2018 CVEs (page 141)
Page 141 of 162 — CVEs published in 2018, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2018-7566 | High | 7.8 | 2018-03-30 | The Linux kernel 4.15 has a Buffer Overflow via an SNDRV_SEQ_IOCTL_SET_CLIENT_POOL ioctl write operation to /dev/snd/seq by a local user. |
CVE-2018-7203 | Medium | 6.1 | 2018-03-30 | Cross-site scripting (XSS) vulnerability in Twonky Server 7.0.11 through 8.5 allows remote attackers to inject arbitrary web script or HTML via the friendlynam… |
CVE-2018-7171 | High | 7.5 | 2018-03-30 | Directory traversal vulnerability in Twonky Server 7.0.11 through 8.5 allows remote attackers to share the contents of arbitrary directories via a .. (dot dot)… |
CVE-2018-5708 | High | 8.0 | 2018-03-30 | An issue was discovered on D-Link DIR-601 B1 2.02NA devices. Being on the same local network as, but being unauthenticated to, the administrator's panel, a use… |
CVE-2018-1234 | Medium | 5.5 | 2018-03-30 | RSA Authentication Agent version 8.0.1 and earlier for Web for IIS is affected by a problem where access control list (ACL) permissions on a Windows Named Pipe… |
CVE-2018-1233 | Medium | 6.1 | 2018-03-30 | RSA Authentication Agent version 8.0.1 and earlier for Web for both IIS and Apache Web Server are affected by a cross-site scripting vulnerability. The attacke… |
CVE-2018-1232 | High | 7.5 | 2018-03-30 | RSA Authentication Agent version 8.0.1 and earlier for Web for both IIS and Apache Web Server are impacted by a stack-based buffer overflow which may occur whe… |
CVE-2018-3822 | Critical | 9.8 | 2018-03-30 | X-Pack Security versions 6.2.0, 6.2.1, and 6.2.2 are vulnerable to a user impersonation attack via incorrect XML canonicalization and DOM traversal. An attacke… |
CVE-2018-3821 | Medium | 6.1 | 2018-03-30 | Kibana versions after 5.1.1 and before 5.6.7 and 6.1.3 had a cross-site scripting (XSS) vulnerability in the tag cloud visualization that could allow an attack… |
CVE-2018-3820 | Medium | 6.1 | 2018-03-30 | Kibana versions after 6.1.0 and before 6.1.3 had a cross-site scripting (XSS) vulnerability in labs visualizations that could allow an attacker to obtain sensi… |
CVE-2018-3819 | Medium | 6.1 | 2018-03-30 | The fix in Kibana for ESA-2017-23 was incomplete. With X-Pack security enabled, Kibana versions before 6.1.3 and 5.6.7 have an open redirect vulnerability on t… |
CVE-2018-3818 | Medium | 6.1 | 2018-03-30 | Kibana versions 5.1.1 to 6.1.2 and 5.6.6 had a cross-site scripting (XSS) vulnerability via the colored fields formatter that could allow an attacker to obtain… |
CVE-2018-3817 | Medium | 6.5 | 2018-03-30 | When logging warnings regarding deprecated settings, Logstash before 5.6.6 and 6.x before 6.1.2 could inadvertently log sensitive information. |
CVE-2018-9151 | Medium | 5.5 | 2018-03-30 | A NULL pointer dereference bug in the function ObReferenceObjectByHandle in the Kingsoft Internet Security 9+ kernel driver KWatch3.sys allows local non-privil… |
CVE-2018-9148 | Critical | 9.8 | 2018-03-30 | Western Digital WD My Cloud v04.05.00-320 devices embed the session token (aka PHPSESSID) in filenames, which makes it easier for attackers to bypass authentic… |
CVE-2018-3741 | Medium | 6.1 | 2018-03-30 | There is a possible XSS vulnerability in all rails-html-sanitizer gem versions below 1.0.4 for Ruby. The gem allows non-whitelisted attributes to be present in… |
CVE-2018-3740 | High | 7.5 | 2018-03-30 | A specially crafted HTML fragment can cause Sanitize gem for Ruby to allow non-whitelisted attributes to be used on a whitelisted HTML element. |
CVE-2018-3728 | High | 8.8 | 2018-03-30 | hoek node module before 4.2.0 and 5.0.x before 5.0.3 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via 'merge' and 'applyToDefault… |
CVE-2018-9147 | Medium | 6.1 | 2018-03-30 | Cross-site scripting (XSS) vulnerabilities in version 7.5.7 of Gespage software allow remote attackers to inject arbitrary web script or HTML via the email, pa… |
CVE-2018-9134 | High | 8.8 | 2018-03-30 | file_manage_control.php in DedeCMS 5.7 has CSRF in an fmdo=rename action, as demonstrated by renaming an arbitrary file under uploads/userup to a .php file und… |
CVE-2018-1390 | Medium | 5.4 | 2018-03-30 | IBM Financial Transaction Manager for Check Services for Multi-Platform 3.0, 3.0.2, and 3.0.2.1 is vulnerable to cross-site scripting. This vulnerability allow… |
CVE-2018-1384 | Medium | 5.4 | 2018-03-30 | IBM Business Process Manager 8.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus a… |
CVE-2018-5799 | Medium | 6.1 | 2018-03-30 | In Zoho ManageEngine ServiceDesk Plus before 9403, an XSS issue allows an attacker to run arbitrary JavaScript via a /api/request/?OPERATION_NAME= URI, aka SD-… |
CVE-2018-9145 | Medium | 6.5 | 2018-03-30 | In the DataBuf class in include/exiv2/types.hpp in Exiv2 0.26, an issue exists in the constructor with an initial buffer size. A large size value may lead to a… |
CVE-2018-9144 | High | 8.1 | 2018-03-30 | In Exiv2 0.26, there is an out-of-bounds read in Exiv2::Internal::binaryToString in image.cpp. It could result in denial of service or information disclosure. |
CVE-2018-9143 | Critical | 9.8 | 2018-03-30 | On Samsung mobile devices with M(6.0) and N(7.x) software, a heap overflow in the sensorhub binder service leads to code execution in a privileged process, aka… |
CVE-2018-9142 | High | 7.0 | 2018-03-30 | On Samsung mobile devices with N(7.x) software, attackers can install an arbitrary APK in the Secure Folder SD Card area because of faulty validation of a pack… |
CVE-2018-9141 | High | 7.8 | 2018-03-30 | On Samsung mobile devices with L(5.x), M(6.0), and N(7.x) software, Gallery allows remote attackers to execute arbitrary code via a BMP file with a crafted res… |
CVE-2018-9140 | Medium | 6.1 | 2018-03-30 | On Samsung mobile devices with M(6.0) software, the Email application allows XSS via an event attribute and arbitrary file loading via a src attribute, aka SVE… |
CVE-2018-9139 | Critical | 9.8 | 2018-03-30 | On Samsung mobile devices with N(7.x) software, a buffer overflow in the vision service allows code execution in a privileged process via a large frame size, a… |
CVE-2018-9138 | Medium | 5.5 | 2018-03-30 | An issue was discovered in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.29 and 2.30. Stack Exhaustion occurs in the C++ demangling functions… |
CVE-2018-9136 | Medium | 5.5 | 2018-03-30 | windrvr1260.sys in Jungo DriverWizard WinDriver 12.6.0 allows attackers to cause a denial of service (BSOD) via a crafted .exe file, a different vulnerability… |
CVE-2018-9135 | High | 8.8 | 2018-03-30 | In ImageMagick 7.0.7-24 Q16, there is a heap-based buffer over-read in IsWEBPImageLossless in coders/webp.c. |
CVE-2018-9133 | Medium | 6.5 | 2018-03-30 | ImageMagick 7.0.7-26 Q16 has excessive iteration in the DecodeLabImage and EncodeLabImage functions (coders/tiff.c), which results in a hang (tens of minutes)… |
CVE-2018-9132 | Medium | 6.5 | 2018-03-30 | libming 0.4.8 has a NULL pointer dereference in the getInt function of the decompile.c file. Remote attackers could leverage this vulnerability to cause a deni… |
CVE-2018-9130 | Medium | 6.1 | 2018-03-30 | IBOS 4.4.3 has XSS via a company full name. |
CVE-2018-1191 | High | 8.8 | 2018-03-29 | Cloud Foundry Garden-runC, versions prior to 1.11.0, contains an information exposure vulnerability. A user with access to Garden logs may be able to obtain le… |
CVE-2018-9031 | Critical | 9.8 | 2018-03-29 | The login interface on TNLSoftSolutions Sentry Vision 3.x devices provides password disclosure by reading an "if(pwd ==" line in the HTML source code. This mea… |
CVE-2018-6588 | Medium | 6.1 | 2018-03-29 | CA API Developer Portal 3.5 up to and including 3.5 CR5 has a reflected cross-site scripting vulnerability related to the apiExplorer. |
CVE-2018-6587 | Medium | 6.1 | 2018-03-29 | CA API Developer Portal 3.5 up to and including 3.5 CR6 has a reflected cross-site scripting vulnerability related to the widgetID variable. |
CVE-2018-6586 | Medium | 6.1 | 2018-03-29 | CA API Developer Portal 3.5 up to and including 3.5 CR6 has a stored cross-site scripting vulnerability related to profile picture processing. |
CVE-2018-5224 | High | 8.8 | 2018-03-29 | Bamboo did not correctly check if a configured Mercurial repository URI contained values that the Windows operating system may consider argument parameters. An… |
CVE-2018-5223 | High | 7.2 | 2018-03-29 | Fisheye and Crucible did not correctly check if a configured Mercurial repository URI contained values that the Windows operating system may consider argument… |
CVE-2018-4841 | Critical | 9.8 | 2018-03-29 | A vulnerability has been identified in TIM 1531 IRC (All versions < V1.1). A remote attacker with network access to port 80/tcp or port 443/tcp could perform a… |
CVE-2018-9117 | Medium | 5.3 | 2018-03-29 | WireMock before 2.16.0 contains a vulnerability that allows a remote unauthenticated attacker to access local files beyond the application directory via a spec… |
CVE-2018-9116 | Critical | 9.1 | 2018-03-29 | An XXE vulnerability within WireMock before 2.16.0 allows a remote unauthenticated attacker to access local files and internal resources and potentially cause… |
CVE-2018-7600 | Critical | 9.8 | 2018-03-29 | Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbitrary code because of an issue affectin… |
CVE-2018-9123 | Medium | 5.4 | 2018-03-29 | In Crea8social 2018.2, there is Stored Cross-Site Scripting via a User Profile. |
CVE-2018-9122 | Medium | 5.4 | 2018-03-29 | In Crea8social 2018.2, there is Reflected Cross-Site Scripting via the term parameter to the /search URI. |
CVE-2018-9121 | Medium | 5.4 | 2018-03-29 | In Crea8social 2018.2, there is Stored Cross-Site Scripting via a post comment. |
CVE-2018-9120 | Medium | 5.4 | 2018-03-29 | In Crea8social 2018.2, there is Stored Cross-Site Scripting via a post. |
CVE-2018-0196 | Medium | 4.9 | 2018-03-28 | A vulnerability in the web-based user interface (web UI) of Cisco IOS XE Software could allow an authenticated, remote attacker to write arbitrary files to the… |
CVE-2018-0195 | High | 8.8 | 2018-03-28 | A vulnerability in the Cisco IOS XE Software REST API could allow an authenticated, remote attacker to bypass API authorization checks and use the API to perfo… |
CVE-2018-0193 | High | 7.8 | 2018-03-28 | Multiple vulnerabilities in the CLI parser of Cisco IOS XE Software could allow an authenticated, local attacker to inject arbitrary commands into the CLI of t… |
CVE-2018-0190 | Medium | 6.1 | 2018-03-28 | Multiple vulnerabilities in the web-based user interface (web UI) of Cisco IOS XE Software could allow an unauthenticated, remote attacker to conduct a cross-s… |
CVE-2018-0189 | Medium | 5.3 | 2018-03-28 | A vulnerability in the Forwarding Information Base (FIB) code of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, network attacker… |
CVE-2018-0188 | Medium | 6.1 | 2018-03-28 | Multiple vulnerabilities in the web-based user interface (web UI) of Cisco IOS XE Software could allow an unauthenticated, remote attacker to conduct a cross-s… |
CVE-2018-0186 | Medium | 6.1 | 2018-03-28 | Multiple vulnerabilities in the web-based user interface (web UI) of Cisco IOS XE Software could allow an unauthenticated, remote attacker to conduct a cross-s… |
CVE-2018-0185 | High | 7.8 | 2018-03-28 | Multiple vulnerabilities in the CLI parser of Cisco IOS XE Software could allow an authenticated, local attacker to inject arbitrary commands into the CLI of t… |
CVE-2018-0184 | Medium | 6.7 | 2018-03-28 | A vulnerability in the CLI parser of Cisco IOS XE Software could allow an authenticated, local attacker to gain access to the underlying Linux shell of an affe… |
CVE-2018-0183 | Medium | 6.7 | 2018-03-28 | A vulnerability in the CLI parser of Cisco IOS XE Software could allow an authenticated, local attacker to gain access to the underlying Linux shell of an affe… |
CVE-2018-0182 | High | 7.8 | 2018-03-28 | Multiple vulnerabilities in the CLI parser of Cisco IOS XE Software could allow an authenticated, local attacker to inject arbitrary commands into the CLI of t… |
CVE-2018-0180 | Medium | 5.9 | 2018-03-28 | Multiple vulnerabilities in the Login Enhancements (Login Block) feature of Cisco IOS Software could allow an unauthenticated, remote attacker to trigger a rel… |
CVE-2018-0179 | Medium | 5.9 | 2018-03-28 | Multiple vulnerabilities in the Login Enhancements (Login Block) feature of Cisco IOS Software could allow an unauthenticated, remote attacker to trigger a rel… |
CVE-2018-0177 | High | 7.5 | 2018-03-28 | A vulnerability in the IP Version 4 (IPv4) processing code of Cisco IOS XE Software running on Cisco Catalyst 3850 and Cisco Catalyst 3650 Series Switches coul… |
CVE-2018-0176 | High | 7.8 | 2018-03-28 | Multiple vulnerabilities in the CLI parser of Cisco IOS XE Software could allow an authenticated, local attacker to gain access to the underlying Linux shell o… |
CVE-2018-0175 | High | 8.0 | 2018-03-28 | Format String vulnerability in the Link Layer Discovery Protocol (LLDP) subsystem of Cisco IOS Software, Cisco IOS XE Software, and Cisco IOS XR Software could… |
CVE-2018-0174 | High | 8.6 | 2018-03-28 | A vulnerability in the DHCP option 82 encapsulation functionality of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attack… |
CVE-2018-0173 | High | 8.6 | 2018-03-28 | A vulnerability in the Cisco IOS Software and Cisco IOS XE Software function that restores encapsulated option 82 information in DHCP Version 4 (DHCPv4) packet… |
CVE-2018-0172 | High | 8.6 | 2018-03-28 | A vulnerability in the DHCP option 82 encapsulation functionality of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attack… |
CVE-2018-0171 | Critical | 9.8 | 2018-03-28 | A vulnerability in the Smart Install feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to trigger a reloa… |
CVE-2018-0170 | High | 7.5 | 2018-03-28 | A vulnerability in the Cisco Umbrella Integration feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a denial of service… |
CVE-2018-0169 | High | 7.8 | 2018-03-28 | Multiple vulnerabilities in the CLI parser of Cisco IOS XE Software could allow an authenticated, local attacker to gain access to the underlying Linux shell o… |
CVE-2018-0167 | High | 8.8 | 2018-03-28 | Multiple Buffer Overflow vulnerabilities in the Link Layer Discovery Protocol (LLDP) subsystem of Cisco IOS Software, Cisco IOS XE Software, and Cisco IOS XR S… |
CVE-2018-0165 | High | 7.4 | 2018-03-28 | A vulnerability in the Internet Group Management Protocol (IGMP) packet-processing functionality of Cisco IOS XE Software could allow an unauthenticated, adjac… |
CVE-2018-0164 | High | 8.6 | 2018-03-28 | A vulnerability in the Switch Integrated Security Features of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an interface queue… |
CVE-2018-0163 | Medium | 6.5 | 2018-03-28 | A vulnerability in the 802.1x multiple-authentication (multi-auth) feature of Cisco IOS Software could allow an unauthenticated, adjacent attacker to bypass th… |
CVE-2018-0161 | Medium | 6.3 | 2018-03-28 | A vulnerability in the Simple Network Management Protocol (SNMP) subsystem of Cisco IOS Software running on certain models of Cisco Catalyst Switches could all… |
CVE-2018-0160 | Medium | 6.3 | 2018-03-28 | A vulnerability in Simple Network Management Protocol (SNMP) subsystem of Cisco IOS XE Software could allow an authenticated, remote attacker to cause a denial… |
CVE-2018-0159 | High | 7.5 | 2018-03-28 | A vulnerability in the implementation of Internet Key Exchange Version 1 (IKEv1) functionality in Cisco IOS Software and Cisco IOS XE Software could allow an u… |
CVE-2018-0158 | High | 8.6 | 2018-03-28 | A vulnerability in the Internet Key Exchange Version 2 (IKEv2) module of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote at… |
CVE-2018-0157 | High | 8.6 | 2018-03-28 | A vulnerability in the Zone-Based Firewall code of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a device to reload. The vulne… |
CVE-2018-0156 | High | 7.5 | 2018-03-28 | A vulnerability in the Smart Install feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to trigger a reloa… |
CVE-2018-0155 | High | 8.6 | 2018-03-28 | A vulnerability in the Bidirectional Forwarding Detection (BFD) offload implementation of Cisco Catalyst 4500 Series Switches and Cisco Catalyst 4500-X Series… |
CVE-2018-0154 | High | 7.5 | 2018-03-28 | A vulnerability in the crypto engine of the Cisco Integrated Services Module for VPN (ISM-VPN) running Cisco IOS Software could allow an unauthenticated, remot… |
CVE-2018-0152 | High | 8.8 | 2018-03-28 | A vulnerability in the web-based user interface (web UI) of Cisco IOS XE Software could allow an authenticated, remote attacker to gain elevated privileges on… |
CVE-2018-0151 | Critical | 9.8 | 2018-03-28 | A vulnerability in the quality of service (QoS) subsystem of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to ca… |
CVE-2018-0150 | Critical | 9.8 | 2018-03-28 | A vulnerability in Cisco IOS XE Software could allow an unauthenticated, remote attacker to log in to a device running an affected release of Cisco IOS XE Soft… |
CVE-2018-6608 | Medium | 4.3 | 2018-03-28 | In the WebRTC component in Opera 51.0.2830.55, after visiting a web site that attempts to gather complete client information (such as https://ip.voidsec.com)… |
CVE-2018-8885 | High | 7.0 | 2018-03-28 | screenresolution-mechanism in screen-resolution-extra 0.17.2 does not properly use the PolicyKit D-Bus API, which allows local users to bypass intended access… |
CVE-2018-8820 | High | 7.5 | 2018-03-28 | An issue was discovered in Square 9 GlobalForms 6.2.x. A Time Based SQL injection vulnerability in the "match" parameter allows remote authenticated attackers… |
CVE-2018-1064 | High | 7.5 | 2018-03-28 | libvirt version before 4.2.0-rc1 is vulnerable to a resource exhaustion as a result of an incomplete fix for CVE-2018-5748 that affects QEMU monitor but now al… |
CVE-2018-7498 | Critical | 9.8 | 2018-03-28 | In Philips Alice 6 System version R8.0.2 or prior, the lack of proper data encryption passes up the guarantees of confidentiality, integrity, and accountabilit… |
CVE-2018-5451 | Critical | 9.8 | 2018-03-28 | In Philips Alice 6 System version R8.0.2 or prior, when an actor claims to have a given identity, the software does not prove or insufficiently proves that the… |
CVE-2018-9110 | Critical | 9.1 | 2018-03-28 | Studio 42 elFinder before 2.1.37 has a directory traversal vulnerability in elFinder.class.php with the zipdl() function that can allow a remote attacker to do… |
CVE-2018-7676 | Low | 3.9 | 2018-03-28 | The NetIQ Identity Manager, in versions prior to 4.7, userapp with log / trace enabled may leak sensitive information. |
CVE-2018-7674 | Low | 2.1 | 2018-03-28 | The NetIQ Identity Manager user console, in versions prior to 4.7, is susceptible to URL redirection. |
CVE-2018-1142 | Medium | 5.4 | 2018-03-28 | Tenable Appliance versions 4.6.1 and earlier have been found to contain a single XSS vulnerability. Utilizing a specially crafted request, an authenticated att… |
CVE-2018-1083 | High | 7.8 | 2018-03-28 | Zsh before version 5.4.2-test-1 is vulnerable to a buffer overflow in the shell autocomplete functionality. A local unprivileged user can create a specially cr… |
CVE-2018-9109 | Critical | 9.1 | 2018-03-28 | Studio 42 elFinder before 2.1.36 has a directory traversal vulnerability in elFinder.class.php with the zipdl() function that can allow a remote attacker to do… |