2018 CVEs (page 146)
Page 146 of 162 — CVEs published in 2018, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2018-0877 | High | 7.8 | 2018-03-14 | The Desktop Bridge Virtual File System (VFS) in Windows 10 1607, 1703, and 1709, Windows Server 2016 and Windows Server, version 1709 allows an elevation of pr… |
CVE-2018-0876 | High | 7.5 | 2018-03-14 | Microsoft Edge in Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows remote code execution, due to how the scripting engine handles object… |
CVE-2018-0875 | High | 7.5 | 2018-03-14 | .NET Core 1.0, .NET Core 1.1, NET Core 2.0 and PowerShell Core 6.0.0 allow a denial of Service vulnerability due to how specially crafted requests are handled… |
CVE-2018-0874 | High | 7.5 | 2018-03-14 | ChakraCore and Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows remote code execution, due to how the Chakra… |
CVE-2018-0873 | High | 7.5 | 2018-03-14 | ChakraCore and Microsoft Edge in Microsoft Windows 10 1511, 1607, 1703, 1709, and Windows Server 2016 allows remote code execution, due to how the Chakra scrip… |
CVE-2018-0872 | High | 7.5 | 2018-03-14 | ChakraCore and Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows remote code execution, due to how the Chakra… |
CVE-2018-0868 | High | 7.0 | 2018-03-14 | Windows Installer in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 16… |
CVE-2018-0817 | High | 7.0 | 2018-03-14 | The Windows Graphics Device Interface (GDI) in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2012 and R2… |
CVE-2018-0816 | High | 7.0 | 2018-03-14 | The Windows Graphics Device Interface (GDI) in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2012 and R2… |
CVE-2018-0815 | High | 7.0 | 2018-03-14 | The Windows Graphics Device Interface (GDI) in Microsoft Windows Server 2008 SP2 and R2 SP1 and Windows 7 SP1 allows an elevation of privilege vulnerability du… |
CVE-2018-0814 | Medium | 5.5 | 2018-03-14 | The Windows kernel in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1… |
CVE-2018-0813 | Medium | 5.5 | 2018-03-14 | The Windows kernel in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1… |
CVE-2018-0811 | Medium | 5.5 | 2018-03-14 | The Windows kernel in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1… |
CVE-2018-0808 | High | 7.5 | 2018-03-14 | ASP.NET Core 1.0. 1.1, and 2.0 allow an elevation of privilege vulnerability due to how ASP.NET web applications handle web requests, aka "ASP.NET Core Elevati… |
CVE-2018-0787 | High | 8.8 | 2018-03-14 | ASP.NET Core 1.0. 1.1, and 2.0 allow an elevation of privilege vulnerability due to how web applications that are created from templates validate web requests… |
CVE-2018-5782 | Critical | 9.8 | 2018-03-14 | A vulnerability in the conferencing component of Mitel Connect ONSITE, versions R1711-PREM and earlier, and Mitel ST 14.2, release GA28 and earlier, could allo… |
CVE-2018-5781 | Critical | 9.8 | 2018-03-14 | A vulnerability in the conferencing component of Mitel Connect ONSITE, versions R1711-PREM and earlier, and Mitel ST 14.2, release GA28 and earlier, could allo… |
CVE-2018-5780 | Critical | 9.8 | 2018-03-14 | A vulnerability in the conferencing component of Mitel Connect ONSITE, versions R1711-PREM and earlier, and Mitel ST 14.2, release GA28 and earlier, could allo… |
CVE-2018-5779 | Critical | 9.8 | 2018-03-14 | A vulnerability in the conferencing component of Mitel Connect ONSITE, versions R1711-PREM and earlier, and Mitel ST 14.2, release GA28 and earlier, could allo… |
CVE-2018-7678 | Low | 3.5 | 2018-03-14 | A cross site scripting vulnerability exist in the Administration Console in NetIQ Access Manager (NAM) 4.3 and 4.4. |
CVE-2018-7677 | Low | 3.5 | 2018-03-14 | A CSRF exposure exists in NetIQ Access Manager (NAM) 4.4 Identity Server component. |
CVE-2018-7474 | Critical | 9.8 | 2018-03-14 | An issue was discovered in Textpattern CMS 4.6.2 and earlier. It is possible to inject SQL code in the variable "qty" on the page index.php. |
CVE-2018-7279 | Critical | 9.8 | 2018-03-14 | A remote code execution issue was discovered in AlienVault USM and OSSIM before 5.5.1. |
CVE-2018-6875 | High | 7.5 | 2018-03-14 | Format String vulnerability in KeepKey version 4.0.0 allows attackers to trigger information display (of information that should not be accessible), related to… |
CVE-2018-1000132 | Critical | 9.1 | 2018-03-14 | Mercurial version 4.5 and earlier contains a Incorrect Access Control (CWE-285) vulnerability in Protocol server that can result in Unauthorized data access. T… |
CVE-2018-1000131 | Critical | 9.8 | 2018-03-14 | Pradeep Makone wordpress Support Plus Responsive Ticket System version 9.0.2 and earlier contains a SQL Injection vulnerability in the function to get tickets… |
CVE-2018-1000130 | High | 8.1 | 2018-03-14 | A JNDI Injection vulnerability exists in Jolokia agent version 1.3.7 in the proxy mode that allows a remote attacker to run arbitrary Java code on the server. |
CVE-2018-1000129 | Medium | 6.1 | 2018-03-14 | An XSS vulnerability exists in the Jolokia agent version 1.3.7 in the HTTP servlet that allows an attacker to execute malicious javascript in the victim's brow… |
CVE-2018-8108 | Medium | 6.1 | 2018-03-14 | The select component in bui through 2018-03-13 has XSS because it performs an escape operation on already-escaped text, as demonstrated by workGroupList text. |
CVE-2018-8097 | Critical | 9.8 | 2018-03-14 | io/mongo/parser.py in Eve (aka pyeve) before 0.7.5 allows remote attackers to execute arbitrary code via Code Injection in the where parameter. |
CVE-2018-8107 | Medium | 5.5 | 2018-03-14 | The JPXStream::close function in JPXStream.cc in xpdf 4.00 allows attackers to launch denial of service (heap-based buffer over-read and application crash) via… |
CVE-2018-8106 | Medium | 5.5 | 2018-03-14 | The JPXStream::readTilePartData function in JPXStream.cc in xpdf 4.00 allows attackers to launch denial of service (heap-based buffer over-read and application… |
CVE-2018-8105 | Medium | 5.5 | 2018-03-14 | The JPXStream::fillReadBuf function in JPXStream.cc in xpdf 4.00 allows attackers to launch denial of service (heap-based buffer over-read and application cras… |
CVE-2018-8104 | Medium | 5.5 | 2018-03-14 | The BufStream::lookChar function in Stream.cc in xpdf 4.00 allows attackers to launch denial of service (heap-based buffer over-read and application crash) via… |
CVE-2018-8103 | Medium | 5.5 | 2018-03-14 | The JBIG2Stream::readGenericBitmap function in JBIG2Stream.cc in xpdf 4.00 allows attackers to launch denial of service (heap-based buffer over-read and applic… |
CVE-2018-8102 | Medium | 5.5 | 2018-03-14 | The JBIG2MMRDecoder::getBlackCode function in JBIG2Stream.cc in xpdf 4.00 allows attackers to launch denial of service (buffer over-read and application crash)… |
CVE-2018-8101 | Medium | 5.5 | 2018-03-14 | The JPXStream::inverseTransformLevel function in JPXStream.cc in xpdf 4.00 allows attackers to launch denial of service (heap-based buffer over-read and applic… |
CVE-2018-8100 | High | 7.8 | 2018-03-14 | The JPXStream::readTilePart function in JPXStream.cc in xpdf 4.00 allows attackers to launch denial of service (heap-based buffer overflow and application cras… |
CVE-2018-8099 | Medium | 6.5 | 2018-03-14 | Incorrect returning of an error code in the index.c:read_entry() function leads to a double free in libgit2 before v0.26.2, which allows an attacker to cause a… |
CVE-2018-8098 | Medium | 6.5 | 2018-03-14 | Integer overflow in the index.c:read_entry() function while decompressing a compressed prefix length in libgit2 before v0.26.2 allows an attacker to cause a de… |
CVE-2018-8096 | Critical | 9.8 | 2018-03-14 | Datalust Seq before 4.2.605 is vulnerable to Authentication Bypass (with the attacker obtaining admin access) via '"Name":"isauthenticationenabled","Value":fal… |
CVE-2018-1444 | Medium | 5.4 | 2018-03-14 | IBM WebSphere Portal 8.5 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus a… |
CVE-2018-1441 | Medium | 6.1 | 2018-03-14 | IBM Application Performance Management - Response Time Monitoring Agent (IBM Monitoring 8.1.3 and 8.1.4) is vulnerable to cross-site scripting. This vulnerabil… |
CVE-2018-1437 | High | 7.8 | 2018-03-14 | IBM Notes 8.5 and 9.0 could allow an attacker to execute arbitrary code on the system, caused by an error related to multiple untrusted search path. A local at… |
CVE-2018-1435 | High | 7.8 | 2018-03-14 | IBM Notes 8.5 and 9.0 is vulnerable to a DLL hijacking attack. A remote attacker could trick a user to double click a malicious executable in an attacker-contr… |
CVE-2018-1386 | High | 7.8 | 2018-03-14 | IBM Tivoli Workload Automation for AIX (IBM Workload Scheduler 8.6, 9.1, 9.2, 9.3, and 9.4) contains directories with improper permissions that could allow a l… |
CVE-2018-1000127 | High | 7.5 | 2018-03-13 | memcached version prior to 1.4.37 contains an Integer Overflow vulnerability in items.c:item_free() that can result in data corruption and deadlocks due to ite… |
CVE-2018-1000126 | High | 7.5 | 2018-03-13 | Ajenti version 2 contains an Information Disclosure vulnerability in Line 176 of the code source that can result in user and system enumeration as well as data… |
CVE-2018-1000125 | Critical | 9.8 | 2018-03-13 | inversoft prime-jwt version prior to version 1.3.0 or prior to commit 0d94dcef0133d699f21d217e922564adbb83a227 contains an input validation vulnerability in JW… |
CVE-2018-1000124 | Critical | 10.0 | 2018-03-13 | I Librarian I-librarian version 4.8 and earlier contains a XML External Entity (XXE) vulnerability in line 154 of importmetadata.php(simplexml_load_string) tha… |
CVE-2018-1000123 | Critical | 9.8 | 2018-03-13 | Ionic Team Cordova plugin iOS Keychain version before commit 18233ca25dfa92cca018b9c0935f43f78fd77fbf contains an Information Exposure Through Log Files (CWE-5… |
CVE-2018-1227 | High | 7.5 | 2018-03-13 | Pivotal Concourse after 2018-03-05 might allow remote attackers to have an unspecified impact, if a customer obtained the Concourse software from a DNS domain… |
CVE-2018-7405 | Medium | 6.1 | 2018-03-13 | Cross-site scripting (XSS) in Zoho ManageEngine EventLog Analyzer before 11.12 Build 11120 allows remote attackers to inject arbitrary web script or HTML via u… |
CVE-2018-7750 | Critical | 9.8 | 2018-03-13 | transport.py in the SSH server implementation of Paramiko before 1.17.6, 1.18.x before 1.18.5, 2.0.x before 2.0.8, 2.1.x before 2.1.5, 2.2.x before 2.2.3, 2.3… |
CVE-2018-6305 | High | 7.5 | 2018-03-13 | Denial of service in Gemalto's Sentinel LDK RTE version before 7.65 |
CVE-2018-6304 | High | 7.5 | 2018-03-13 | Stack overflow in custom XML-parser in Gemalto's Sentinel LDK RTE version before 7.65 leads to remote denial of service |
CVE-2018-6303 | High | 7.5 | 2018-03-13 | Denial of service by uploading malformed firmware in Hanwha Techwin Smartcams |
CVE-2018-6302 | High | 7.5 | 2018-03-13 | Denial of service by blocking of new camera registration on the cloud server in Hanwha Techwin Smartcams |
CVE-2018-6301 | High | 7.5 | 2018-03-13 | Arbitrary camera access and monitoring via cloud in Hanwha Techwin Smartcams |
CVE-2018-6300 | Critical | 9.8 | 2018-03-13 | Remote password change in Hanwha Techwin Smartcams |
CVE-2018-6299 | Critical | 9.8 | 2018-03-13 | Authentication bypass in Hanwha Techwin Smartcams |
CVE-2018-6298 | Critical | 9.8 | 2018-03-13 | Remote code execution in Hanwha Techwin Smartcams |
CVE-2018-6297 | Critical | 9.8 | 2018-03-13 | Buffer overflow in Hanwha Techwin Smartcams |
CVE-2018-6296 | Medium | 5.3 | 2018-03-13 | An undocumented (hidden) capability for switching the web interface in Hanwha Techwin Smartcams |
CVE-2018-6295 | Critical | 9.8 | 2018-03-13 | Unencrypted way of remote control and communications in Hanwha Techwin Smartcams |
CVE-2018-6294 | Critical | 9.8 | 2018-03-13 | Unsecured way of firmware update in Hanwha Techwin Smartcams |
CVE-2018-1057 | High | 8.8 | 2018-03-13 | On a Samba 4 AD DC the LDAP server in all versions of Samba from 4.0.0 onwards incorrectly validates permissions to modify passwords over LDAP allowing authent… |
CVE-2018-1050 | Medium | 4.3 | 2018-03-13 | All versions of Samba from 4.0.0 onwards are vulnerable to a denial of service attack when the RPC spoolss service is configured to be run as an external daemo… |
CVE-2018-1000093 | High | 8.8 | 2018-03-13 | CryptoNote version version 0.8.9 and possibly later contain a local RPC server which does not require authentication, as a result the walletd and the simplewal… |
CVE-2018-1000092 | High | 8.8 | 2018-03-13 | CMS Made Simple version versions 2.2.5 contains a Cross ite Request Forgery (CSRF) vulnerability in Admin profile page that can result in Details can be found… |
CVE-2018-1000091 | High | 8.8 | 2018-03-13 | KadNode version version 2.2.0 contains a Buffer Overflow vulnerability in Arguments when starting up the binary that can result in Control of program execution… |
CVE-2018-1000090 | High | 7.5 | 2018-03-13 | textpattern version version 4.6.2 contains a XML Injection vulnerability in Import XML feature that can result in Denial of service in context to the web serve… |
CVE-2018-1000089 | High | 7.4 | 2018-03-13 | Anymail django-anymail version version 0.2 through 1.3 contains a CWE-532, CWE-209 vulnerability in WEBHOOK_AUTHORIZATION setting value that can result in An a… |
CVE-2018-1000088 | Medium | 6.1 | 2018-03-13 | Doorkeeper version 2.1.0 through 4.2.5 contains a Cross Site Scripting (XSS) vulnerability in web view's OAuth app form, user authorization prompt web view tha… |
CVE-2018-1000087 | Medium | 4.8 | 2018-03-13 | WolfCMS version version 0.8.3.1 contains a Reflected Cross Site Scripting vulnerability in "Create New File" and "Create New Directory" input box from 'files'… |
CVE-2018-1000086 | High | 8.8 | 2018-03-13 | NPR Visuals Team Pym.js version versions 0.4.2 up to 1.3.1 contains a Cross ite Request Forgery (CSRF) vulnerability in Pym.js _onNavigateToMessage function. h… |
CVE-2018-1000085 | Medium | 5.5 | 2018-03-13 | ClamAV version version 0.99.3 contains a Out of bounds heap memory read vulnerability in XAR parser, function xar_hash_check() that can result in Leaking of me… |
CVE-2018-1000084 | Medium | 5.4 | 2018-03-13 | WOlfCMS WolfCMS version version 0.8.3.1 contains a Stored Cross-Site Scripting vulnerability in Layout Name (from Layout tab) that can result in low privilege… |
CVE-2018-1000083 | Medium | 5.3 | 2018-03-13 | Ajenti version version 2 contains a Improper Error Handling vulnerability in Login JSON request that can result in The requisition leaks a path of the server… |
CVE-2018-1000082 | High | 8.8 | 2018-03-13 | Ajenti version version 2 contains a Cross ite Request Forgery (CSRF) vulnerability in the command execution panel of the tool used to manage the server. that c… |
CVE-2018-1000081 | High | 7.5 | 2018-03-13 | Ajenti version version 2 contains a Input Validation vulnerability in ID string on Get-values POST request that can result in Server Crashing. This attack appe… |
CVE-2018-1000080 | Medium | 6.5 | 2018-03-13 | Ajenti version version 2 contains a Insecure Permissions vulnerability in Plugins download that can result in The download of any plugins as being a normal use… |
CVE-2018-1000079 | Medium | 5.5 | 2018-03-13 | RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier… |
CVE-2018-1000078 | Medium | 6.1 | 2018-03-13 | RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier… |
CVE-2018-1000077 | Medium | 5.3 | 2018-03-13 | RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier… |
CVE-2018-1000076 | Critical | 9.8 | 2018-03-13 | RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier… |
CVE-2018-1000075 | High | 7.5 | 2018-03-13 | RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier… |
CVE-2018-1000074 | High | 7.8 | 2018-03-13 | RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier… |
CVE-2018-1000073 | High | 7.5 | 2018-03-13 | RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier… |
CVE-2018-1000072 | High | 7.5 | 2018-03-13 | iRedMail version prior to commit f04b8ef contains a Insecure Permissions vulnerability in Roundcube Webmail that can result in Exfiltrate a user's password pro… |
CVE-2018-1000071 | High | 7.5 | 2018-03-13 | roundcube version 1.3.4 and earlier contains an Insecure Permissions vulnerability in enigma plugin that can result in exfiltration of gpg private key. This at… |
CVE-2018-1000070 | High | 8.8 | 2018-03-13 | Bitmessage PyBitmessage version v0.6.2 (and introduced in or after commit 8ce72d8d2d25973b7064b1cf76a6b0b3d62f0ba0) contains a Eval injection vulnerability in… |
CVE-2018-1000069 | Medium | 5.5 | 2018-03-13 | FreePlane version 1.5.9 and earlier contains a XML External Entity (XXE) vulnerability in XML Parser in mindmap loader that can result in stealing data from vi… |
CVE-2018-1000114 | Medium | 4.3 | 2018-03-13 | An improper authorization vulnerability exists in Jenkins Promoted Builds Plugin 2.31.1 and earlier in Status.java and ManualCondition.java that allow an attac… |
CVE-2018-1000113 | Medium | 5.4 | 2018-03-13 | A cross-site scripting vulnerability exists in Jenkins TestLink Plugin 2.12 and earlier in TestLinkBuildAction/summary.jelly and others that allow an attacker… |
CVE-2018-1000112 | Medium | 5.3 | 2018-03-13 | An improper authorization vulnerability exists in Jenkins Mercurial Plugin version 2.2 and earlier in MercurialStatus.java that allows an attacker with network… |
CVE-2018-1000111 | Medium | 5.3 | 2018-03-13 | An improper authorization vulnerability exists in Jenkins Subversion Plugin version 2.10.2 and earlier in SubversionStatus.java and SubversionRepositoryStatus… |
CVE-2018-1000110 | Medium | 5.3 | 2018-03-13 | An improper authorization vulnerability exists in Jenkins Git Plugin version 3.7.0 and earlier in GitStatus.java that allows an attacker with network access to… |
CVE-2018-1000109 | Medium | 4.3 | 2018-03-13 | An improper authorization vulnerability exists in Jenkins Google Play Android Publisher Plugin version 1.6 and earlier in GooglePlayBuildStepDescriptor.java th… |
CVE-2018-1000108 | Medium | 6.1 | 2018-03-13 | A cross-site scripting vulnerability exists in Jenkins CppNCSS Plugin 1.1 and earlier in AbstractProjectAction/index.jelly that allow an attacker to craft link… |