2018 CVEs (page 139)
Page 139 of 162 — CVEs published in 2018, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2018-9115 | Medium | 5.3 | 2018-04-04 | Systematic SitaWare 6.4 SP2 does not validate input from other sources sufficiently. e.g., information utilizing the NVG interface. An attacker can freeze the… |
CVE-2018-9035 | Critical | 9.6 | 2018-04-04 | CSV Injection vulnerability in ExportToCsvUtf8.php of the Contact Form 7 to Database Extension plugin 2.10.32 for WordPress allows remote attackers to inject s… |
CVE-2018-9034 | Medium | 5.4 | 2018-04-04 | Cross-site scripting (XSS) vulnerability in lib/interface.php of the Relevanssi plugin 4.0.4 for WordPress allows remote attackers to inject arbitrary JavaScri… |
CVE-2018-8719 | Medium | 5.3 | 2018-04-04 | An issue was discovered in the WP Security Audit Log plugin 3.1.1 for WordPress. Access to wp-content/uploads/wp-security-audit-log/* files is not restricted… |
CVE-2018-9275 | High | 8.2 | 2018-04-04 | In check_user_token in util.c in the Yubico PAM module (aka pam_yubico) 2.18 through 2.25, successful logins can leak file descriptors to the auth mapping file… |
CVE-2018-9119 | Medium | 6.1 | 2018-04-04 | An attacker with physical access to a BrilliantTS FUZE card (MCU firmware 0.1.73, BLE firmware 0.7.4) can unlock the card, extract credit card numbers, and tam… |
CVE-2018-1469 | Critical | 9.8 | 2018-04-04 | IBM API Connect Developer Portal 5.0.0.0 through 5.0.8.2 could allow an unauthenticated attacker to execute system commands using specially crafted HTTP reques… |
CVE-2018-1447 | Medium | 5.1 | 2018-04-04 | The GSKit (IBM Spectrum Protect 7.1 and 7.2) and (IBM Spectrum Protect Snapshot 4.1.3, 4.1.4, and 4.1.6) CMS KDB logic fails to salt the hash function resultin… |
CVE-2018-1421 | High | 7.1 | 2018-04-04 | IBM WebSphere DataPower Appliances 7.1, 7.2, 7.5, 7.5.1, 7.5.2, and 7.6 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data… |
CVE-2018-6874 | High | 8.8 | 2018-04-04 | CSRF exists in the Auth0 authentication service through 14591 if the Legacy Lock API flag is enabled. |
CVE-2018-6873 | Critical | 9.8 | 2018-04-04 | The Auth0 authentication service before 2017-10-15 allows privilege escalation because the JWT audience is not validated. |
CVE-2018-0986 | High | 8.8 | 2018-04-04 | A remote code execution vulnerability exists when the Microsoft Malware Protection Engine does not properly scan a specially crafted file, leading to memory co… |
CVE-2018-9249 | Critical | 9.8 | 2018-04-04 | FiberHome VDSL2 Modem HG 150-UB devices allow authentication bypass by ignoring the parent.location='login.html' JavaScript code in the response to an unauthen… |
CVE-2018-9248 | Critical | 9.8 | 2018-04-04 | FiberHome VDSL2 Modem HG 150-UB devices allow authentication bypass via a "Cookie: Name=0admin" header. |
CVE-2018-9205 | High | 7.5 | 2018-04-04 | Vulnerability in avatar_uploader v7.x-1.0-beta8 , The code in view.php doesn't verify users or sanitize the file path. |
CVE-2018-8814 | Medium | 6.5 | 2018-04-04 | Cross-site request forgery (CSRF) vulnerability in WolfCMS 0.8.3.1 allows remote attackers to hijack the authentication of users for requests that modify plugi… |
CVE-2018-8813 | Medium | 4.8 | 2018-04-04 | Open redirect vulnerability in the login[redirect] parameter login functionality in WolfCMS 0.8.3.1 allows remote attackers to redirect users to arbitrary web… |
CVE-2018-6919 | High | 7.5 | 2018-04-04 | In FreeBSD before 11.1-STABLE, 11.1-RELEASE-p9, 10.4-STABLE, 10.4-RELEASE-p8 and 10.3-RELEASE-p28, due to insufficient initialization of memory copied to userl… |
CVE-2018-6918 | High | 7.5 | 2018-04-04 | In FreeBSD before 11.1-STABLE, 11.1-RELEASE-p9, 10.4-STABLE, 10.4-RELEASE-p8 and 10.3-RELEASE-p28, the length field of the ipsec option header does not count t… |
CVE-2018-6917 | High | 7.5 | 2018-04-04 | In FreeBSD before 11.1-STABLE, 11.1-RELEASE-p9, 10.4-STABLE, 10.4-RELEASE-p8 and 10.3-RELEASE-p28, insufficient validation of user-provided font parameters can… |
CVE-2018-9274 | High | 7.5 | 2018-04-04 | In Wireshark 2.4.0 to 2.4.5 and 2.2.0 to 2.2.13, ui/failure_message.c has a memory leak. |
CVE-2018-9273 | High | 7.5 | 2018-04-04 | In Wireshark 2.4.0 to 2.4.5 and 2.2.0 to 2.2.13, epan/dissectors/packet-pcp.c has a memory leak. |
CVE-2018-9272 | High | 7.5 | 2018-04-04 | In Wireshark 2.4.0 to 2.4.5 and 2.2.0 to 2.2.13, epan/dissectors/packet-h223.c has a memory leak. |
CVE-2018-9271 | High | 7.5 | 2018-04-04 | In Wireshark 2.4.0 to 2.4.5 and 2.2.0 to 2.2.13, epan/dissectors/packet-multipart.c has a memory leak. |
CVE-2018-9270 | High | 7.5 | 2018-04-04 | In Wireshark 2.4.0 to 2.4.5 and 2.2.0 to 2.2.13, epan/oids.c has a memory leak. |
CVE-2018-9269 | High | 7.5 | 2018-04-04 | In Wireshark 2.4.0 to 2.4.5 and 2.2.0 to 2.2.13, epan/dissectors/packet-giop.c has a memory leak. |
CVE-2018-9268 | High | 7.5 | 2018-04-04 | In Wireshark 2.4.0 to 2.4.5 and 2.2.0 to 2.2.13, epan/dissectors/packet-smb2.c has a memory leak. |
CVE-2018-9267 | High | 7.5 | 2018-04-04 | In Wireshark 2.4.0 to 2.4.5 and 2.2.0 to 2.2.13, epan/dissectors/packet-lapd.c has a memory leak. |
CVE-2018-9266 | High | 7.5 | 2018-04-04 | In Wireshark 2.4.0 to 2.4.5 and 2.2.0 to 2.2.13, epan/dissectors/packet-isup.c has a memory leak. |
CVE-2018-9265 | High | 7.5 | 2018-04-04 | In Wireshark 2.4.0 to 2.4.5 and 2.2.0 to 2.2.13, epan/dissectors/packet-tn3270.c has a memory leak. |
CVE-2018-9264 | High | 7.5 | 2018-04-04 | In Wireshark 2.4.0 to 2.4.5 and 2.2.0 to 2.2.13, the ADB dissector could crash with a heap-based buffer overflow. This was addressed in epan/dissectors/packet-… |
CVE-2018-9263 | High | 7.5 | 2018-04-04 | In Wireshark 2.4.0 to 2.4.5 and 2.2.0 to 2.2.13, the Kerberos dissector could crash. This was addressed in epan/dissectors/packet-kerberos.c by ensuring a nonz… |
CVE-2018-9262 | High | 7.5 | 2018-04-04 | In Wireshark 2.4.0 to 2.4.5 and 2.2.0 to 2.2.13, the VLAN dissector could crash. This was addressed in epan/dissectors/packet-vlan.c by limiting VLAN tag nesti… |
CVE-2018-9261 | High | 7.5 | 2018-04-04 | In Wireshark 2.4.0 to 2.4.5 and 2.2.0 to 2.2.13, the NBAP dissector could crash with a large loop that ends with a heap-based buffer overflow. This was address… |
CVE-2018-9260 | High | 7.5 | 2018-04-04 | In Wireshark 2.4.0 to 2.4.5 and 2.2.0 to 2.2.13, the IEEE 802.15.4 dissector could crash. This was addressed in epan/dissectors/packet-ieee802154.c by ensuring… |
CVE-2018-9259 | High | 7.5 | 2018-04-04 | In Wireshark 2.4.0 to 2.4.5 and 2.2.0 to 2.2.13, the MP4 dissector could crash. This was addressed in epan/dissectors/file-mp4.c by restricting the box recursi… |
CVE-2018-9258 | High | 7.5 | 2018-04-04 | In Wireshark 2.4.0 to 2.4.5, the TCP dissector could crash. This was addressed in epan/dissectors/packet-tcp.c by preserving valid data sources. |
CVE-2018-9257 | High | 7.5 | 2018-04-04 | In Wireshark 2.4.0 to 2.4.5, the CQL dissector could go into an infinite loop. This was addressed in epan/dissectors/packet-cql.c by checking for a nonzero num… |
CVE-2018-9256 | High | 7.5 | 2018-04-04 | In Wireshark 2.4.0 to 2.4.5 and 2.2.0 to 2.2.13, the LWAPP dissector could crash. This was addressed in epan/dissectors/packet-lwapp.c by limiting the encapsul… |
CVE-2018-9238 | Medium | 6.1 | 2018-04-04 | proberv.php in Yahei-PHP Proberv 0.4.7 has XSS via the funName parameter. |
CVE-2018-9237 | Medium | 5.4 | 2018-04-04 | iScripts EasyCreate 3.2.1 has Stored Cross-Site Scripting in the "Site Description" field. |
CVE-2018-9236 | Medium | 5.4 | 2018-04-04 | iScripts EasyCreate 3.2.1 has Stored Cross-Site Scripting in the "Site title" field. |
CVE-2018-9235 | Medium | 6.1 | 2018-04-04 | iScripts SonicBB 1.0 has Reflected Cross-Site Scripting via the query parameter to search.php. |
CVE-2018-9252 | Medium | 6.5 | 2018-04-04 | JasPer 2.0.14 allows denial of service via a reachable assertion in the function jpc_abstorelstepsize in libjasper/jpc/jpc_enc.c. |
CVE-2018-9251 | Medium | 5.3 | 2018-04-04 | The xz_decomp function in xzlib.c in libxml2 2.9.8, if --with-lzma is used, allows remote attackers to cause a denial of service (infinite loop) via a crafted… |
CVE-2018-9247 | Critical | 9.8 | 2018-04-04 | The upsql function in \Lib\Lib\Action\Admin\DataAction.class.php in Gxlcms QY v1.0.0713 allows remote attackers to execute arbitrary SQL statements via the sql… |
CVE-2018-9234 | High | 7.5 | 2018-04-04 | GnuPG 2.2.4 and 2.2.5 does not enforce a configuration in which key certification requires an offline master Certify key, which results in apparently valid cer… |
CVE-2018-8941 | High | 8.8 | 2018-04-03 | Diagnostics functionality on D-Link DSL-3782 devices with firmware EU v. 1.01 has a buffer overflow, allowing authenticated remote attackers to execute arbitra… |
CVE-2018-9240 | High | 7.5 | 2018-04-03 | ncmpc through 0.29 is prone to a NULL pointer dereference flaw. If a user uses the chat screen and another client sends a long chat message, a crash and denial… |
CVE-2018-8780 | Critical | 9.1 | 2018-04-03 | In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, the Dir.open, Dir.new, Dir.entries and Dir.empty? method… |
CVE-2018-8779 | High | 7.5 | 2018-04-03 | In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, the UNIXServer.open and UNIXSocket.open methods are not… |
CVE-2018-8778 | High | 7.5 | 2018-04-03 | In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, an attacker controlling the unpacking format (similar to… |
CVE-2018-8777 | High | 7.5 | 2018-04-03 | In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, an attacker can pass a large HTTP request with a crafted… |
CVE-2018-8049 | High | 7.5 | 2018-04-03 | The Stealth endpoint in Unisys Stealth SVG 2.8.x, 3.0.x before 3.0.1999, 3.1.x, 3.2.x before 3.2.030, and 3.3.x before 3.3.016, when running on Linux and AIX… |
CVE-2018-6914 | High | 7.5 | 2018-04-03 | Directory traversal vulnerability in the Dir.mktmpdir method in the tmpdir library in Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before… |
CVE-2018-3645 | High | 7.8 | 2018-04-03 | Escalation of privilege in all versions of the Intel Remote Keyboard allows a local attacker to inject keystrokes into another remote keyboard session. |
CVE-2018-3641 | Critical | 9.8 | 2018-04-03 | Escalation of privilege in all versions of the Intel Remote Keyboard allows a network attacker to inject keystrokes as a local user. |
CVE-2018-3638 | High | 7.8 | 2018-04-03 | Escalation of privilege in all versions of the Intel Remote Keyboard allows an authorized local attacker to execute arbitrary code as a privileged user. |
CVE-2018-5828 | High | 7.8 | 2018-04-03 | In Qualcomm Android for MSM, Firefox OS for MSM, and QRD Android with all Android releases from CAF using the Linux kernel before security patch level 2018-04-… |
CVE-2018-5826 | Medium | 5.9 | 2018-04-03 | In Qualcomm Android for MSM, Firefox OS for MSM, and QRD Android with all Android releases from CAF using the Linux kernel before security patch level 2018-04-… |
CVE-2018-5825 | High | 7.8 | 2018-04-03 | In Qualcomm Android for MSM, Firefox OS for MSM, and QRD Android with all Android releases from CAF using the Linux kernel before security patch level 2018-04-… |
CVE-2018-5824 | High | 7.8 | 2018-04-03 | In Qualcomm Android for MSM, Firefox OS for MSM, and QRD Android with all Android releases from CAF using the Linux kernel before security patch level 2018-04-… |
CVE-2018-5823 | High | 7.8 | 2018-04-03 | In Qualcomm Android for MSM, Firefox OS for MSM, and QRD Android with all Android releases from CAF using the Linux kernel before security patch level 2018-04-… |
CVE-2018-5822 | High | 7.3 | 2018-04-03 | In Qualcomm Android for MSM, Firefox OS for MSM, and QRD Android with all Android releases from CAF using the Linux kernel before security patch level 2018-04-… |
CVE-2018-5821 | High | 7.3 | 2018-04-03 | In Qualcomm Android for MSM, Firefox OS for MSM, and QRD Android with all Android releases from CAF using the Linux kernel before security patch level 2018-04-… |
CVE-2018-5820 | High | 7.3 | 2018-04-03 | In Qualcomm Android for MSM, Firefox OS for MSM, and QRD Android with all Android releases from CAF using the Linux kernel before security patch level 2018-04-… |
CVE-2018-3599 | Critical | 9.8 | 2018-04-03 | In Qualcomm Android for MSM, Firefox OS for MSM, and QRD Android with all Android releases from CAF using the Linux kernel before security patch level 2018-04-… |
CVE-2018-3598 | High | 7.5 | 2018-04-03 | In Qualcomm Android for MSM, Firefox OS for MSM, and QRD Android with all Android releases from CAF using the Linux kernel before security patch level 2018-04-… |
CVE-2018-3596 | Critical | 9.8 | 2018-04-03 | In Qualcomm Android for MSM, Firefox OS for MSM, and QRD Android with all Android releases from CAF using the Linux kernel before security patch level 2018-04-… |
CVE-2018-3584 | High | 7.5 | 2018-04-03 | In Qualcomm Android for MSM, Firefox OS for MSM, and QRD Android with all Android releases from CAF using the Linux kernel before security patch level 2018-04-… |
CVE-2018-3566 | High | 7.8 | 2018-04-03 | In Qualcomm Android for MSM, Firefox OS for MSM, and QRD Android with all Android releases from CAF using the Linux kernel before security patch level 2018-04-… |
CVE-2018-3563 | High | 7.8 | 2018-04-03 | In Qualcomm Android for MSM, Firefox OS for MSM, and QRD Android with all Android releases from CAF using the Linux kernel before security patch level 2018-04-… |
CVE-2018-3689 | Medium | 5.5 | 2018-04-03 | AESM daemon in Intel Software Guard Extensions Platform Software Component for Linux before 2.1.102 can effectively be disabled by a local attacker creating a… |
CVE-2018-1099 | Medium | 5.5 | 2018-04-03 | DNS rebinding vulnerability found in etcd 3.3.1 and earlier. An attacker can control his DNS records to direct to localhost, and trick the browser into sending… |
CVE-2018-1098 | High | 8.8 | 2018-04-03 | A cross-site request forgery flaw was found in etcd 3.3.1 and earlier. An attacker can set up a website that tries to send a POST request to the etcd server an… |
CVE-2018-8836 | Medium | 5.3 | 2018-04-03 | Wago 750 Series PLCs with firmware version 10 and prior include a remote attack may take advantage of an improper implementation of the 3 way handshake during… |
CVE-2018-0493 | High | 7.2 | 2018-04-03 | remctld in remctl before 3.14, when an attacker is authorized to execute a command that uses the sudo option, has a use-after-free that leads to a daemon crash… |
CVE-2018-0492 | High | 7.0 | 2018-04-03 | Johnathan Nightingale beep through 1.3.4, if setuid, has a race condition that allows local privilege escalation. |
CVE-2018-4176 | Medium | 5.5 | 2018-04-03 | An issue was discovered in certain Apple products. macOS before 10.13.4 is affected. The issue involves the "Disk Images" component. It allows attackers to tri… |
CVE-2018-4175 | High | 7.8 | 2018-04-03 | An issue was discovered in certain Apple products. macOS before 10.13.4 is affected. The issue involves the "LaunchServices" component. It allows attackers to… |
CVE-2018-4174 | Medium | 5.9 | 2018-04-03 | An issue was discovered in certain Apple products. iOS before 11.3 is affected. macOS before 10.13.4 is affected. The issue involves the "Mail" component. It a… |
CVE-2018-4172 | Medium | 4.6 | 2018-04-03 | An issue was discovered in certain Apple products. iOS before 11.3 is affected. The issue involves the "Find My iPhone" component. It allows physically proxima… |
CVE-2018-4170 | High | 7.8 | 2018-04-03 | An issue was discovered in certain Apple products. macOS before 10.13.4 is affected. The issue involves the "Admin Framework" component. It allows local users… |
CVE-2018-4168 | Medium | 4.6 | 2018-04-03 | An issue was discovered in certain Apple products. iOS before 11.3 is affected. The issue involves the "Files Widget" component. It allows physically proximate… |
CVE-2018-4167 | High | 7.0 | 2018-04-03 | An issue was discovered in certain Apple products. iOS before 11.3 is affected. macOS before 10.13.4 is affected. tvOS before 11.3 is affected. watchOS before… |
CVE-2018-4166 | High | 7.0 | 2018-04-03 | An issue was discovered in certain Apple products. iOS before 11.3 is affected. macOS before 10.13.4 is affected. tvOS before 11.3 is affected. watchOS before… |
CVE-2018-4165 | High | 8.8 | 2018-04-03 | An issue was discovered in certain Apple products. iOS before 11.3 is affected. Safari before 11.1 is affected. iCloud before 7.4 on Windows is affected. iTune… |
CVE-2018-4164 | Critical | 9.8 | 2018-04-03 | An issue was discovered in certain Apple products. Xcode before 9.3 is affected. The issue, which is unspecified, involves the "LLVM" component. |
CVE-2018-4163 | High | 8.8 | 2018-04-03 | An issue was discovered in certain Apple products. iOS before 11.3 is affected. Safari before 11.1 is affected. iCloud before 7.4 on Windows is affected. iTune… |
CVE-2018-4162 | High | 8.8 | 2018-04-03 | An issue was discovered in certain Apple products. iOS before 11.3 is affected. Safari before 11.1 is affected. iCloud before 7.4 on Windows is affected. iTune… |
CVE-2018-4161 | High | 8.8 | 2018-04-03 | An issue was discovered in certain Apple products. iOS before 11.3 is affected. Safari before 11.1 is affected. iCloud before 7.4 on Windows is affected. iTune… |
CVE-2018-4160 | High | 7.8 | 2018-04-03 | An issue was discovered in certain Apple products. macOS before 10.13.4 is affected. The issue involves the "Kernel" component. It allows attackers to execute… |
CVE-2018-4158 | High | 7.0 | 2018-04-03 | An issue was discovered in certain Apple products. iOS before 11.3 is affected. macOS before 10.13.4 is affected. watchOS before 4.3 is affected. The issue inv… |
CVE-2018-4157 | High | 7.0 | 2018-04-03 | An issue was discovered in certain Apple products. iOS before 11.3 is affected. macOS before 10.13.4 is affected. tvOS before 11.3 is affected. watchOS before… |
CVE-2018-4156 | High | 7.0 | 2018-04-03 | An issue was discovered in certain Apple products. iOS before 11.3 is affected. macOS before 10.13.4 is affected. The issue involves the "PluginKit" component… |
CVE-2018-4155 | High | 7.0 | 2018-04-03 | An issue was discovered in certain Apple products. iOS before 11.3 is affected. macOS before 10.13.4 is affected. tvOS before 11.3 is affected. watchOS before… |
CVE-2018-4154 | High | 7.0 | 2018-04-03 | An issue was discovered in certain Apple products. iOS before 11.3 is affected. macOS before 10.13.4 is affected. The issue involves the "Storage" component. A… |
CVE-2018-4152 | High | 7.0 | 2018-04-03 | An issue was discovered in certain Apple products. macOS before 10.13.4 is affected. The issue involves the "Notes" component. A race condition allows attacker… |
CVE-2018-4151 | High | 7.0 | 2018-04-03 | An issue was discovered in certain Apple products. iOS before 11.3 is affected. macOS before 10.13.4 is affected. The issue involves the "iCloud Drive" compone… |
CVE-2018-4150 | High | 7.8 | 2018-04-03 | An issue was discovered in certain Apple products. iOS before 11.3 is affected. macOS before 10.13.4 is affected. tvOS before 11.3 is affected. watchOS before… |