2018 CVEs (page 145)
Page 145 of 162 — CVEs published in 2018, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2018-8729 | Medium | 6.1 | 2018-03-15 | Multiple cross-site scripting (XSS) vulnerabilities in the Activity Log plugin before 2.4.1 for WordPress allow remote attackers to inject arbitrary JavaScript… |
CVE-2018-8728 | Medium | 6.1 | 2018-03-15 | server/app/views/static/code.html in Kontena before 1.5.0 allows XSS in "kontena master login --remote" code display, as demonstrated by /code#code= in a URI. |
CVE-2018-8720 | Medium | 5.4 | 2018-03-15 | ServiceNow ITSM 2016-06-02 has XSS via the First Name or Last Name field of My Profile (aka navpage.do), or the Search bar of My Portal (aka search_results.do). |
CVE-2018-8722 | Medium | 6.1 | 2018-03-15 | Zoho ManageEngine Desktop Central version 9.1.0 build 91099 has multiple XSS issues that were fixed in build 92026. |
CVE-2018-8721 | Medium | 6.1 | 2018-03-15 | Zoho ManageEngine EventLog Analyzer version 11.0 build 11000 has Stored XSS related to the index2.do?url=editAlertForm&tab=alert&alert=profile URI and the Edit… |
CVE-2018-8076 | High | 7.5 | 2018-03-15 | ZenMate 1.5.4 for macOS suffers from a type confusion vulnerability within the com.zenmate.chron-xpc LaunchDaemon component. The LaunchDaemon implements an XPC… |
CVE-2018-7886 | High | 7.8 | 2018-03-15 | An issue was discovered in CloudMe 1.11.0. An unauthenticated local attacker that can connect to the "CloudMe Sync" client application listening on 127.0.0.1 p… |
CVE-2018-8717 | High | 8.8 | 2018-03-15 | joyplus-cms 1.6.0 has CSRF, as demonstrated by adding an administrator account via a manager/admin_ajax.php?action=save&tab={pre}manager request. |
CVE-2018-8715 | High | 8.1 | 2018-03-15 | The Embedthis HTTP library, and Appweb versions before 7.0.3, have a logic flaw related to the authCondition function in http/httpLib.c. With a forged HTTP req… |
CVE-2018-8045 | High | 8.8 | 2018-03-15 | In Joomla! 3.5.0 through 3.8.5, the lack of type casting of a variable in a SQL statement leads to a SQL injection vulnerability in the User Notes list view. |
CVE-2018-7756 | Critical | 9.8 | 2018-03-15 | RunExeFile.exe in the installer for DEWESoft X3 SP1 (64-bit) devices does not require authentication for sessions on TCP port 1999, which allows remote attacke… |
CVE-2018-7707 | Medium | 6.1 | 2018-03-15 | Cross-site scripting (XSS) vulnerability in SecurEnvoy SecurMail before 9.2.501 allows remote attackers to inject arbitrary web script or HTML via an HTML-form… |
CVE-2018-7706 | Medium | 6.5 | 2018-03-15 | Directory traversal vulnerability in SecurEnvoy SecurMail before 9.2.501 allows remote authenticated users to read arbitrary e-mail messages via a .. (dot dot)… |
CVE-2018-7705 | High | 8.1 | 2018-03-15 | Directory traversal vulnerability in SecurEnvoy SecurMail before 9.2.501 allows remote authenticated users to read e-mail messages to arbitrary recipients via… |
CVE-2018-7704 | Medium | 6.5 | 2018-03-15 | SecurEnvoy SecurMail before 9.2.501 allows remote authenticated users to read arbitrary e-mail messages via the option1 parameter in a reply action to secmail/… |
CVE-2018-7703 | Medium | 6.1 | 2018-03-15 | Cross-site scripting (XSS) vulnerability in SecurEnvoy SecurMail before 9.2.501 allows remote attackers to inject arbitrary web script or HTML via the mailboxi… |
CVE-2018-7702 | Critical | 9.1 | 2018-03-15 | SecurEnvoy SecurMail before 9.2.501 allows remote attackers to spoof transmission of arbitrary e-mail messages, resend e-mail messages to arbitrary recipients… |
CVE-2018-7701 | Medium | 6.5 | 2018-03-15 | Multiple cross-site request forgery (CSRF) vulnerabilities in SecurEnvoy SecurMail before 9.2.501 allow remote attackers to hijack the authentication of arbitr… |
CVE-2018-8712 | Critical | 9.8 | 2018-03-14 | An issue was discovered in Webmin 1.840 and 1.880 when the default Yes setting of "Can view any file as a log file" is enabled. As a result of weak default con… |
CVE-2018-8711 | Critical | 9.8 | 2018-03-14 | A local file inclusion issue was discovered in the WooCommerce Products Filter (aka WOOF) plugin before 2.2.0 for WordPress, as demonstrated by the shortcode p… |
CVE-2018-8710 | Critical | 9.8 | 2018-03-14 | A remote code execution issue was discovered in the WooCommerce Products Filter (aka WOOF) plugin before 2.2.0 for WordPress, as demonstrated by the shortcode… |
CVE-2018-6329 | Critical | 9.8 | 2018-03-14 | It was discovered that the Unitrends Backup (UB) before 10.1.0 libbpext.so authentication could be bypassed with a SQL injection, allowing a remote attacker to… |
CVE-2018-6328 | Critical | 9.8 | 2018-03-14 | It was discovered that the Unitrends Backup (UB) before 10.1.0 user interface was exposed to an authentication bypass, which then could allow an unauthenticate… |
CVE-2018-2402 | High | 7.6 | 2018-03-14 | In systems using the optional capture & replay functionality of SAP HANA, 1.00 and 2.00, (see SAP Note 2362820 for more information about capture & replay), us… |
CVE-2018-2401 | Medium | 5.4 | 2018-03-14 | SAP Business Process Automation (BPA) By Redwood does not sufficiently validate an XML document accepted from an untrusted source resulting in an XML External… |
CVE-2018-2400 | High | 7.5 | 2018-03-14 | Under certain conditions SAP Business Process Automation (BPA) By Redwood, 9.00, 9.10, allows an attacker to access information which would otherwise be restri… |
CVE-2018-2399 | Medium | 6.1 | 2018-03-14 | Cross-Site Scripting in Process Monitoring Infrastructure, from 7.10 to 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, due to inefficient encoding of user controlled inpu… |
CVE-2018-2398 | High | 7.5 | 2018-03-14 | Under certain conditions SAP Business Client 6.5 allows an attacker to access information which would otherwise be restricted. |
CVE-2018-2397 | Medium | 5.4 | 2018-03-14 | In SAP Business Objects Business Intelligence Platform, 4.00, 4.10, 4.20, 4.30, the Central Management Console (CMC) does not sufficiently encode user controll… |
CVE-2018-2366 | Medium | 4.3 | 2018-03-14 | SAP Business Process Automation (BPA) By Redwood, 9.0, 9.1, allows an attacker to exploit insufficient validation of path information provided by users, thus c… |
CVE-2018-7533 | High | 7.8 | 2018-03-14 | An Incorrect Default Permissions issue was discovered in OSIsoft PI Data Archive versions 2017 and prior. Insecure default configuration may allow escalation o… |
CVE-2018-7531 | Medium | 5.9 | 2018-03-14 | An Improper Input Validation issue was discovered in OSIsoft PI Data Archive versions 2017 and prior. Unauthenticated users may use unvalidated custom requests… |
CVE-2018-7529 | High | 7.5 | 2018-03-14 | A Deserialization of Untrusted Data issue was discovered in OSIsoft PI Data Archive versions 2017 and prior. Unauthenticated users may modify deserialized data… |
CVE-2018-7508 | Medium | 6.1 | 2018-03-14 | A Cross-site Scripting issue was discovered in OSIsoft PI Web API versions 2017 R2 and prior. Cross-site scripting may occur when input is incorrectly neutrali… |
CVE-2018-7504 | Medium | 6.1 | 2018-03-14 | A Protection Mechanism Failure issue was discovered in OSIsoft PI Vision versions 2017 and prior. The X-XSS-Protection response header is not set to block, all… |
CVE-2018-7500 | Critical | 9.8 | 2018-03-14 | A Permissions, Privileges, and Access Controls issue was discovered in OSIsoft PI Web API versions 2017 R2 and prior. Privileges may be escalated, giving attac… |
CVE-2018-7496 | Medium | 5.3 | 2018-03-14 | An Information Exposure issue was discovered in OSIsoft PI Vision versions 2017 and prior. The server response header and referrer-policy response header each… |
CVE-2018-1077 | High | 7.5 | 2018-03-14 | Spacewalk 2.6 contains an API which has an XXE flaw allowing for the disclosure of potentially sensitive information from the server. |
CVE-2018-1000122 | Critical | 9.1 | 2018-03-14 | A buffer over-read exists in curl 7.20.0 to and including curl 7.58.0 in the RTSP+RTP handling code that allows an attacker to cause a denial of service or inf… |
CVE-2018-1000121 | High | 7.5 | 2018-03-14 | A NULL pointer dereference exists in curl 7.21.0 to and including curl 7.58.0 in the LDAP code that allows an attacker to cause a denial of service |
CVE-2018-1000120 | Critical | 9.8 | 2018-03-14 | A buffer overflow exists in curl 7.12.3 to and including curl 7.58.0 in the FTP URL handling that allows an attacker to cause a denial of service or worse. |
CVE-2018-0983 | High | 7.0 | 2018-03-14 | Windows Storage Services in Windows 10 versions 1511, 1607, 1703 and 1709, Windows Server 2016 and Windows Server, version 1709 allows an elevation of privileg… |
CVE-2018-0977 | High | 7.0 | 2018-03-14 | The Windows kernel mode driver in Windows 10 Gold, 1511, 1607, 1703, and 1709, Windows Server 2016 and Windows Server, version 1709 allows an elevation of priv… |
CVE-2018-0947 | High | 8.8 | 2018-03-14 | Microsoft SharePoint Foundation 2013 SP1 and Microsoft SharePoint Enterprise Server 2016 allow an elevation of privilege vulnerability to due how specially cra… |
CVE-2018-0944 | High | 8.8 | 2018-03-14 | Microsoft Project Server 2013 SP1 and Microsoft SharePoint Enterprise Server 2016 allows an elevation of privilege vulnerability to due how specially crafted w… |
CVE-2018-0942 | Low | 2.6 | 2018-03-14 | Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold… |
CVE-2018-0941 | Medium | 5.5 | 2018-03-14 | Microsoft Exchange Server 2016 Cumulative Update 7 and Microsoft Exchange Server 2016 Cumulative Update 8 allow an information disclosure vulnerability due to… |
CVE-2018-0940 | Medium | 6.5 | 2018-03-14 | Microsoft Exchange Outlook Web Access (OWA) in Microsoft Exchange Server 2010 Service Pack 3 Update Rollup 20, Microsoft Exchange Server 2013 Cumulative Update… |
CVE-2018-0939 | Medium | 4.3 | 2018-03-14 | ChakraCore and Microsoft Edge in Windows 10 1703 and 1709 allow information disclosure, due to how the scripting engine handles objects in memory, aka "Scripti… |
CVE-2018-0937 | High | 7.5 | 2018-03-14 | ChakraCore and Microsoft Windows 10 1703 and 1709 allow remote code execution, due to how the Chakra scripting engine handles objects in memory, aka "Chakra Sc… |
CVE-2018-0936 | High | 7.5 | 2018-03-14 | ChakraCore and Microsoft Windows 10 1709 allow remote code execution, due to how the Chakra scripting engine handles objects in memory, aka "Chakra Scripting E… |
CVE-2018-0935 | High | 7.5 | 2018-03-14 | Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511… |
CVE-2018-0934 | High | 7.5 | 2018-03-14 | ChakraCore and Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows remote code execution, due to how the Chakra scripting engine… |
CVE-2018-0933 | High | 7.5 | 2018-03-14 | ChakraCore and Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows remote code execution, due to how the Chakra scripting engine… |
CVE-2018-0932 | Medium | 4.3 | 2018-03-14 | Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, and Microsoft Edge and In… |
CVE-2018-0931 | High | 7.5 | 2018-03-14 | ChakraCore and Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows remote code execution, due to how the Chakra scripting engine… |
CVE-2018-0930 | High | 7.5 | 2018-03-14 | ChakraCore and Microsoft Edge in Microsoft Windows 10 1709 allows remote code execution, due to how the Chakra scripting engine handles objects in memory, aka… |
CVE-2018-0929 | Medium | 4.3 | 2018-03-14 | Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold… |
CVE-2018-0927 | Medium | 4.3 | 2018-03-14 | Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, and Microsoft Edge and In… |
CVE-2018-0926 | Medium | 5.5 | 2018-03-14 | The Windows kernel in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1… |
CVE-2018-0925 | High | 7.5 | 2018-03-14 | ChakraCore allows remote code execution, due to how the ChakraCore scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerab… |
CVE-2018-0924 | Medium | 6.5 | 2018-03-14 | Microsoft Exchange Server 2010 Service Pack 3 Update Rollup 20, Microsoft Exchange Server 2013 Cumulative Update 18, Microsoft Exchange Server 2013 Cumulative… |
CVE-2018-0923 | High | 8.8 | 2018-03-14 | Microsoft SharePoint Enterprise Server 2016 allows an elevation of privilege vulnerability to due how specially crafted web requests are sanitized, aka "Micros… |
CVE-2018-0922 | High | 7.8 | 2018-03-14 | Microsoft Office 2010 SP2, 2013 SP1, and 2016, Microsoft Office 2016 Click-to-Run Microsoft Office 2016 for Mac, Microsoft Office Compatibility Pack SP2, Micro… |
CVE-2018-0921 | High | 8.8 | 2018-03-14 | Microsoft SharePoint Enterprise Server 2016 allows an elevation of privilege vulnerability to due how specially crafted web requests are sanitized, aka "Micros… |
CVE-2018-0919 | Low | 3.3 | 2018-03-14 | Microsoft Office 2010 SP2, 2013 SP1, and 2016, Microsoft Office 2016 Click-to-Run Microsoft Office 2016 for Mac, Microsoft Office Web Apps 2010 SP2, Microsoft… |
CVE-2018-0917 | High | 8.8 | 2018-03-14 | Microsoft SharePoint Enterprise Server 2016 allows an elevation of privilege vulnerability to due how specially crafted web requests are sanitized, aka "Micros… |
CVE-2018-0916 | High | 8.8 | 2018-03-14 | Microsoft Project Server 2013 SP1 and Microsoft SharePoint Enterprise Server 2016 allow an elevation of privilege vulnerability to due how specially crafted we… |
CVE-2018-0915 | High | 8.8 | 2018-03-14 | Microsoft Project Server 2013 SP1 and Microsoft SharePoint Enterprise Server 2016 allow an elevation of privilege vulnerability to due how specially crafted we… |
CVE-2018-0914 | High | 8.8 | 2018-03-14 | Microsoft Project Server 2013 SP1 and Microsoft SharePoint Enterprise Server 2016 allow an elevation of privilege vulnerability to due how specially crafted we… |
CVE-2018-0913 | High | 8.8 | 2018-03-14 | Microsoft Project Server 2013 SP1 and Microsoft SharePoint Enterprise Server 2016 allow an elevation of privilege vulnerability to due how specially crafted we… |
CVE-2018-0912 | High | 8.8 | 2018-03-14 | Microsoft Project Server 2013 SP1 and Microsoft SharePoint Enterprise Server 2016 allow an elevation of privilege vulnerability to due how specially crafted we… |
CVE-2018-0911 | High | 8.8 | 2018-03-14 | Microsoft Project Server 2013 SP1 and Microsoft SharePoint Enterprise Server 2016 allow an elevation of privilege vulnerability to due how specially crafted we… |
CVE-2018-0910 | High | 8.8 | 2018-03-14 | Microsoft Project Server 2013 SP1 and Microsoft SharePoint Enterprise Server 2016 allow an elevation of privilege vulnerability to due how specially crafted we… |
CVE-2018-0909 | High | 8.8 | 2018-03-14 | Microsoft Project Server 2013 SP1 and Microsoft SharePoint Enterprise Server 2016 allow an elevation of privilege vulnerability to due how specially crafted we… |
CVE-2018-0907 | High | 7.8 | 2018-03-14 | Microsoft Excel 2007 SP3, Microsoft Excel 2010 SP2, Microsoft Excel 2013 SP1, Microsoft Excel 2016, Microsoft Office 2016 Click-to-Run and Microsoft Office 201… |
CVE-2018-0904 | Medium | 4.7 | 2018-03-14 | The Windows kernel in Microsoft Windows Server 2008 R2 SP1, Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 170… |
CVE-2018-0903 | High | 7.8 | 2018-03-14 | Microsoft Access 2010 SP2, Microsoft Access 2013 SP1, Microsoft Access 2016, and Microsoft Office 2016 Click-to-Run allow a remote code execution vulnerability… |
CVE-2018-0902 | High | 7.8 | 2018-03-14 | The Cryptography Next Generation (CNG) kernel-mode driver (cng.sys) in Windows 10 Gold, 1511, 1607, 1703, and 1709. Windows Server 2016 and Windows Server, ver… |
CVE-2018-0901 | Medium | 4.7 | 2018-03-14 | The Windows kernel in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1… |
CVE-2018-0900 | Medium | 4.7 | 2018-03-14 | The Windows kernel in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1… |
CVE-2018-0899 | Medium | 4.7 | 2018-03-14 | The Windows kernel in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1… |
CVE-2018-0898 | Medium | 4.7 | 2018-03-14 | The Windows kernel in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1… |
CVE-2018-0897 | Medium | 4.7 | 2018-03-14 | The Windows kernel in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1… |
CVE-2018-0896 | Medium | 4.7 | 2018-03-14 | The Windows kernel in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1… |
CVE-2018-0895 | Medium | 4.7 | 2018-03-14 | The Windows kernel in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1… |
CVE-2018-0894 | Medium | 4.7 | 2018-03-14 | The Windows kernel in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1… |
CVE-2018-0893 | High | 7.5 | 2018-03-14 | Microsoft Edge in Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows remote code execution, due to how the scripting engine handles object… |
CVE-2018-0891 | Medium | 4.3 | 2018-03-14 | ChakraCore, and Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, and I… |
CVE-2018-0889 | High | 7.5 | 2018-03-14 | Microsoft Edge in Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows remote code execution, due to how the scripting engine handles object… |
CVE-2018-0888 | Medium | 5.6 | 2018-03-14 | The Microsoft Hyper-V Network Switch in 64-bit versions of Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 and R2… |
CVE-2018-0886 | High | 7.0 | 2018-03-14 | The Credential Security Support Provider protocol (CredSSP) in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Ser… |
CVE-2018-0885 | Medium | 5.8 | 2018-03-14 | The Microsoft Hyper-V Network Switch in 64-bit versions of Microsoft Windows Server 2008 SP2 and R2 SP1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 160… |
CVE-2018-0884 | High | 7.8 | 2018-03-14 | Windows Scripting Host (WSH) in Windows 10 Gold, 1511, 1607, 1703 and 1709, Windows Server 2016 and Windows Server, version 1709 allows a security feature bypa… |
CVE-2018-0883 | High | 7.5 | 2018-03-14 | Windows Shell in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607… |
CVE-2018-0882 | High | 7.0 | 2018-03-14 | The Desktop Bridge in Windows 10 1607, 1703, and 1709, Windows Server 2016 and Windows Server, version 1709 allows an elevation of privilege vulnerability due… |
CVE-2018-0881 | High | 7.0 | 2018-03-14 | The Microsoft Video Control in Microsoft Windows Server 2008 R2 SP1, Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511… |
CVE-2018-0880 | High | 7.0 | 2018-03-14 | The Desktop Bridge in Windows 10 1607, 1703, and 1709, Windows Server 2016 and Windows Server, version 1709 allows an elevation of privilege vulnerability due… |
CVE-2018-0879 | High | 7.5 | 2018-03-14 | Microsoft Edge in Windows 10 1709 allows information disclosure, due to how Edge handles objects in memory, aka "Microsoft Edge Information Disclosure Vulnerab… |
CVE-2018-0878 | Low | 3.1 | 2018-03-14 | Windows Remote Assistance in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2012 and R2, Windows 10 Gold… |