2018 CVEs (page 138)
Page 138 of 162 — CVEs published in 2018, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2018-9995 | Critical | 9.8 | 2018-04-10 | TBK DVR4104 and DVR4216 devices, as well as Novo, CeNova, QSee, Pulnix, XVR 5 in 1, Securus, Night OWL, DVR Login, HVR Login, and MDVR Login, which run re-bran… |
CVE-2018-9993 | Medium | 4.8 | 2018-04-10 | YUNUCMS 1.0.7 has XSS via the content title on an admin/content/addcontent/cid/## page (aka a news center page). |
CVE-2018-3839 | High | 8.8 | 2018-04-10 | An exploitable code execution vulnerability exists in the XCF image rendering functionality of Simple DirectMedia Layer SDL2_image-2.0.2. A specially crafted X… |
CVE-2018-3838 | Medium | 6.5 | 2018-04-10 | An exploitable information vulnerability exists in the XCF image rendering functionality of Simple DirectMedia Layer SDL2_image-2.0.2. A specially crafted XCF… |
CVE-2018-3837 | Medium | 5.5 | 2018-04-10 | An exploitable information disclosure vulnerability exists in the PCX image rendering functionality of Simple DirectMedia Layer SDL2_image-2.0.2. A specially c… |
CVE-2018-9989 | High | 7.5 | 2018-04-10 | ARM mbed TLS before 2.1.11, before 2.7.2, and before 2.8.0 has a buffer over-read in ssl_parse_server_psk_hint() that could cause a crash on invalid input. |
CVE-2018-9988 | High | 7.5 | 2018-04-10 | ARM mbed TLS before 2.1.11, before 2.7.2, and before 2.8.0 has a buffer over-read in ssl_parse_server_key_exchange() that could cause a crash on invalid input. |
CVE-2018-9985 | Medium | 6.1 | 2018-04-10 | The front page of MetInfo 6.0 allows XSS by sending a feedback message to an administrator. |
CVE-2018-9918 | High | 7.8 | 2018-04-10 | libqpdf.a in QPDF through 8.0.2 mishandles certain "expected dictionary key but found non-name object" cases, allowing remote attackers to cause a denial of se… |
CVE-2018-9038 | Medium | 6.5 | 2018-04-10 | Monstra CMS 3.0.4 allows remote attackers to delete files via an admin/index.php?id=filesmanager&delete_dir=./&path=uploads/ request. |
CVE-2018-9037 | High | 8.8 | 2018-04-10 | Monstra CMS 3.0.4 allows remote code execution via an upload_file request for a .zip file, which is automatically extracted and may contain .php files. |
CVE-2018-8772 | Medium | 6.1 | 2018-04-10 | Coship RT3052 4.0.0.48 devices allow XSS via a crafted SSID field on the "Wireless Setting - Basic" screen. |
CVE-2018-2413 | Medium | 5.4 | 2018-04-10 | SAP Disclosure Management 10.1 does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. |
CVE-2018-2412 | Low | 3.8 | 2018-04-10 | SAP Disclosure Management 10.1 does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. |
CVE-2018-2410 | Medium | 5.4 | 2018-04-10 | SAP Business One, 9.2, 9.3, browser access does not sufficiently encode user controlled inputs, which results in a Cross-Site Scripting (XSS) vulnerability. |
CVE-2018-2409 | Medium | 6.3 | 2018-04-10 | Improper session management when using SAP Cloud Platform 2.0 (Connectivity Service and Cloud Connector). Under certain conditions, data of some other user may… |
CVE-2018-2408 | High | 7.3 | 2018-04-10 | Improper Session Management in SAP Business Objects, 4.0, from 4.10, from 4.20, 4.30, CMC/BI Launchpad/Fiorified BI Launchpad. In case of password change for a… |
CVE-2018-2406 | Medium | 5.3 | 2018-04-10 | Unquoted windows search path (directory/path traversal) vulnerability in Crystal Reports Server, OEM Edition (CRSE), 4.0, 4.10, 4.20, 4.30, startup path. |
CVE-2018-2405 | Medium | 5.4 | 2018-04-10 | SAP Solution Manager, 7.10, 7.20, Incident Management Work Center allows an attacker to upload a malicious script as an attachment and this could lead to possi… |
CVE-2018-2404 | Medium | 4.3 | 2018-04-10 | SAP Disclosure Management 10.1 allows an attacker to upload any file without proper file format validation. |
CVE-2018-2403 | Medium | 5.4 | 2018-04-10 | Under certain conditions, SAP Disclosure Management 10.1 allows an attacker to access information which would otherwise be restricted. It is possible for an au… |
CVE-2018-5227 | Medium | 4.8 | 2018-04-10 | Various administrative application link resources in Atlassian Application Links before version 5.4.4 allow remote attackers with administration rights to inje… |
CVE-2018-9934 | High | 8.8 | 2018-04-10 | The reset-password feature in MetInfo 6.0 allows remote attackers to change arbitrary passwords via vectors involving a Host HTTP header that is modified to sp… |
CVE-2018-9928 | Medium | 6.1 | 2018-04-10 | Cross-site scripting (XSS) vulnerability in save.php in MetInfo 6.0 allows remote attackers to inject arbitrary web script or HTML via the webname or weburl pa… |
CVE-2018-9927 | High | 8.8 | 2018-04-10 | An issue was discovered in WUZHI CMS 4.1.0. There is a CSRF vulnerability that can add a user account via index.php?m=member&f=index&v=add. |
CVE-2018-9926 | High | 8.8 | 2018-04-10 | An issue was discovered in WUZHI CMS 4.1.0. There is a CSRF vulnerability that can add an admin account via index.php?m=core&f=power&v=add. |
CVE-2018-9925 | Medium | 5.4 | 2018-04-10 | An issue was discovered in idreamsoft iCMS through 7.0.7. XSS exists via the nickname field in an admincp.php?app=user&do=save&frame=iPHP request. |
CVE-2018-9924 | Critical | 9.8 | 2018-04-10 | An issue was discovered in idreamsoft iCMS through 7.0.7. SQL injection exists via the pid array parameter in an admincp.php?app=tag&do=save&frame=iPHP request. |
CVE-2018-9923 | High | 8.8 | 2018-04-10 | An issue was discovered in idreamsoft iCMS through 7.0.7. CSRF exists in admincp.php, as demonstrated by adding an article via an app=article&do=save&frame=iPH… |
CVE-2018-9922 | Medium | 5.3 | 2018-04-10 | An issue was discovered in idreamsoft iCMS through 7.0.7. Physical path leakage exists via an invalid nickname field that reveals a core/library/weixin.class.p… |
CVE-2018-9840 | Medium | 6.8 | 2018-04-10 | The Open Whisper Signal app before 2.23.2 for iOS allows physically proximate attackers to bypass the screen locker feature via certain rapid sequences of acti… |
CVE-2018-5463 | High | 7.8 | 2018-04-09 | A structured exception handler overflow vulnerability in Leao Consultoria e Desenvolvimento de Sistemas (LCDS) LTDA ME LAquis SCADA 4.1.0.3391 and earlier may… |
CVE-2018-6182 | Medium | 6.1 | 2018-04-09 | Mahara 16.10 before 16.10.9 and 17.04 before 17.04.7 and 17.10 before 17.10.4 are vulnerable to bad input when TinyMCE is bypassed by POST packages. Therefore… |
CVE-2018-1217 | Critical | 9.8 | 2018-04-09 | Avamar Installation Manager in Dell EMC Avamar Server 7.3.1, 7.4.1, and 7.5.0, and Dell EMC Integrated Data Protection Appliance 2.0 and 2.1, is affected by a… |
CVE-2018-9864 | Medium | 6.1 | 2018-04-09 | The WP Live Chat Support plugin before 8.0.06 for WordPress has stored XSS via the Name field. |
CVE-2018-9862 | High | 7.8 | 2018-04-09 | util.c in runV 1.0.0 for Docker mishandles a numeric username, which allows attackers to obtain root access by leveraging the presence of an initial numeric va… |
CVE-2018-1308 | High | 7.5 | 2018-04-09 | This vulnerability in Apache Solr 1.2 to 6.6.2 and 7.0.0 to 7.2.1 relates to an XML external entity expansion (XXE) in the `&dataConfig=<inlinexml>` parameter… |
CVE-2018-0556 | High | 8.8 | 2018-04-09 | Buffalo WZR-1750DHP2 Ver.2.30 and earlier allows an attacker to execute arbitrary OS commands via unspecified vectors. |
CVE-2018-0555 | High | 7.8 | 2018-04-09 | Buffer overflow in Buffalo WZR-1750DHP2 Ver.2.30 and earlier allows an attacker to execute arbitrary code via a specially crafted file. |
CVE-2018-0554 | High | 8.8 | 2018-04-09 | Buffalo WZR-1750DHP2 Ver.2.30 and earlier allows an attacker to bypass authentication and execute arbitrary commands on the device via unspecified vectors. |
CVE-2018-0553 | High | 7.4 | 2018-04-09 | The iRemoconWiFi App for Android version 4.1.7 and earlier does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spo… |
CVE-2018-0545 | Critical | 9.8 | 2018-04-09 | LXR version 1.0.0 to 2.3.0 allows remote attackers to execute arbitrary OS commands via unspecified vectors. |
CVE-2018-9857 | Medium | 6.1 | 2018-04-09 | PHP Scripts Mall Match Clone Script 1.0.4 has XSS via the search field to searchbyid.php (aka the "View Search By Id" screen). |
CVE-2018-9856 | High | 8.8 | 2018-04-09 | Kotti before 1.3.2 and 2.x before 2.0.0b2 has CSRF in the local roles implementation, as demonstrated by triggering a permission change via a /admin-document/@… |
CVE-2018-6905 | Medium | 4.8 | 2018-04-08 | The page module in TYPO3 before 8.7.11, and 9.1.0, has XSS via $GLOBALS['TYPO3_CONF_VARS']['SYS']['sitename'], as demonstrated by an admin entering a crafted s… |
CVE-2018-9852 | Critical | 9.8 | 2018-04-08 | In Gxlcms QY v1.0.0713, Lib\Lib\Action\Home\HitsAction.class.php allows remote attackers to read data from a database by embedding a FROM clause in a query str… |
CVE-2018-9851 | High | 7.5 | 2018-04-08 | In Gxlcms QY v1.0.0713, Lib\Lib\Action\Admin\TplAction.class.php allows remote attackers to read any file via a modified pathname in an Admin-Tpl request, as d… |
CVE-2018-9850 | High | 7.5 | 2018-04-08 | In Gxlcms QY v1.0.0713, Lib\Lib\Action\Admin\DataAction.class.php allows remote attackers to delete any file via directory traversal sequences in the id parame… |
CVE-2018-9848 | Critical | 9.8 | 2018-04-07 | In Gxlcms QY v1.0.0713, the upload function in Lib\Lib\Action\Admin\UploadAction.class.php allows remote attackers to execute arbitrary PHP code by first using… |
CVE-2018-9847 | Critical | 9.8 | 2018-04-07 | In Gxlcms QY v1.0.0713, the update function in Lib\Lib\Action\Admin\TplAction.class.php allows remote attackers to execute arbitrary PHP code by placing this c… |
CVE-2018-9846 | High | 8.8 | 2018-04-07 | In Roundcube from versions 1.2.0 to 1.3.5, with the archive plugin enabled and configured, it's possible to exploit the unsanitized, user-controlled "_uid" par… |
CVE-2018-9327 | High | 8.1 | 2018-04-07 | Etherpad 1.5.x and 1.6.x before 1.6.4 allows an attacker to execute arbitrary code on the server. The instance has to be configured to use a document database… |
CVE-2018-9326 | Critical | 9.8 | 2018-04-07 | Etherpad 1.6.3 before 1.6.4 allows an attacker to execute arbitrary code. |
CVE-2018-9325 | High | 7.5 | 2018-04-07 | Etherpad 1.5.x and 1.6.x before 1.6.4 allows an attacker to export all the existing pads of an instance without knowledge of pad names. |
CVE-2018-9330 | Medium | 5.4 | 2018-04-07 | register.jsp in Coremail XT3.0 allows stored XSS, as demonstrated by the third form field to a URI under register/, a different vulnerability than CVE-2015-694… |
CVE-2018-9844 | Medium | 6.1 | 2018-04-07 | The Iptanus WordPress File Upload plugin before 4.3.4 for WordPress mishandles Settings attributes, leading to XSS. |
CVE-2018-9841 | High | 8.8 | 2018-04-07 | The export function in libavfilter/vf_signature.c in FFmpeg through 3.4.2 allows remote attackers to cause a denial of service (out-of-array access) or possibl… |
CVE-2018-9331 | High | 7.5 | 2018-04-07 | An issue was discovered in zzcms 8.2. user/adv.php allows remote attackers to delete arbitrary files via directory traversal sequences in the oldimg parameter… |
CVE-2018-9838 | Critical | 9.8 | 2018-04-06 | The caml_ba_deserialize function in byterun/bigarray.c in the standard library in OCaml 4.06.0 has an integer overflow which, in situations where marshalled da… |
CVE-2018-7506 | High | 7.5 | 2018-04-06 | The private key of the web server in Moxa MXview versions 2.8 and prior is able to be read and accessed via an HTTP GET request, which may allow a remote attac… |
CVE-2018-1272 | High | 7.5 | 2018-04-06 | Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, provide client-side support for multipart reques… |
CVE-2018-1271 | Medium | 5.9 | 2018-04-06 | Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to configure Spring MVC to se… |
CVE-2018-1270 | Critical | 9.8 | 2018-04-06 | Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to expose STOMP over WebSocke… |
CVE-2018-1000156 | High | 7.8 | 2018-04-06 | GNU Patch version 2.7.6 contains an input validation vulnerability when processing patch files, specifically the EDITOR_PROGRAM invocation (using ed) can resul… |
CVE-2018-1096 | Medium | 6.5 | 2018-04-05 | An input sanitization flaw was found in the id field in the dashboard controller of Foreman before 1.16.1. A user could use this flaw to perform an SQL injecti… |
CVE-2018-9328 | Medium | 6.1 | 2018-04-05 | PHP Scripts Mall Redbus Clone Script 3.0.6 has XSS via the ter_from or tag parameter to results.php. |
CVE-2018-9233 | High | 7.8 | 2018-04-05 | Sophos Endpoint Protection 10.7 uses an unsalted SHA-1 hash for password storage in %PROGRAMDATA%\Sophos\Sophos Anti-Virus\Config\machine.xml, which makes it e… |
CVE-2018-4863 | Medium | 5.5 | 2018-04-05 | Sophos Endpoint Protection 10.7 allows local users to bypass an intended tamper protection mechanism by deleting the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSe… |
CVE-2018-3624 | High | 8.3 | 2018-04-05 | Buffer overflow in ETWS processing module Intel XMM71xx, XMM72xx, XMM73xx, XMM74xx and Sofia 3G/R allows remote attacker to potentially execute arbitrary code… |
CVE-2018-9244 | Medium | 6.1 | 2018-04-05 | GitLab Community and Enterprise Editions version 9.2 up to 10.4 are vulnerable to XSS because a lack of input validation in the milestones component leads to c… |
CVE-2018-9243 | Medium | 6.1 | 2018-04-05 | GitLab Community and Enterprise Editions version 8.4 up to 10.4 are vulnerable to XSS because a lack of input validation in the merge request component leads t… |
CVE-2018-7035 | Medium | 5.4 | 2018-04-05 | Cross-site scripting (XSS) vulnerability in Gleez CMS 1.2.0 and 2.0 might allow remote attackers (users) to inject JavaScript via HTML content in an editor, wh… |
CVE-2018-1315 | Low | 3.7 | 2018-04-05 | In Apache Hive 2.1.0 to 2.3.2, when 'COPY FROM FTP' statement is run using HPL/SQL extension to Hive, a compromised/malicious FTP server can cause the file to… |
CVE-2018-1284 | Low | 3.7 | 2018-04-05 | In Apache Hive 0.6.0 to 2.3.2, malicious user might use any xpath UDFs (xpath/xpath_string/xpath_boolean/xpath_number/xpath_double/xpath_float/xpath_long/xpath… |
CVE-2018-1282 | Critical | 9.1 | 2018-04-05 | This vulnerability in Apache Hive JDBC driver 0.7.1 to 2.3.2 allows carefully crafted arguments to be used to bypass the argument escaping/cleanup that JDBC dr… |
CVE-2018-1000154 | Medium | 6.1 | 2018-04-05 | Zammad GmbH Zammad version 2.3.0 and earlier contains a Improper Neutralization of Script-Related HTML Tags in a Web Page (CWE-80) vulnerability in the subject… |
CVE-2018-1000153 | High | 8.8 | 2018-04-05 | A cross-site request forgery vulnerability exists in Jenkins vSphere Plugin 2.16 and older in Clone.java, CloudSelectorParameter.java, ConvertToTemplate.java… |
CVE-2018-1000152 | Medium | 6.3 | 2018-04-05 | An improper authorization vulnerability exists in Jenkins vSphere Plugin 2.16 and older in Clone.java, CloudSelectorParameter.java, ConvertToTemplate.java, Con… |
CVE-2018-1000151 | Medium | 5.6 | 2018-04-05 | A man in the middle vulnerability exists in Jenkins vSphere Plugin 2.16 and older in VSphere.java that disables SSL/TLS certificate validation by default. |
CVE-2018-1000150 | Low | 3.3 | 2018-04-05 | An exposure of sensitive information vulnerability exists in Jenkins Reverse Proxy Auth Plugin 1.5 and older in ReverseProxySecurityRealm#authContext that allo… |
CVE-2018-1000149 | Medium | 5.6 | 2018-04-05 | A man in the middle vulnerability exists in Jenkins Ansible Plugin 0.8 and older in AbstractAnsibleInvocation.java, AnsibleAdHocCommandBuilder.java, AnsibleAdH… |
CVE-2018-1000148 | Medium | 6.5 | 2018-04-05 | An exposure of sensitive information vulnerability exists in Jenkins Copy To Slave Plugin version 1.4.4 and older in CopyToSlaveBuildWrapper.java that allows a… |
CVE-2018-1000147 | Medium | 6.5 | 2018-04-05 | An exposure of sensitive information vulnerability exists in Jenkins Perforce Plugin version 1.3.36 and older in PerforcePasswordEncryptor.java that allows att… |
CVE-2018-1000146 | High | 8.8 | 2018-04-05 | An arbitrary code execution vulnerability exists in Liquibase Runner Plugin version 1.3.0 and older that allows an attacker with permission to configure jobs t… |
CVE-2018-1000145 | Medium | 6.5 | 2018-04-05 | An exposure of sensitive information vulnerability exists in Jenkins Perforce Plugin version 1.3.36 and older in PerforcePasswordEncryptor.java that allows att… |
CVE-2018-1000144 | Medium | 6.1 | 2018-04-05 | A cross site scripting vulnerability exists in Jenkins Cucumber Living Documentation Plugin 1.0.12 and older in CukedoctorBaseAction#doDynamic that disables th… |
CVE-2018-1000143 | Medium | 6.7 | 2018-04-05 | An exposure of sensitive information vulnerability exists in Jenkins GitHub Pull Request Builder Plugin version 1.39.0 and older in GhprbCause.java that allows… |
CVE-2018-1000142 | High | 7.8 | 2018-04-05 | An exposure of sensitive information vulnerability exists in Jenkins GitHub Pull Request Builder Plugin version 1.39.0 and older in GhprbCause.java that allows… |
CVE-2018-9309 | Critical | 9.8 | 2018-04-05 | An issue was discovered in zzcms 8.2. It allows SQL injection via the id parameter in a dl/dl_sendsms.php request. |
CVE-2018-9307 | Medium | 6.1 | 2018-04-04 | dsmall v20180320 allows XSS via the pdr_sn parameter to public/index.php/home/predeposit/index.html. |
CVE-2018-9305 | High | 8.1 | 2018-04-04 | In Exiv2 0.26, an out-of-bounds read in IptcData::printStructure in iptc.c could result in a crash or information leak, related to the "== 0x1c" case. |
CVE-2018-9304 | Medium | 6.5 | 2018-04-04 | In Exiv2 0.26, a divide by zero in BigTiffImage::printIFD in bigtiffimage.cpp could result in denial of service. |
CVE-2018-9303 | Medium | 6.5 | 2018-04-04 | In Exiv2 0.26, an assertion failure in BigTiffImage::readData in bigtiffimage.cpp results in an abort. |
CVE-2018-1097 | High | 8.8 | 2018-04-04 | A flaw was found in foreman before 1.16.1. The issue allows users with limited permissions for powering oVirt/RHV hosts on and off to discover the username and… |
CVE-2018-1082 | High | 8.1 | 2018-04-04 | A flaw was found in Moodle 3.4 to 3.4.1, and 3.3 to 3.3.4. If a user account using OAuth2 authentication method was once confirmed but later suspended, the use… |
CVE-2018-1081 | Medium | 5.3 | 2018-04-04 | A flaw was found in Moodle 3.4 to 3.4.1, 3.3 to 3.3.4, 3.2 to 3.2.7, 3.1 to 3.1.10 and earlier unsupported versions. Unauthenticated users can trigger custom m… |
CVE-2018-1002150 | Critical | 9.1 | 2018-04-04 | Koji version 1.12, 1.13, 1.14 and 1.15 contain an incorrect access control vulnerability resulting in arbitrary filesystem read/write access. This vulnerabilit… |
CVE-2018-9285 | Critical | 9.8 | 2018-04-04 | Main_Analysis_Content.asp in /apply.cgi on ASUS RT-AC66U, RT-AC68U, RT-AC86U, RT-AC88U, RT-AC1900, RT-AC2900, and RT-AC3100 devices before 3.0.0.4.384_10007; R… |
CVE-2018-9284 | Critical | 9.8 | 2018-04-04 | authentication.cgi on D-Link DIR-868L devices with Singapore StarHub firmware before v1.21SHCb03 allows remote attackers to execute arbitrary code. |
CVE-2018-9126 | Critical | 9.8 | 2018-04-04 | The DNNArticle module 11 for DNN (formerly DotNetNuke) allows remote attackers to read the web.config file, and consequently discover database credentials, via… |