phpMyAdmin 4.8.0 before 4.8.0-1 has CSRF, allowing an attacker to execute arbitrary SQL statements, related to js/db_operations.js, js/tbl_operations.js, libra… |
CVE-2018-6306 | High | 7.8 | 2018-04-19 | Unauthorized code execution from specific DLL and is known as DLL Hijacking attack in Kaspersky Password Manager versions before 8.0.6.538. |
CVE-2018-1146 | High | 7.5 | 2018-04-19 | A remote unauthenticated user can enable telnet on the Belkin N750 using firmware version 1.10.22 by sending a crafted HTTP request to set.cgi. When enabled th… |
CVE-2018-1145 | Critical | 9.8 | 2018-04-19 | A remote unauthenticated user can overflow a stack buffer in the Belkin N750 using firmware version 1.10.22 by sending a crafted HTTP request to proxy.cgi. |
CVE-2018-1144 | Critical | 9.8 | 2018-04-19 | A remote unauthenticated user can execute commands as root in the Belkin N750 using firmware version 1.10.22 by sending a crafted HTTP request to proxy.cgi. |
CVE-2018-1143 | Critical | 9.8 | 2018-04-19 | A remote unauthenticated user can execute commands as root in the Belkin N750 using firmware version 1.10.22 by sending a crafted HTTP request to twonky_comman… |
CVE-2018-9137 | Medium | 6.8 | 2018-04-19 | Open-AudIT before 2.2 has CSV Injection. |
CVE-2018-10227 | Medium | 5.4 | 2018-04-19 | MiniCMS v1.10 has XSS via the mc-admin/conf.php site_link parameter. |
CVE-2018-10225 | Critical | 9.8 | 2018-04-19 | thinkphp 3.1.3 has SQL Injection via the index.php s parameter. |
CVE-2018-10224 | Medium | 6.8 | 2018-04-19 | An issue was discovered in YzmCMS 3.8. There is a CSRF vulnerability that can add a tag via /index.php/admin/tag/add.html. |
CVE-2018-10223 | Medium | 6.8 | 2018-04-19 | An issue was discovered in YzmCMS 3.8. There is a CSRF vulnerability that can add an admin account via /index.php/admin/admin_manage/add.html. |
CVE-2018-10222 | High | 8.8 | 2018-04-19 | An issue was discovered in idreamsoft iCMS V7.0. There is a CSRF vulnerability that can add a Column via /admincp.php?app=article_category&do=save&frame=iPHP. |
CVE-2018-10221 | Medium | 5.4 | 2018-04-19 | An issue was discovered in WUZHI CMS V4.1.0. There is a persistent XSS vulnerability that can steal the administrator cookies via the tag[tag] parameter to the… |
CVE-2018-10220 | High | 8.8 | 2018-04-19 | Glastopf 3.1.3-dev has SSRF, as demonstrated by the abc.php a parameter. NOTE: the vendor indicates that this is intentional behavior because the product is a… |
CVE-2018-10219 | Medium | 5.3 | 2018-04-19 | baijiacms V3 has physical path leakage via an index.php?mod=mobile&name=member&do=index request. |
CVE-2018-10205 | Medium | 5.3 | 2018-04-19 | hyperstart 1.0.0 in HyperHQ Hyper has memory leaks in the container_setup_modules and hyper_rescan_scsi functions in container.c, related to runV 1.0.0 for Doc… |
CVE-2018-2879 | Critical | 9.0 | 2018-04-19 | Vulnerability in the Oracle Access Manager component of Oracle Fusion Middleware (subcomponent: Authentication Engine). Supported versions that are affected ar… |
CVE-2018-2878 | Medium | 6.1 | 2018-04-19 | Vulnerability in the PeopleSoft Enterprise HCM Shared Components component of Oracle PeopleSoft Products (subcomponent: Notepad). The supported version that is… |
CVE-2018-2877 | Medium | 5.0 | 2018-04-19 | Vulnerability in the MySQL Cluster component of Oracle MySQL (subcomponent: Cluster: ndbcluster/plugin). Supported versions that are affected are 7.2.27 and pr… |
CVE-2018-2876 | High | 7.1 | 2018-04-19 | Vulnerability in the Oracle Retail Integration Bus component of Oracle Retail Applications (subcomponent: RIB Kernal(Apache Commons Collections)). The supporte… |
CVE-2018-2874 | Medium | 4.3 | 2018-04-19 | Vulnerability in the Oracle Application Object Library component of Oracle E-Business Suite (subcomponent: Logging). The supported version that is affected is… |
CVE-2018-2873 | Medium | 5.3 | 2018-04-19 | Vulnerability in the Oracle General Ledger component of Oracle E-Business Suite (subcomponent: Account Hierarchy Manager). Supported versions that are affected… |
CVE-2018-2872 | Medium | 5.3 | 2018-04-19 | Vulnerability in the Oracle General Ledger component of Oracle E-Business Suite (subcomponent: Account Hierarchy Manager). Supported versions that are affected… |
CVE-2018-2871 | Critical | 9.1 | 2018-04-19 | Vulnerability in the Oracle Human Resources component of Oracle E-Business Suite (subcomponent: General Utilities). Supported versions that are affected are 12… |
CVE-2018-2870 | Critical | 9.1 | 2018-04-19 | Vulnerability in the Oracle Human Resources component of Oracle E-Business Suite (subcomponent: General Utilities). Supported versions that are affected are 12… |
CVE-2018-2869 | Medium | 5.3 | 2018-04-19 | Vulnerability in the Oracle Human Resources component of Oracle E-Business Suite (subcomponent: General Utilities). Supported versions that are affected are 12… |
CVE-2018-2868 | Medium | 5.3 | 2018-04-19 | Vulnerability in the Oracle Human Resources component of Oracle E-Business Suite (subcomponent: General Utilities). Supported versions that are affected are 12… |
CVE-2018-2867 | Medium | 5.3 | 2018-04-19 | Vulnerability in the Oracle Application Object Library component of Oracle E-Business Suite (subcomponent: Diagnostics). Supported versions that are affected a… |
CVE-2018-2866 | Medium | 5.3 | 2018-04-19 | Vulnerability in the Oracle General Ledger component of Oracle E-Business Suite (subcomponent: Consolidation Hierarchy Viewer). Supported versions that are aff… |
CVE-2018-2865 | Medium | 5.3 | 2018-04-19 | Vulnerability in the Oracle General Ledger component of Oracle E-Business Suite (subcomponent: Consolidation Hierarchy Viewer). Supported versions that are aff… |
CVE-2018-2864 | Medium | 5.3 | 2018-04-19 | Vulnerability in the Oracle Application Object Library component of Oracle E-Business Suite (subcomponent: Diagnostics). Supported versions that are affected a… |
CVE-2018-2863 | Medium | 5.0 | 2018-04-19 | Vulnerability in the Sun ZFS Storage Appliance Kit (AK) component of Oracle Sun Systems Products Suite (subcomponent: API frameworks). The supported version th… |
CVE-2018-2862 | High | 7.1 | 2018-04-19 | Vulnerability in the Oracle Retail Point-of-Service component of Oracle Retail Applications (subcomponent: User Interface). Supported versions that are affecte… |
CVE-2018-2861 | Medium | 6.5 | 2018-04-19 | Vulnerability in the Oracle Retail Back Office component of Oracle Retail Applications (subcomponent: Security). Supported versions that are affected are 13.4… |
CVE-2018-2860 | High | 8.2 | 2018-04-19 | Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). Supported versions that are affected are Prior to 5.1.36 and… |
CVE-2018-2859 | Medium | 6.1 | 2018-04-19 | Vulnerability in the Oracle Financial Services Basel Regulatory Capital Internal Ratings Based Approach component of Oracle Financial Services Applications (su… |
CVE-2018-2858 | Medium | 5.3 | 2018-04-19 | Vulnerability in the Sun ZFS Storage Appliance Kit (AK) component of Oracle Sun Systems Products Suite (subcomponent: HTTP data path subsystems). The supported… |
CVE-2018-2857 | Medium | 6.3 | 2018-04-19 | Vulnerability in the Sun ZFS Storage Appliance Kit (AK) component of Oracle Sun Systems Products Suite (subcomponent: HTTP data path subsystems). The supported… |
CVE-2018-2856 | High | 8.1 | 2018-04-19 | Vulnerability in the Oracle Financial Services Basel Regulatory Capital Internal Ratings Based Approach component of Oracle Financial Services Applications (su… |
CVE-2018-2855 | High | 8.1 | 2018-04-19 | Vulnerability in the Oracle Financial Services Basel Regulatory Capital Basic component of Oracle Financial Services Applications (subcomponent: Portfolio, Att… |
CVE-2018-2854 | Medium | 6.1 | 2018-04-19 | Vulnerability in the Oracle Financial Services Basel Regulatory Capital Basic component of Oracle Financial Services Applications (subcomponent: Portfolio, Att… |
CVE-2018-2853 | Medium | 5.4 | 2018-04-19 | Vulnerability in the Oracle Hospitality Simphony First Edition component of Oracle Hospitality Applications (subcomponent: Operations, Client Application Loade… |
CVE-2018-2852 | Medium | 6.4 | 2018-04-19 | Vulnerability in the Oracle Hospitality Guest Access component of Oracle Hospitality Applications (subcomponent: Base). Supported versions that are affected ar… |
CVE-2018-2851 | High | 8.1 | 2018-04-19 | Vulnerability in the Oracle Hospitality Simphony First Edition component of Oracle Hospitality Applications (subcomponent: Enterprise Management Console). Supp… |
CVE-2018-2850 | High | 7.3 | 2018-04-19 | Vulnerability in the Oracle Hospitality Cruise Fleet Management System component of Oracle Hospitality Applications (subcomponent: Fleet Management System Suit… |