2018 CVEs (page 148)
Page 148 of 162 — CVEs published in 2018, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2018-1220 | Medium | 6.1 | 2018-03-08 | EMC RSA Archer, versions prior to 6.2.0.8, contains a redirect vulnerability in the QuickLinks feature. A remote attacker may potentially exploit this vulnerab… |
CVE-2018-1219 | Medium | 4.3 | 2018-03-08 | EMC RSA Archer, versions prior to 6.2.0.8, contains an improper access control vulnerability on an API which is used to enumerate user information. A remote au… |
CVE-2018-1216 | Critical | 9.8 | 2018-03-08 | A hard-coded password vulnerability was discovered in vApp Manager which is embedded in Dell EMC Unisphere for VMAX, Dell EMC Solutions Enabler, Dell EMC VASA… |
CVE-2018-1215 | High | 8.8 | 2018-03-08 | An arbitrary file upload vulnerability was discovered in vApp Manager which is embedded in Dell EMC Unisphere for VMAX, Dell EMC Solutions Enabler, Dell EMC VA… |
CVE-2018-1182 | High | 7.8 | 2018-03-08 | An issue was discovered in EMC RSA Identity Governance and Lifecycle versions 7.0.1, 7.0.2, all patch levels (hardware appliance and software bundle deployment… |
CVE-2018-7757 | Medium | 5.5 | 2018-03-08 | Memory leak in the sas_smp_get_phy_events function in drivers/scsi/libsas/sas_expander.c in the Linux kernel through 4.15.7 allows local users to cause a denia… |
CVE-2018-7755 | Medium | 5.5 | 2018-03-08 | An issue was discovered in the fd_locked_ioctl function in drivers/block/floppy.c in the Linux kernel through 4.15.7. The floppy driver will copy a kernel poin… |
CVE-2018-0224 | Medium | 6.7 | 2018-03-08 | A vulnerability in the CLI of the Cisco StarOS operating system for Cisco ASR 5000 Series Aggregation Services Routers could allow an authenticated, local atta… |
CVE-2018-0223 | Medium | 6.1 | 2018-03-08 | A vulnerability in DesktopServlet in the web-based management interface of Cisco Security Manager could allow an unauthenticated, remote attacker to conduct a… |
CVE-2018-0221 | Medium | 6.7 | 2018-03-08 | A vulnerability in specific CLI commands for the Cisco Identity Services Engine (ISE) could allow an authenticated, local attacker to perform command injection… |
CVE-2018-0220 | Medium | 5.4 | 2018-03-08 | A vulnerability in the web-based management interface of Cisco Videoscape AnyRes Live could allow an authenticated, remote attacker to conduct a cross-site scr… |
CVE-2018-0219 | Medium | 6.1 | 2018-03-08 | A vulnerability in the web-based management interface of Cisco Unified Computing System (UCS) Director could allow an unauthenticated, remote attacker to condu… |
CVE-2018-0218 | Low | 3.3 | 2018-03-08 | A vulnerability in the web-based user interface of the Cisco Secure Access Control Server prior to 5.8 patch 9 could allow an unauthenticated, remote attacker… |
CVE-2018-0217 | Medium | 6.7 | 2018-03-08 | A vulnerability in the CLI of the Cisco StarOS operating system for Cisco ASR 5000 Series Aggregation Services Routers could allow an authenticated, local atta… |
CVE-2018-0216 | Medium | 5.4 | 2018-03-08 | A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to conduct a cros… |
CVE-2018-0215 | Medium | 6.3 | 2018-03-08 | A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to conduct a cros… |
CVE-2018-0214 | Medium | 5.3 | 2018-03-08 | A vulnerability in certain CLI commands of Cisco Identity Services Engine (ISE) could allow an authenticated, local attacker to execute arbitrary commands on t… |
CVE-2018-0213 | High | 8.8 | 2018-03-08 | A vulnerability in the credential reset functionality for Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to gain elevated p… |
CVE-2018-0212 | Medium | 6.1 | 2018-03-08 | A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to conduct a cros… |
CVE-2018-0211 | Medium | 4.4 | 2018-03-08 | A vulnerability in specific CLI commands for the Cisco Identity Services Engine could allow an authenticated, local attacker to cause a denial of service (DoS)… |
CVE-2018-0210 | High | 8.8 | 2018-03-08 | A vulnerability in the web-based management interface of Cisco Data Center Network Manager could allow an unauthenticated, remote attacker to conduct a cross-s… |
CVE-2018-0209 | High | 7.7 | 2018-03-08 | A vulnerability in the Simple Network Management Protocol (SNMP) subsystem communication channel through the Cisco 550X Series Stackable Managed Switches could… |
CVE-2018-0208 | Medium | 5.4 | 2018-03-08 | A vulnerability in the web-based management interface of the (cloud based) Cisco Registered Envelope Service could allow an authenticated, remote attacker to c… |
CVE-2018-0207 | Low | 3.3 | 2018-03-08 | A vulnerability in the web-based user interface of the Cisco Secure Access Control Server prior to 5.8 patch 9 could allow an unauthenticated, remote attacker… |
CVE-2018-0147 | Critical | 9.8 | 2018-03-08 | A vulnerability in Java deserialization used by Cisco Secure Access Control System (ACS) prior to release 5.8 patch 9 could allow an unauthenticated, remote at… |
CVE-2018-0144 | Medium | 6.1 | 2018-03-08 | A vulnerability in the web-based management interface of Cisco Prime Data Center Network Manager could allow an unauthenticated, remote attacker to conduct a c… |
CVE-2018-0141 | High | 8.4 | 2018-03-08 | A vulnerability in Cisco Prime Collaboration Provisioning (PCP) Software 11.6 could allow an unauthenticated, local attacker to log in to the underlying Linux… |
CVE-2018-0087 | Medium | 5.6 | 2018-03-08 | A vulnerability in the FTP server of the Cisco Web Security Appliance (WSA) could allow an unauthenticated, remote attacker to log in to the FTP server of the… |
CVE-2018-7753 | Critical | 9.8 | 2018-03-07 | An issue was discovered in Bleach 2.1.x before 2.1.3. Attributes that have URI values weren't properly sanitized if the values contained character entities. Us… |
CVE-2018-7752 | High | 7.8 | 2018-03-07 | GPAC through 0.7.1 has a Buffer Overflow in the gf_media_avc_read_sps function in media_tools/av_parsers.c, a different vulnerability than CVE-2018-1000100. |
CVE-2018-7675 | Low | 2.8 | 2018-03-07 | In NetIQ Sentinel before 8.1.x, a Sentinel user is logged into the Sentinel Web Interface. After performing some tasks within Sentinel the user does not log ou… |
CVE-2018-7565 | High | 8.8 | 2018-03-07 | CSRF exists on Polycom QDX 6000 devices. |
CVE-2018-7564 | Medium | 6.1 | 2018-03-07 | Stored XSS exists on Polycom QDX 6000 devices. |
CVE-2018-7204 | High | 7.5 | 2018-03-07 | inc/logger.php in the Giribaz File Manager plugin before 5.0.2 for WordPress logged activity related to the plugin in /wp-content/uploads/file-manager/log.txt… |
CVE-2018-5452 | High | 7.5 | 2018-03-07 | A Stack-based Buffer Overflow issue was discovered in Emerson Process Management ControlWave Micro Process Automation Controller: ControlWave Micro [ProConOS v… |
CVE-2018-7746 | High | 8.8 | 2018-03-07 | An issue was discovered in Western Bridge Cobub Razor 0.7.2. Authentication is not required for /index.php?/manage/channel/modifychannel. For example, with a c… |
CVE-2018-7745 | High | 7.5 | 2018-03-07 | An issue was discovered in Western Bridge Cobub Razor 0.7.2. Authentication is not required for /index.php?/install/installation/createuserinfo requests, resul… |
CVE-2018-7473 | Medium | 6.1 | 2018-03-07 | Open redirect vulnerability in the SO Connect SO WIFI hotspot web interface, prior to version 140, allows remote attackers to redirect users to arbitrary web s… |
CVE-2018-1000119 | Medium | 5.9 | 2018-03-07 | Sinatra rack-protection versions 1.5.4 and 2.0.0.rc3 and earlier contains a timing attack vulnerability in the CSRF token checking that can result in signature… |
CVE-2018-1000118 | High | 8.8 | 2018-03-07 | Github Electron version Electron 1.8.2-beta.4 and earlier contains a Command Injection vulnerability in Protocol Handler that can result in command execute. Th… |
CVE-2018-1000117 | Medium | 6.7 | 2018-03-07 | Python Software Foundation CPython version From 3.2 until 3.6.4 on Windows contains a Buffer Overflow vulnerability in os.symlink() function on Windows that ca… |
CVE-2018-1000116 | Critical | 9.8 | 2018-03-07 | NET-SNMP version 5.7.2 contains a heap corruption vulnerability in the UDP protocol handler that can result in command execution. |
CVE-2018-1054 | High | 7.5 | 2018-03-07 | An out-of-bounds memory read flaw was found in the way 389-ds-base handled certain LDAP search filters, affecting all versions including 1.4.x. A remote, unaut… |
CVE-2018-7741 | Medium | 6.1 | 2018-03-07 | Eramba e1.0.6.033 has Reflected XSS in the Date Filter via the created parameter to the /crons URI. |
CVE-2018-7740 | Medium | 5.5 | 2018-03-07 | The resv_map_release function in mm/hugetlb.c in the Linux kernel through 4.15.7 allows local users to cause a denial of service (BUG) via a crafted applicatio… |
CVE-2018-7721 | Medium | 6.1 | 2018-03-07 | Cross Site Scripting (XSS) exists in MetInfo 6.0.0 via /feedback/index.php because app/system/feedback/web/feedback.class.php mishandles input data. |
CVE-2018-7720 | High | 8.8 | 2018-03-07 | A cross-site request forgery (CSRF) vulnerability exists in Western Bridge Cobub Razor 0.7.2 via /index.php?/user/createNewUser/, resulting in account creation. |
CVE-2018-7739 | Critical | 9.8 | 2018-03-07 | antsle antman before 0.9.1a allows remote attackers to bypass authentication via invalid characters in the username and password parameters, as demonstrated by… |
CVE-2018-7738 | High | 7.8 | 2018-03-07 | In util-linux before 2.32-rc1, bash-completion/umount allows local users to gain privileges by embedding shell commands in a mountpoint name, which is mishandl… |
CVE-2018-7737 | Medium | 5.3 | 2018-03-06 | In Z-BlogPHP 1.5.1.1740, there is Web Site physical path leakage, as demonstrated by admin_footer.php or admin_footer.php. NOTE: the software maintainer disput… |
CVE-2018-7736 | Medium | 6.1 | 2018-03-06 | In Z-BlogPHP 1.5.1.1740, cmd.php has XSS via the ZC_BLOG_SUBNAME parameter or ZC_UPLOAD_FILETYPE parameter. NOTE: the software maintainer disputes that this is… |
CVE-2018-5471 | Medium | 5.9 | 2018-03-06 | A Cleartext Transmission of Sensitive Information issue was discovered in Belden Hirschmann RS, RSR, RSB, MACH100, MACH1000, MACH4000, MS, and OCTOPUS Classic… |
CVE-2018-5469 | Critical | 9.8 | 2018-03-06 | An Improper Restriction of Excessive Authentication Attempts issue was discovered in Belden Hirschmann RS, RSR, RSB, MACH100, MACH1000, MACH4000, MS, and OCTOP… |
CVE-2018-5467 | Medium | 6.5 | 2018-03-06 | An Information Exposure Through Query Strings in GET Request issue was discovered in Belden Hirschmann RS, RSR, RSB, MACH100, MACH1000, MACH4000, MS, and OCTOP… |
CVE-2018-5465 | High | 8.8 | 2018-03-06 | A Session Fixation issue was discovered in Belden Hirschmann RS, RSR, RSB, MACH100, MACH1000, MACH4000, MS, and OCTOPUS Classic Platform Switches. A session fi… |
CVE-2018-5461 | Medium | 6.5 | 2018-03-06 | An Inadequate Encryption Strength issue was discovered in Belden Hirschmann RS, RSR, RSB, MACH100, MACH1000, MACH4000, MS, and OCTOPUS Classic Platform Switche… |
CVE-2018-7185 | High | 7.5 | 2018-03-06 | The protocol engine in ntp 4.2.6 before 4.2.8p11 allows a remote attackers to cause a denial of service (disruption) by continually sending a packet with a zer… |
CVE-2018-7184 | High | 7.5 | 2018-03-06 | ntpd in ntp 4.2.8p4 before 4.2.8p11 drops bad packets before updating the "received" timestamp, which allows remote attackers to cause a denial of service (dis… |
CVE-2018-7182 | High | 7.5 | 2018-03-06 | The ctl_getitem method in ntpd in ntp-4.2.8p6 before 4.2.8p11 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted mode 6 pa… |
CVE-2018-7170 | Medium | 5.3 | 2018-03-06 | ntpd in ntp 4.2.x before 4.2.8p7 and 4.3.x before 4.3.92 allows authenticated users that know the private symmetric key to create arbitrarily-many ephemeral as… |
CVE-2018-6811 | Medium | 6.1 | 2018-03-06 | Multiple cross-site scripting (XSS) vulnerabilities in Citrix NetScaler ADC 10.5, 11.0, 11.1, and 12.0, and NetScaler Gateway 10.5, 11.0, 11.1, and 12.0 allow… |
CVE-2018-6810 | High | 7.5 | 2018-03-06 | Directory traversal vulnerability in NetScaler ADC 10.5, 11.0, 11.1, and 12.0, and NetScaler Gateway 10.5, 11.0, 11.1, and 12.0 allows remote attackers to trav… |
CVE-2018-6809 | Critical | 9.8 | 2018-03-06 | NetScaler ADC 10.5, 11.0, 11.1, and 12.0, and NetScaler Gateway 10.5, 11.0, 11.1, and 12.0 allow remote attackers to gain privilege on a target system. |
CVE-2018-6808 | High | 7.5 | 2018-03-06 | NetScaler ADC 10.5, 11.0, 11.1, and 12.0, and NetScaler Gateway 10.5, 11.0, 11.1, and 12.0 allow remote attackers to download arbitrary files on the target sys… |
CVE-2018-6530 | Critical | 9.8 | 2018-03-06 | OS command injection vulnerability in soap.cgi (soapcgi_main in cgibin) in D-Link DIR-880L DIR-880L_REVA_FIRMWARE_PATCH_1.08B04 and previous versions, DIR-868L… |
CVE-2018-6529 | Medium | 6.1 | 2018-03-06 | XSS vulnerability in htdocs/webinc/js/bsc_sms_inbox.php in D-Link DIR-868L DIR868LA1_FW112b04 and previous versions, DIR-865L DIR-865L_REVA_FIRMWARE_PATCH_1.08… |
CVE-2018-6528 | Medium | 6.1 | 2018-03-06 | XSS vulnerability in htdocs/webinc/body/bsc_sms_send.php in D-Link DIR-868L DIR868LA1_FW112b04 and previous versions, DIR-865L DIR-865L_REVA_FIRMWARE_PATCH_1.0… |
CVE-2018-6527 | Medium | 6.1 | 2018-03-06 | XSS vulnerability in htdocs/webinc/js/adv_parent_ctrl_map.php in D-Link DIR-868L DIR868LA1_FW112b04 and previous versions, DIR-865L DIR-865L_REVA_FIRMWARE_PATC… |
CVE-2018-6019 | Medium | 5.9 | 2018-03-06 | Samsung Display Solutions App before 3.02 for Android allows man-in-the-middle attackers to spoof B2B content by leveraging failure to use encryption during in… |
CVE-2018-5730 | Low | 3.8 | 2018-03-06 | MIT krb5 1.6 or later allows an authenticated kadmin with permission to add principals to an LDAP Kerberos database to circumvent a DN containership check by s… |
CVE-2018-5729 | Medium | 4.7 | 2018-03-06 | MIT krb5 1.6 or later allows an authenticated kadmin with permission to add principals to an LDAP Kerberos database to cause a denial of service (NULL pointer… |
CVE-2018-1343 | Critical | 9.8 | 2018-03-06 | PAM exposure enabling unauthenticated access to remote host |
CVE-2018-7735 | High | 7.2 | 2018-03-06 | Afian FileRun (before 2018.02.13) suffers from a remote SQL injection vulnerability, when logged in as superuser, via the search parameter in a /?module=metada… |
CVE-2018-7734 | High | 7.2 | 2018-03-06 | Afian FileRun (before 2018.02.13) suffers from a remote SQL injection vulnerability, when logged in as superuser, via the search parameter in a /?module=users&… |
CVE-2018-7733 | High | 8.8 | 2018-03-06 | An issue was discovered in YxtCMF 3.1. RbacController.class.php has CSRF, as demonstrated by modifying an administrator account via index.php/admin/user/add_po… |
CVE-2018-7732 | Critical | 9.8 | 2018-03-06 | An issue was discovered in YxtCMF 3.1. SQL Injection exists in ShitiController.class.php via the ids array parameter to exam/shiti/delshiti.html. |
CVE-2018-7731 | Medium | 5.5 | 2018-03-06 | An issue was discovered in Exempi through 2.4.4. XMPFiles/source/FormatSupport/WEBP_Support.cpp does not check whether a bitstream has a NULL value, leading to… |
CVE-2018-7730 | Medium | 5.5 | 2018-03-06 | An issue was discovered in Exempi through 2.4.4. A certain case of a 0xffffffff length is mishandled in XMPFiles/source/FormatSupport/PSIR_FileWriter.cpp, lead… |
CVE-2018-7729 | Medium | 5.5 | 2018-03-06 | An issue was discovered in Exempi through 2.4.4. There is a stack-based buffer over-read in the PostScript_MetaHandler::ParsePSFile() function in XMPFiles/sour… |
CVE-2018-7728 | Medium | 5.5 | 2018-03-06 | An issue was discovered in Exempi through 2.4.4. XMPFiles/source/FileHandlers/TIFF_Handler.cpp mishandles a case of a zero length, leading to a heap-based buff… |
CVE-2018-7727 | Medium | 6.5 | 2018-03-06 | An issue was discovered in ZZIPlib 0.13.68. There is a memory leak triggered in the function zzip_mem_disk_new in memdisk.c, which will lead to a denial of ser… |
CVE-2018-7726 | Medium | 6.5 | 2018-03-06 | An issue was discovered in ZZIPlib 0.13.68. There is a bus error caused by the __zzip_parse_root_directory function of zip.c. Attackers could leverage this vul… |
CVE-2018-7725 | Medium | 6.5 | 2018-03-06 | An issue was discovered in ZZIPlib 0.13.68. An invalid memory address dereference was discovered in zzip_disk_fread in mmapped.c. The vulnerability causes an a… |
CVE-2018-7724 | Medium | 5.4 | 2018-03-06 | The management panel in Piwigo 2.9.3 has stored XSS via the name parameter in a /admin.php?page=photo-${photo_number} request. CSRF exploitation, related to CV… |
CVE-2018-7723 | Medium | 5.4 | 2018-03-06 | The management panel in Piwigo 2.9.3 has stored XSS via the virtual_name parameter in a /admin.php?page=cat_list request, a different issue than CVE-2017-9836… |
CVE-2018-7722 | Medium | 5.4 | 2018-03-06 | The management panel in Piwigo 2.9.3 has stored XSS via the name parameter in a /ws.php?format=json request. CSRF exploitation, related to CVE-2017-10681, may… |
CVE-2018-1000101 | Critical | 9.8 | 2018-03-06 | Mingw-w64 version 5.0.3 and earlier, 5.0.4, 6.0.0 and 7.0.0 contains an Improper Null Termination (CWE-170) vulnerability in mingw-w64-crt (libc)->(v)snprintf… |
CVE-2018-1000100 | High | 7.8 | 2018-03-06 | GPAC MP4Box version 0.7.1 and earlier contains a Buffer Overflow vulnerability in src/isomedia/avc_ext.c lines 2417 to 2420 that can result in Heap chunks bein… |
CVE-2018-7650 | Medium | 4.8 | 2018-03-06 | PHP Scripts Mall Hot Scripts Clone:Script Classified Version 3.1 Application is vulnerable to stored XSS within the "Add New" function for a Management User. W… |
CVE-2018-7307 | High | 8.8 | 2018-03-06 | The Auth0 Auth0.js library before 9.3 has CSRF because it mishandles the case where the authorization response lacks the state parameter. |
CVE-2018-1062 | Medium | 5.3 | 2018-03-06 | A vulnerability was discovered in oVirt 4.1.x before 4.1.9, where the combination of Enable Discard and Wipe After Delete flags for VM disks managed by oVirt… |
CVE-2018-7717 | Medium | 6.1 | 2018-03-05 | The htmlImageAddTitleAttribute function in sige.php in the Kubik-Rubik Simple Image Gallery Extended (SIGE) extension 3.2.3 for Joomla! has XSS via a crafted i… |
CVE-2018-7716 | Critical | 9.8 | 2018-03-05 | PrivateVPN 2.0.31 for macOS suffers from a root privilege escalation vulnerability with its com.privat.vpn.helper privileged helper tool. This privileged helpe… |
CVE-2018-7715 | Critical | 9.8 | 2018-03-05 | PrivateVPN 2.0.31 for macOS suffers from a root privilege escalation vulnerability with its com.privat.vpn.helper privileged helper tool. This privileged helpe… |
CVE-2018-7714 | High | 7.5 | 2018-03-05 | The validateInputImageSize function in modules/imgcodecs/src/loadsave.cpp in OpenCV 3.4.1 allows remote attackers to cause a denial of service (assertion failu… |
CVE-2018-7713 | High | 7.5 | 2018-03-05 | The validateInputImageSize function in modules/imgcodecs/src/loadsave.cpp in OpenCV 3.4.1 allows remote attackers to cause a denial of service (assertion failu… |
CVE-2018-7712 | High | 7.5 | 2018-03-05 | The validateInputImageSize function in modules/imgcodecs/src/loadsave.cpp in OpenCV 3.4.1 allows remote attackers to cause a denial of service (assertion failu… |
CVE-2018-7711 | High | 8.1 | 2018-03-05 | HTTPRedirect.php in the saml2 library in SimpleSAMLphp before 1.15.4 has an incorrect check of return values in the signature validation utilities, allowing an… |
CVE-2018-7493 | Critical | 9.8 | 2018-03-05 | CactusVPN through 6.0 for macOS suffers from a root privilege escalation vulnerability in its privileged helper tool. The privileged helper tool implements an… |
CVE-2018-7698 | High | 8.1 | 2018-03-05 | An issue was discovered in D-Link mydlink+ 3.8.5 build 259 for DCS-933L 1.05.04 and DCS-934L 1.05.04 devices. The mydlink+ app sends the username and password… |