2018 CVEs (page 14)
Page 14 of 162 — CVEs published in 2018, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2018-20914 | High | 7.3 | 2019-08-01 | In cPanel before 70.0.23, OpenID providers can inject arbitrary data into cPanel session files (SEC-368). |
CVE-2018-20913 | Medium | 4.9 | 2019-08-01 | cPanel before 70.0.23 allows attackers to read the root accesshash via the WHM /cgi/trustclustermaster.cgi (SEC-364). |
CVE-2018-20912 | Medium | 6.3 | 2019-08-01 | cPanel before 70.0.23 allows demo accounts to execute code via awstats (SEC-362). |
CVE-2018-20911 | High | 7.2 | 2019-08-01 | cPanel before 70.0.23 allows code execution because "." is in @INC during a Perl syntax check of cpaddonsup (SEC-359). |
CVE-2018-20910 | Medium | 6.1 | 2019-08-01 | cPanel before 70.0.23 allows self XSS in the WHM cPAddons showsecurity Interface (SEC-357). |
CVE-2018-20909 | High | 7.1 | 2019-08-01 | cPanel before 70.0.23 allows arbitrary file-chmod operations during legacy incremental backups (SEC-338). |
CVE-2018-20908 | Medium | 5.5 | 2019-08-01 | cPanel before 71.9980.37 allows arbitrary file-read operations during pkgacct custom template handling (SEC-435). |
CVE-2018-20907 | Medium | 4.3 | 2019-08-01 | cPanel before 71.9980.37 does not enforce the Mime::list_hotlinks API feature restriction (SEC-432). |
CVE-2018-20906 | Medium | 4.3 | 2019-08-01 | cPanel before 71.9980.37 allows attackers to make API calls that bypass the images feature restriction (SEC-430). |
CVE-2018-20905 | Medium | 5.4 | 2019-08-01 | cPanel before 71.9980.37 allows attackers to make API calls that bypass the backup feature restriction (SEC-429). |
CVE-2018-20904 | Medium | 4.3 | 2019-08-01 | cPanel before 71.9980.37 allows attackers to make API calls that bypass the cron feature restriction (SEC-427). |
CVE-2018-20903 | Medium | 6.1 | 2019-08-01 | cPanel before 71.9980.37 allows self XSS in the WHM Backup Configuration interface (SEC-421). |
CVE-2018-20902 | Medium | 5.5 | 2019-08-01 | cPanel before 71.9980.37 allows attackers to read root's crontab file by leveraging ClamAV installation (SEC-408). |
CVE-2018-20901 | Medium | 6.1 | 2019-08-01 | cPanel before 71.9980.37 allows Remote-Stored XSS in WHM Save Theme Interface (SEC-400). |
CVE-2018-20900 | Medium | 6.1 | 2019-08-01 | cPanel before 71.9980.37 allows stored XSS in the YUM autorepair functionality (SEC-399). |
CVE-2018-20899 | Medium | 6.1 | 2019-08-01 | cPanel before 71.9980.37 allows stored XSS in the WHM cPAddons installation interface (SEC-398). |
CVE-2018-20898 | Medium | 4.3 | 2019-08-01 | cPanel before 71.9980.37 allows e-mail injection during cPAddons moderation (SEC-396). |
CVE-2018-20897 | Low | 2.8 | 2019-08-01 | cPanel before 71.9980.37 allows arbitrary file-unlink operations via the cPAddons moderation system (SEC-395). |
CVE-2018-20896 | Low | 3.9 | 2019-08-01 | cPanel before 71.9980.37 allows code injection in the WHM cPAddons interface (SEC-394). |
CVE-2018-20895 | High | 7.2 | 2019-08-01 | In cPanel before 71.9980.37, API tokens retain ACLs after those ACLs are removed from the corresponding accounts (SEC-393). |
CVE-2018-20894 | Low | 3.3 | 2019-08-01 | cPanel before 74.0.0 makes web-site contents accessible to other local users via Git repositories (SEC-443). |
CVE-2018-20893 | Low | 2.3 | 2019-08-01 | cPanel before 74.0.0 allows file-rename operations during account renames (SEC-442). |
CVE-2018-20892 | Medium | 4.3 | 2019-08-01 | cPanel before 74.0.0 allows arbitrary zone file modifications because of incorrect CAA record handling (SEC-439). |
CVE-2018-20891 | Medium | 5.5 | 2019-08-01 | cPanel before 74.0.0 allows arbitrary file-read operations during File Restoration (SEC-436). |
CVE-2018-20890 | Medium | 4.3 | 2019-08-01 | cPanel before 74.0.0 allows arbitrary zone file modifications during record edits (SEC-426). |
CVE-2018-20889 | Medium | 4.4 | 2019-08-01 | cPanel before 74.0.0 allows certain file-read operations via password file caching (SEC-425). |
CVE-2018-20888 | Medium | 5.5 | 2019-08-01 | cPanel before 74.0.0 allows file modification in the context of the root account because of incorrect HTTP authentication (SEC-424). |
CVE-2018-20887 | Critical | 9.8 | 2019-08-01 | cPanel before 74.0.0 allows SQL injection during database backups (SEC-420). |
CVE-2018-20886 | Medium | 5.3 | 2019-08-01 | cPanel before 74.0.0 insecurely stores phpMyAdmin session files (SEC-418). |
CVE-2018-10899 | High | 8.1 | 2019-08-01 | A flaw was found in Jolokia versions from 1.2 to before 1.6.1. Affected versions are vulnerable to a system-wide CSRF. This holds true for properly configured… |
CVE-2018-20885 | Medium | 5.3 | 2019-08-01 | cPanel before 74.0.0 allows Apache HTTP Server configuration injection because of DocumentRoot variable interpolation (SEC-416). |
CVE-2018-20884 | Medium | 5.4 | 2019-08-01 | cPanel before 74.0.0 allows stored XSS in the WHM File Restoration interface (SEC-367). |
CVE-2018-20883 | Medium | 6.5 | 2019-08-01 | cPanel before 74.0.8 allows FTP access during account suspension (SEC-449). |
CVE-2018-20882 | Medium | 6.8 | 2019-08-01 | cPanel before 74.0.8 allows arbitrary file-write operations in the context of the root account during WHM Force Password Change (SEC-447). |
CVE-2018-20881 | Medium | 5.4 | 2019-08-01 | cPanel before 74.0.8 allows self stored XSS on the Security Questions login page (SEC-446). |
CVE-2018-20880 | Low | 3.3 | 2019-08-01 | cPanel before 74.0.8 mishandles account suspension because of an invalid email_accounts.json file (SEC-445). |
CVE-2018-20879 | Medium | 6.3 | 2019-08-01 | cPanel before 74.0.8 allows demo accounts to execute arbitrary code via the Fileman::viewfile API (SEC-444). |
CVE-2018-20878 | Medium | 5.4 | 2019-08-01 | cPanel before 74.0.8 allows stored XSS in WHM "File and Directory Restoration" interface (SEC-441). |
CVE-2018-20877 | Medium | 5.4 | 2019-08-01 | cPanel before 74.0.8 allows self XSS in WHM Style Upload interface (SEC-437). |
CVE-2018-20876 | Medium | 5.4 | 2019-08-01 | cPanel before 74.0.8 allows self XSS in the Site Software Moderation interface (SEC-434). |
CVE-2018-20875 | Medium | 5.4 | 2019-08-01 | cPanel before 74.0.8 allows self XSS in the WHM Security Questions interface (SEC-433). |
CVE-2018-20874 | Medium | 5.4 | 2019-08-01 | cPanel before 74.0.8 allows self XSS in the WHM "Create a New Account" interface (SEC-428). |
CVE-2018-20873 | Low | 3.3 | 2019-08-01 | cPanel before 74.0.8 allows local users to disable the ClamAV daemon (SEC-409). |
CVE-2018-20872 | Medium | 6.5 | 2019-07-31 | DrayTek routers before 2018-05-23 allow CSRF attacks to change DNS or DHCP settings, a related issue to CVE-2017-11649. |
CVE-2018-16860 | High | 7.5 | 2019-07-31 | A flaw was found in samba's Heimdal KDC implementation, versions 4.8.x up to, excluding 4.8.12, 4.9.x up to, excluding 4.9.8 and 4.10.x up to, excluding 4.10.3… |
CVE-2018-20871 | Critical | 9.8 | 2019-07-30 | In Univa Grid Engine before 8.6.3, when configured for Docker jobs and execd spooling on root_squash, weak file permissions ("other" write access) occur in cer… |
CVE-2018-20861 | Medium | 6.5 | 2019-07-30 | libopenmpt before 0.3.11 allows a crash with certain malformed custom tunings in MPTM files. |
CVE-2018-20860 | Medium | 6.5 | 2019-07-30 | libopenmpt before 0.3.13 allows a crash with malformed MED files. |
CVE-2018-20859 | Medium | 6.1 | 2019-07-30 | edx-platform before 2018-07-18 allows XSS via a response to a Chemical Equation advanced problem. |
CVE-2018-16871 | High | 7.5 | 2019-07-30 | A flaw was found in the Linux kernel's NFS implementation, all versions 3.x and all versions 4.x up to 4.20. An attacker, who is able to mount an exported NFS… |
CVE-2018-20870 | Medium | 5.5 | 2019-07-30 | The WebDAV transport feature in cPanel before 76.0.8 enables debug logging (SEC-467). |
CVE-2018-20869 | High | 7.8 | 2019-07-30 | cPanel before 76.0.8 allows arbitrary code execution in the context of the root account via dnssec adminbin (SEC-465). |
CVE-2018-20868 | Medium | 6.1 | 2019-07-30 | cPanel before 76.0.8 has Stored XSS in the WHM MultiPHP Manager interface (SEC-464). |
CVE-2018-20866 | Medium | 6.1 | 2019-07-30 | cPanel before 76.0.8 has Stored XSS in the WHM "Reset a DNS Zone" feature (SEC-461). |
CVE-2018-20865 | Medium | 6.1 | 2019-07-30 | cPanel before 76.0.8 has Self XSS in the WHM Additional Backup Destination field (SEC-459). |
CVE-2018-20864 | Medium | 6.5 | 2019-07-30 | cPanel before 76.0.8 allows a persistent Virtual FTP accounts after removal of its associated domain (SEC-454). |
CVE-2018-20863 | Critical | 9.8 | 2019-07-30 | cPanel before 76.0.8 allows remote attackers to execute arbitrary code via mailing-list attachments (SEC-452). |
CVE-2018-20862 | High | 7.8 | 2019-07-30 | cPanel before 76.0.8 unsafely performs PostgreSQL password changes (SEC-366). |
CVE-2018-20867 | Medium | 6.1 | 2019-07-30 | cPanel before 76.0.8 has an open redirect when resetting connections (SEC-462). |
CVE-2018-18570 | Medium | 6.1 | 2019-07-29 | Planon before Live Build 41 has XSS. |
CVE-2018-11774 | High | 7.2 | 2019-07-29 | Apache VCL versions 2.1 through 2.5 do not properly validate form input when adding and removing VMs to and from hosts. The form data is then used in SQL state… |
CVE-2018-11773 | Critical | 9.8 | 2019-07-29 | Apache VCL versions 2.1 through 2.5 do not properly validate form input when processing a submitted block allocation. The form data is then used as an argument… |
CVE-2018-11772 | High | 7.2 | 2019-07-29 | Apache VCL versions 2.1 through 2.5 do not properly validate cookie input when determining what node (if any) was previously selected in the privilege tree. Th… |
CVE-2018-17213 | High | 8.8 | 2019-07-29 | An issue was discovered in PrinterOn Central Print Services (CPS) through 4.1.4. A user without valid credentials can bypass the authentication process, obtain… |
CVE-2018-17211 | Medium | 5.3 | 2019-07-29 | An issue was discovered in PrinterOn Central Print Services (CPS) through 4.1.4. An unauthenticated attacker can view details about the printers associated wit… |
CVE-2018-20857 | High | 7.5 | 2019-07-26 | Zendesk Samlr before 2.6.2 allows an XML nodes comment attack such as a name_id node with user@example.com followed by <!---->. and then the attacker's domain… |
CVE-2018-20856 | High | 7.8 | 2019-07-26 | An issue was discovered in the Linux kernel before 4.18.7. In block/blk-core.c, there is an __blk_drain_queue() use-after-free because a certain error case is… |
CVE-2018-20855 | Low | 3.3 | 2019-07-26 | An issue was discovered in the Linux kernel before 4.18.7. In create_qp_common in drivers/infiniband/hw/mlx5/qp.c, mlx5_ib_create_qp_resp was never initialized… |
CVE-2018-20854 | High | 7.8 | 2019-07-26 | An issue was discovered in the Linux kernel before 4.20. drivers/phy/mscc/phy-ocelot-serdes.c has an off-by-one error with a resultant ctrl->phys out-of-bounds… |
CVE-2018-11779 | Critical | 9.8 | 2019-07-26 | In Apache Storm versions 1.1.0 to 1.2.2, when the user is using the storm-kafka-client or storm-kafka modules, it is possible to cause the Storm UI daemon to d… |
CVE-2018-13897 | High | 7.5 | 2019-07-25 | Clients hostname gets added to DNS record on device which is running dnsmasq resulting in an information exposure in Snapdragon Auto, Snapdragon Connectivity… |
CVE-2018-3316 | High | 7.6 | 2019-07-23 | Vulnerability in the Oracle Retail Customer Management and Segmentation Foundation component of Oracle Retail Applications (subcomponent: Segment). Supported v… |
CVE-2018-3315 | High | 8.2 | 2019-07-23 | Vulnerability in the Oracle Retail Customer Management and Segmentation Foundation component of Oracle Retail Applications (subcomponent: Customer). Supported… |
CVE-2018-3111 | High | 7.6 | 2019-07-23 | Vulnerability in the Oracle Retail Xstore Office component of Oracle Retail Applications (subcomponent: Internal Operations). The supported version that is aff… |
CVE-2018-2883 | Medium | 5.5 | 2019-07-23 | Vulnerability in the Oracle Retail Xstore Office component of Oracle Retail Applications (subcomponent: Internal Operations). Supported versions that are affec… |
CVE-2018-18676 | Medium | 6.1 | 2019-07-23 | GNUBOARD5 5.3.1.9 has XSS that allows remote attackers to inject arbitrary web script or HTML via the "mobile board tail contents" parameter, aka the adm/board… |
CVE-2018-18675 | Medium | 6.1 | 2019-07-23 | GNUBOARD5 5.3.1.9 has XSS that allows remote attackers to inject arbitrary web script or HTML via the "mobile board title contents" parameter, aka the adm/boar… |
CVE-2018-18672 | Medium | 6.1 | 2019-07-23 | GNUBOARD5 5.3.1.9 has XSS that allows remote attackers to inject arbitrary web script or HTML via the "board head contents" parameter, aka the adm/board_form_u… |
CVE-2018-18670 | Medium | 6.1 | 2019-07-23 | GNUBOARD5 5.3.1.9 has XSS that allows remote attackers to inject arbitrary web script or HTML via the "Extra Contents" parameter, aka the adm/config_form_updat… |
CVE-2018-18673 | Medium | 6.1 | 2019-07-23 | GNUBOARD5 5.3.1.9 has XSS that allows remote attackers to inject arbitrary web script or HTML via the "Menu Link" parameter, aka the adm/menu_list_update.php m… |
CVE-2018-18671 | Medium | 6.1 | 2019-07-23 | GNUBOARD5 5.3.1.9 has XSS that allows remote attackers to inject arbitrary web script or HTML via the "mobile board head contents" parameter, aka the adm/board… |
CVE-2018-18669 | Medium | 6.1 | 2019-07-23 | GNUBOARD5 5.3.1.9 has XSS that allows remote attackers to inject arbitrary web script or HTML via the "board title contents" parameter, aka the adm/board_form_… |
CVE-2018-2024 | High | 8.1 | 2019-07-22 | IBM QRadar SIEM 7.2 and 7.3 specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended acto… |
CVE-2018-13927 | High | 7.8 | 2019-07-22 | Debug policy with invalid signature can be loaded when the debug policy functionality is disabled by using the parallel image loading in Snapdragon Auto, Snapd… |
CVE-2018-13924 | Critical | 9.8 | 2019-07-22 | Lack of check to prevent the buffer length taking negative values can lead to stack overflow. in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Elect… |
CVE-2018-13896 | High | 7.8 | 2019-07-22 | XBL_SEC image authentication and other crypto related validations are accessible to a compromised OEM XBL Loader due to missing lock at XBL_SEC stage.. in Snap… |
CVE-2018-17210 | High | 8.8 | 2019-07-20 | An issue was discovered in PrinterOn Central Print Services (CPS) through 4.1.4. The core components that create and launch a print job do not perform complete… |
CVE-2018-17792 | High | 8.8 | 2019-07-19 | MDaemon Webmail (formerly WorldClient) has CSRF. |
CVE-2018-2022 | Medium | 5.3 | 2019-07-17 | IBM QRadar SIEM 7.2 and 7.3 discloses sensitive information to unauthorized users. The information can be used to mount further attacks on the system. IBM X-Fo… |
CVE-2018-2021 | Medium | 6.1 | 2019-07-17 | IBM QRadar SIEM 7.2 and 7.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus alteri… |
CVE-2018-1921 | Medium | 5.4 | 2019-07-17 | IBM Campaign 9.1.0, 9.1.2, 10.1, and 11.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web… |
CVE-2018-13442 | High | 8.8 | 2019-07-16 | SolarWinds Network Performance Monitor 12.3 allows SQL Injection via the /api/ActiveAlertsOnThisEntity/GetActiveAlerts TriggeringObjectEntityNames parameter. |
CVE-2018-19629 | High | 7.5 | 2019-07-16 | A Denial of Service vulnerability in the ImageNow Server service in Hyland Perceptive Content Server before 7.1.5 allows an attacker to crash the service via a… |
CVE-2018-7838 | High | 7.5 | 2019-07-15 | A CWE-119 Buffer Errors vulnerability exists in Modicon M580 CPU - BMEP582040, all versions before V2.90, and Modicon Ethernet Module BMENOC0301, all versions… |
CVE-2018-20852 | Medium | 5.3 | 2019-07-13 | http.cookiejar.DefaultPolicy.domain_return_ok in Lib/http/cookiejar.py in Python before 3.7.3 does not correctly validate the domain: it can be tricked into se… |
CVE-2018-18095 | Medium | 6.8 | 2019-07-11 | Improper authentication in firmware for Intel(R) SSD DC S4500 Series and Intel(R) SSD DC S4600 Series before SCV10150 may allow an unprivileged user to potenti… |
CVE-2018-17196 | High | 8.8 | 2019-07-11 | In Apache Kafka versions between 0.11.0.0 and 2.1.0, it is possible to manually craft a Produce request which bypasses transaction/idempotent ACL validation. O… |
CVE-2018-1968 | Medium | 5.3 | 2019-07-11 | IBM Security Identity Manager 7.0.1 discloses sensitive information to unauthorized users. The information can be used to mount further attacks on the system… |
CVE-2018-19588 | High | 7.2 | 2019-07-11 | Alarm.com ADC-V522IR 0100b9 devices have Incorrect Access Control. |
CVE-2018-17152 | Medium | 6.4 | 2019-07-11 | Intersystems Cache 2017.2.2.865.0 allows XXE. |