2018 CVEs (page 15)
Page 15 of 162 — CVEs published in 2018, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2018-17151 | Medium | 5.4 | 2019-07-11 | Intersystems Cache 2017.2.2.865.0 has Incorrect Access Control. |
CVE-2018-17150 | Medium | 6.1 | 2019-07-11 | Intersystems Cache 2017.2.2.865.0 allows XSS. |
CVE-2018-11744 | High | 8.1 | 2019-07-11 | Cloudera Manager through 5.15 has Incorrect Access Control. |
CVE-2018-11734 | Medium | 6.1 | 2019-07-10 | In e107 v2.1.7, output without filtering results in XSS. |
CVE-2018-19584 | High | 7.5 | 2019-07-10 | GitLab EE, versions 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, is vulnerable to an insecure direct object reference vulnerability that al… |
CVE-2018-19583 | Medium | 6.5 | 2019-07-10 | GitLab CE/EE, versions 8.0 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, would log access tokens in the Workhorse logs, permitting adm… |
CVE-2018-19582 | Medium | 4.3 | 2019-07-10 | GitLab EE, versions 11.4 before 11.4.8 and 11.5 before 11.5.1, is affected by an insecure direct object reference vulnerability that permits an unauthorized us… |
CVE-2018-19581 | High | 7.5 | 2019-07-10 | GitLab EE, versions 8.3 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, is vulnerable to an insecure object reference vulnerability that… |
CVE-2018-19580 | Medium | 5.3 | 2019-07-10 | All versions of GitLab prior to 11.5.1, 11.4.8, and 11.3.11 do not send an email to the old email address when an email address change is made. |
CVE-2018-19579 | Medium | 5.4 | 2019-07-10 | GitLab EE version 11.5 is vulnerable to a persistent XSS vulnerability in the Operations page. This is fixed in 11.5.1. |
CVE-2018-19578 | Medium | 6.5 | 2019-07-10 | GitLab EE, version 11.5 before 11.5.1, is vulnerable to an insecure object reference issue that permits a user with Reporter privileges to view the Jaeger Trac… |
CVE-2018-19571 | High | 7.7 | 2019-07-10 | GitLab CE/EE, versions 8.18 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an SSRF vulnerability in webhooks. |
CVE-2018-19576 | High | 8.1 | 2019-07-10 | GitLab CE/EE, versions 8.6 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an access control issue that allows a Guest… |
CVE-2018-19575 | Medium | 4.3 | 2019-07-10 | GitLab CE/EE, versions 10.1 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an insecure direct object reference issue… |
CVE-2018-19574 | Medium | 5.4 | 2019-07-10 | GitLab CE/EE, versions 7.6 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an XSS vulnerability in the OAuth authoriza… |
CVE-2018-19573 | Medium | 5.4 | 2019-07-10 | GitLab CE/EE, versions 10.3 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an XSS vulnerability in Markdown fields vi… |
CVE-2018-19572 | Medium | 5.9 | 2019-07-10 | GitLab CE 8.17 and later and EE 8.3 and later have a symlink time-of-check-to-time-of-use race condition that would allow unauthorized access to files in the G… |
CVE-2018-19570 | Medium | 5.4 | 2019-07-10 | GitLab CE/EE, versions 11.3 before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an XSS vulnerability in Markdown fields via unrecogni… |
CVE-2018-19569 | High | 8.8 | 2019-07-10 | GitLab CE/EE, versions 8.8 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an authorization vulnerability that allows… |
CVE-2018-10531 | High | 7.5 | 2019-07-10 | An issue was discovered in the America's Army Proving Grounds platform for the Unreal Engine. With a false packet sent via UDP, the application server responds… |
CVE-2018-19577 | Medium | 5.3 | 2019-07-10 | Gitlab CE/EE, versions 8.6 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an incorrect access control vulnerability t… |
CVE-2018-19496 | Medium | 6.5 | 2019-07-10 | An issue was discovered in GitLab Community and Enterprise Edition 10.x and 11.x before 11.3.11, 11.4.x before 11.4.8, and 11.5.x before 11.5.1. There is an in… |
CVE-2018-19495 | Medium | 6.5 | 2019-07-10 | An issue was discovered in GitLab Community and Enterprise Edition before 11.3.11, 11.4.x before 11.4.8, and 11.5.x before 11.5.1. There is an SSRF vulnerabili… |
CVE-2018-19494 | Medium | 4.3 | 2019-07-10 | An issue was discovered in GitLab Community and Enterprise Edition 11.x before 11.3.11, 11.4.x before 11.4.8, and 11.5.x before 11.5.1. There is an incorrect a… |
CVE-2018-19493 | Medium | 6.1 | 2019-07-10 | An issue was discovered in GitLab Community and Enterprise Edition 11.x before 11.3.11, 11.4.x before 11.4.8, and 11.5.x before 11.5.1. There is a persistent X… |
CVE-2018-14831 | Medium | 4.9 | 2019-07-10 | An arbitrary file read vulnerability in DamiCMS v6.0.0 allows remote authenticated administrators to read any files in the server via a crafted /admin.php?s=Tp… |
CVE-2018-20851 | High | 8.8 | 2019-07-10 | Helpy before 2.2.0 allows agents to edit admins. |
CVE-2018-17147 | Medium | 4.8 | 2019-07-10 | Nagios XI before 5.5.4 has XSS in the auto login admin management page. |
CVE-2018-14496 | Critical | 9.8 | 2019-07-10 | Vivotek FD8136 devices allow remote memory corruption and remote code execution because of a stack-based buffer overflow, related to sprintf, vlocal_buff_4326… |
CVE-2018-14495 | Critical | 9.8 | 2019-07-10 | Vivotek FD8136 devices allow Remote Command Injection, aka "another command injection vulnerability in our target device," a different issue than CVE-2018-1449… |
CVE-2018-14494 | Critical | 9.8 | 2019-07-10 | Vivotek FD8136 devices allow Remote Command Injection, related to BusyBox and wget. NOTE: the vendor sent a clarification on 2019-09-17 explaining that, althou… |
CVE-2018-14550 | High | 8.8 | 2019-07-10 | An issue has been found in third-party PNM decoding associated with libpng 1.6.35. It is a stack-based buffer overflow in the function get_token in pnm2png.c i… |
CVE-2018-12628 | High | 8.8 | 2019-07-10 | An issue was discovered in Eventum 3.5.0. CSRF in htdocs/manage/users.php allows creating another user with admin privileges. |
CVE-2018-12627 | Medium | 6.1 | 2019-07-10 | An issue was discovered in Eventum 3.5.0. /htdocs/list.php has XSS via the show_notification_list_issues or show_authorized_issues parameter. |
CVE-2018-12626 | Medium | 6.1 | 2019-07-10 | An issue was discovered in Eventum 3.5.0. /htdocs/popup.php has XSS via the cat parameter. |
CVE-2018-12625 | Medium | 6.1 | 2019-07-10 | An issue was discovered in Eventum 3.5.0. /htdocs/validate.php has XSS via the values parameter. |
CVE-2018-12623 | Medium | 6.1 | 2019-07-10 | An issue was discovered in Eventum 3.5.0. htdocs/switch.php has XSS via the current_page parameter. |
CVE-2018-12622 | Medium | 6.1 | 2019-07-10 | An issue was discovered in Eventum 3.5.0. htdocs/ajax/update.php has XSS via the field_name parameter. |
CVE-2018-11307 | Critical | 9.8 | 2019-07-09 | An issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.5. Use of Jackson default typing along with a gadget class from iBatis allows exfiltrat… |
CVE-2018-15738 | Medium | 5.5 | 2019-07-09 | An issue was discovered in STOPzilla AntiMalware 6.5.2.59. The driver file szkg64.sys contains an Arbitrary Write vulnerability due to not validating the outpu… |
CVE-2018-14833 | Medium | 5.9 | 2019-07-09 | Intuit Lacerte 2017 has Incorrect Access Control. |
CVE-2018-11563 | Medium | 4.6 | 2019-07-08 | An issue was discovered in Open Ticket Request System (OTRS) 6.0.x through 6.0.7. A carefully constructed email could be used to inject and execute arbitrary s… |
CVE-2018-16386 | High | 7.5 | 2019-07-05 | An issue was discovered in SWIFT Alliance Web Platform 7.1.23. A log injection (and an arbitrary log filename) can be achieved via the PATH_INFO to swp/login/E… |
CVE-2018-14733 | High | 7.5 | 2019-07-05 | The Odoo Community Association (OCA) dbfilter_from_header module makes Odoo 8.x, 9.x, 10.x, and 11.x vulnerable to ReDoS (regular expression denial of service)… |
CVE-2018-14529 | High | 7.5 | 2019-07-05 | Invoxia NVX220 devices allow access to /bin/sh via escape from a restricted CLI, leading to disclosure of password hashes. |
CVE-2018-14528 | Critical | 9.8 | 2019-07-05 | Invoxia NVX220 devices allow TELNET access as admin with a default password. |
CVE-2018-12621 | Medium | 6.1 | 2019-07-05 | An issue was discovered in Eventum 3.5.0. /htdocs/switch.php has an Open Redirect via the current_page parameter. |
CVE-2018-14027 | Medium | 6.1 | 2019-07-05 | Digisol Wireless Wifi Home Router HR-3300 allows XSS via the userid or password parameter to the admin login page. |
CVE-2018-20850 | High | 8.2 | 2019-07-04 | Stormshield Network Security 2.0.0 through 2.13.0 and 3.0.0 through 3.7.1 has self-XSS in the command line interface of the SNS web server. |
CVE-2018-14860 | Critical | 9.1 | 2019-07-03 | Improper sanitization of dynamic user expressions in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier allows authenticated privileged users… |
CVE-2018-14859 | High | 8.1 | 2019-07-03 | Incorrect access control in the password reset component in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier allows authenticated users to… |
CVE-2018-14865 | Medium | 6.5 | 2019-07-03 | Report engine in Odoo Community 9.0 through 11.0 and earlier and Odoo Enterprise 9.0 through 11.0 and earlier does not use secure options when passing document… |
CVE-2018-14864 | Medium | 6.5 | 2019-07-03 | Incorrect access control in asset bundles in Odoo Community 9.0 through 11.0 and earlier and Odoo Enterprise 9.0 through 11.0 and earlier allows remote authent… |
CVE-2018-14863 | High | 8.1 | 2019-07-03 | Incorrect access control in the RPC framework in Odoo Community 8.0 through 11.0 and Odoo Enterprise 9.0 through 11.0 allows authenticated users to call privat… |
CVE-2018-14862 | Medium | 6.5 | 2019-07-03 | Incorrect access control in the mail templating system in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier allows authenticated internal us… |
CVE-2018-14861 | Medium | 6.5 | 2019-07-03 | Improper data access control in Odoo Community 10.0 and 11.0 and Odoo Enterprise 10.0 and 11.0 allows authenticated users to perform a CSV export of the secure… |
CVE-2018-14866 | Medium | 4.3 | 2019-07-03 | Incorrect access control in the TransientModel framework in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier allows authenticated attackers… |
CVE-2018-12715 | Medium | 6.1 | 2019-07-03 | DIGISOL DG-HR3400 devices have XSS via a modified SSID when the apssid value is unchanged. |
CVE-2018-18326 | High | 7.5 | 2019-07-03 | DNN (aka DotNetNuke) 9.2 through 9.2.2 incorrectly converts encryption key source values, resulting in lower than expected entropy. NOTE: this issue exists bec… |
CVE-2018-18325 | High | 7.5 | 2019-07-03 | DNN (aka DotNetNuke) 9.2 through 9.2.2 uses a weak encryption algorithm to protect input parameters. NOTE: this issue exists because of an incomplete fix for C… |
CVE-2018-15812 | High | 7.5 | 2019-07-03 | DNN (aka DotNetNuke) 9.2 through 9.2.1 incorrectly converts encryption key source values, resulting in lower than expected entropy. |
CVE-2018-15811 | High | 7.5 | 2019-07-03 | DNN (aka DotNetNuke) 9.2 through 9.2.1 uses a weak encryption algorithm to protect input parameters. |
CVE-2018-12250 | High | 7.2 | 2019-07-03 | An issue was discovered in Elite CMS Pro 2.01. In /admin/add_sidebar.php, the ?page= parameter is vulnerable to SQL injection. |
CVE-2018-11686 | Critical | 9.8 | 2019-07-03 | The Publish Service in FlexPaper (later renamed FlowPaper) 2.3.6 allows remote code execution via setup.php and change_config.php. |
CVE-2018-10986 | High | 8.8 | 2019-07-03 | OX Guard 2.8.0 has CSRF. |
CVE-2018-11425 | Critical | 9.8 | 2019-07-03 | Memory corruption issue was discovered in Moxa OnCell G3470A-LTE Series version 1.6 Build 18021314 and prior, a different vulnerability than CVE-2018-11424. |
CVE-2018-11424 | High | 7.5 | 2019-07-03 | There is Memory corruption in the web interface of Moxa OnCell G3470A-LTE Series version 1.6 Build 18021314 and prior, a different vulnerability than CVE-2018-… |
CVE-2018-11423 | High | 7.5 | 2019-07-03 | There is Memory corruption in the web interface Moxa OnCell G3100-HSPA Series version 1.6 Build 17100315 and prior, different vulnerability than CVE-2018-11420. |
CVE-2018-11422 | Critical | 9.8 | 2019-07-03 | Moxa OnCell G3100-HSPA Series version 1.6 Build 17100315 and prior use a proprietary configuration protocol that does not provide confidentiality, integrity, a… |
CVE-2018-11421 | Critical | 9.8 | 2019-07-03 | Moxa OnCell G3100-HSPA Series version 1.6 Build 17100315 and prior use a proprietary monitoring protocol that does not provide confidentiality, integrity, and… |
CVE-2018-11420 | Critical | 9.8 | 2019-07-03 | There is Memory corruption in the web interface of Moxa OnCell G3100-HSPA Series version 1.5 Build 17042015 and prio,r a different vulnerability than CVE-2018-… |
CVE-2018-11317 | Medium | 6.1 | 2019-07-03 | Subrion CMS before 4.1.4 has XSS. |
CVE-2018-11227 | Medium | 6.1 | 2019-07-03 | Monstra CMS 3.0.4 and earlier has XSS via index.php. |
CVE-2018-11215 | Critical | 9.8 | 2019-07-03 | Remote code execution is possible in Cloudera Data Science Workbench version 1.3.0 and prior releases via unspecified attack vectors. |
CVE-2018-11427 | High | 8.8 | 2019-07-03 | CSRF tokens are not used in the web application of Moxa OnCell G3100-HSPA Series version 1.4 Build 16062919 and prior, which makes it possible to perform CSRF… |
CVE-2018-11426 | Critical | 9.8 | 2019-07-03 | A weak Cookie parameter is used in the web application of Moxa OnCell G3100-HSPA Series version 1.4 Build 16062919 and prior. An attacker can brute force param… |
CVE-2018-20849 | Medium | 6.1 | 2019-06-30 | Arastta eCommerce 1.6.2 is vulnerable to XSS via the PATH_INFO to the login/ URI. |
CVE-2018-20848 | High | 8.8 | 2019-06-30 | Advisto PEEL SHOPPING 9.0.0 has CSRF via en/achat/caddie_ajout.php and en/achat/caddie_affichage.php, as demonstrated by an XSS payload in the couleurId[0] par… |
CVE-2018-20814 | Medium | 6.1 | 2019-06-28 | An XSS issue was found with Psaldownload.cgi in Pulse Secure Pulse Connect Secure (PCS) 8.3R2 before 8.3R2 and Pulse Policy Secure (PPS) 5.4RX before 5.4R2. Th… |
CVE-2018-20813 | Critical | 9.8 | 2019-06-28 | An input validation issue has been found with login_meeting.cgi in Pulse Secure Pulse Connect Secure 8.3RX before 8.3R2. |
CVE-2018-20812 | High | 7.5 | 2019-06-28 | An information exposure issue where IPv6 DNS traffic would be sent outside of the VPN tunnel (when Traffic Enforcement was enabled) exists in Pulse Secure Puls… |
CVE-2018-20811 | Medium | 5.3 | 2019-06-28 | A hidden RPC service issue was found with Pulse Secure Pulse Connect Secure 8.3RX before 8.3R2 and 8.1RX before 8.1R12. |
CVE-2018-20810 | Critical | 9.8 | 2019-06-28 | Session data between cluster nodes during cluster synchronization is not properly encrypted in Pulse Secure Pulse Connect Secure (PCS) 8.3RX before 8.3R2 and P… |
CVE-2018-20809 | High | 7.5 | 2019-06-28 | A crafted message can cause the web server to crash with Pulse Secure Pulse Connect Secure (PCS) 8.3RX before 8.3R5 and Pulse Policy Secure 5.4RX before 5.4R5… |
CVE-2018-20808 | Medium | 6.1 | 2019-06-28 | An XSS issue has been found with rd.cgi in Pulse Secure Pulse Connect Secure 8.3RX before 8.3R3 due to improper header sanitization. This is not applicable to… |
CVE-2018-20807 | Medium | 6.1 | 2019-06-28 | An XSS issue has been found in welcome.cgi in Pulse Secure Pulse Connect Secure (PCS) 8.1.x before 8.1R12, 8.2.x before 8.2R9, and 8.3.x before 8.3R3 due to on… |
CVE-2018-17560 | Medium | 6.1 | 2019-06-28 | The admin interface of the Grouptime Teamwire Client 1.5.1 prior to 1.9.0 on-premises messenger server allows stored XSS. All backend versions prior to prod-20… |
CVE-2018-17170 | High | 8.1 | 2019-06-28 | Grouptime Teamwire Desktop Client 1.5.1 prior to 1.9.0 on Windows allows code injection via a template, leading to remote code execution. All backend versions… |
CVE-2018-14918 | High | 7.5 | 2019-06-28 | LOYTEC LGATE-902 6.3.2 devices allow Directory Traversal. |
CVE-2018-14916 | Critical | 9.1 | 2019-06-28 | LOYTEC LGATE-902 6.3.2 devices allow Arbitrary file deletion. |
CVE-2018-14887 | Medium | 6.5 | 2019-06-28 | Improper Host header sanitization in the dbfilter routing component in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier allows a remote att… |
CVE-2018-14886 | Medium | 4.9 | 2019-06-28 | The module-description renderer in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier does not disable RST's local file inclusion, which allo… |
CVE-2018-14885 | Critical | 9.8 | 2019-06-28 | Incorrect access control in the database manager component in Odoo Community 10.0 and 11.0 and Odoo Enterprise 10.0 and 11.0 allows a remote attacker to restor… |
CVE-2018-14868 | Medium | 6.5 | 2019-06-28 | Incorrect access control in the Password Encryption module in Odoo Community 9.0 and Odoo Enterprise 9.0 allows authenticated users to change the password of o… |
CVE-2018-14867 | Medium | 5.3 | 2019-06-28 | Incorrect access control in the portal messaging system in Odoo Community 9.0 and 10.0 and Odoo Enterprise 9.0 and 10.0 allows remote attackers to post message… |
CVE-2018-15519 | Critical | 9.8 | 2019-06-28 | Various Lexmark devices have a Buffer Overflow (issue 1 of 2). |
CVE-2018-14919 | Medium | 6.1 | 2019-06-28 | LOYTEC LGATE-902 6.3.2 devices allow XSS. |
CVE-2018-15520 | Critical | 9.8 | 2019-06-28 | Various Lexmark devices have a Buffer Overflow (issue 2 of 2). |
CVE-2018-15555 | Critical | 9.8 | 2019-06-28 | On Telus Actiontec WEB6000Q v1.1.02.22 devices, an attacker can login with root level access with the user "root" and password "admin" by using the enabled onb… |
CVE-2018-6177 | Medium | 4.3 | 2019-06-27 | Information leak in media engine in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to leak cross-origin data via a crafted HTML page. |