2018 CVEs (page 153)
Page 153 of 162 — CVEs published in 2018, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2018-0847 | Medium | 4.3 | 2018-02-15 | Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, and Windows 10 Gold, 1511… |
CVE-2018-0846 | High | 7.8 | 2018-02-15 | The Windows Common Log File System (CLFS) driver in Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2008 SP2 and R2 SP1, Windows Server 2012 and R2, Wind… |
CVE-2018-0844 | High | 7.8 | 2018-02-15 | The Windows Common Log File System (CLFS) driver in Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2008 SP2 and R2 SP1, Windows Server 2012 and R2, Wind… |
CVE-2018-0843 | Medium | 4.7 | 2018-02-15 | The Windows kernel in Windows 10 version 1709 and Windows Server, version 1709 allows an information disclosure vulnerability due to how objects in memory are… |
CVE-2018-0842 | High | 7.0 | 2018-02-15 | Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2008 SP2 and R2 SP1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703 and 1709, Windows Serv… |
CVE-2018-0841 | High | 8.8 | 2018-02-15 | Microsoft Office 2016 Click-to-Run allows a remote code execution vulnerability due to how objects are handled in memory, aka "Office Remote Code Execution Vul… |
CVE-2018-0840 | High | 7.5 | 2018-02-15 | Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, and Internet Explorer and… |
CVE-2018-0839 | Medium | 4.3 | 2018-02-15 | Microsoft Edge in Microsoft Windows 10 1703 allows information disclosure, due to how Edge handles objects in memory, aka "Microsoft Edge Information Disclosur… |
CVE-2018-0838 | High | 7.5 | 2018-02-15 | Microsoft Edge and ChakraCore in Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows remote code execution, due to how the script… |
CVE-2018-0837 | High | 7.5 | 2018-02-15 | Microsoft Edge and ChakraCore in Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows remote code execution, due to how the script… |
CVE-2018-0836 | High | 7.5 | 2018-02-15 | Microsoft Edge and ChakraCore in Microsoft Windows 10 1703 and 1709 allows remote code execution, due to how the scripting engine handles objects in memory, ak… |
CVE-2018-0835 | High | 7.5 | 2018-02-15 | Microsoft Edge and ChakraCore in Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows remote code execution, due to how the script… |
CVE-2018-0834 | High | 7.5 | 2018-02-15 | Microsoft Edge and ChakraCore in Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows remote code execution, due to how the script… |
CVE-2018-0833 | Medium | 5.3 | 2018-02-15 | The Microsoft Server Message Block 2.0 and 3.0 (SMBv2/SMBv3) client in Windows 8.1 and RT 8.1 and Windows Server 2012 R2 allows a denial of service vulnerabili… |
CVE-2018-0832 | Medium | 4.7 | 2018-02-15 | The Windows kernel in Windows 8.1 and RT 8.1, Windows Server 2012 R2, Windows 10 Gold, 1511, 1607, 1703 and 1709, Windows Server 2016 and Windows Server, versi… |
CVE-2018-0831 | High | 7.8 | 2018-02-15 | The Windows kernel in Windows 10 versions 1607, 1703 and 1709, Windows Server 2016 and Windows Server, version 1709 allows an elevation of privilege vulnerabil… |
CVE-2018-0830 | Medium | 4.7 | 2018-02-15 | The Windows kernel in Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2008 SP2 and R2 SP1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703… |
CVE-2018-0829 | Medium | 4.7 | 2018-02-15 | The Windows kernel in Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2008 SP2 and R2 SP1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703… |
CVE-2018-0828 | High | 7.8 | 2018-02-15 | Windows 10 version 1607 and Windows Server 2016 allow an elevation of privilege vulnerability due to how the MultiPoint management account password is stored… |
CVE-2018-0827 | Medium | 5.3 | 2018-02-15 | Windows Scripting Host (WSH) in Windows 10 versions 1703 and 1709 and Windows Server, version 1709 allows a Device Guard security feature bypass vulnerability… |
CVE-2018-0826 | High | 7.0 | 2018-02-15 | Windows Storage Services in Windows 10 versions 1511, 1607, 1703 and 1709, Windows Server 2016 and Windows Server, version 1709 allows an elevation of privileg… |
CVE-2018-0825 | High | 7.5 | 2018-02-15 | StructuredQuery in Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2008 SP2 and R2 SP1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703 and… |
CVE-2018-0823 | High | 7.0 | 2018-02-15 | The Named Pipe File System in Windows 10 version 1709 and Windows Server, version 1709 allows an elevation of privilege vulnerability due to the way the Named… |
CVE-2018-0822 | High | 7.0 | 2018-02-15 | NTFS in Windows 10 Gold, 1511, 1607, 1703 and 1709, Windows Server 2016 and Windows Server, version 1709 allows an elevation of privilege vulnerability due to… |
CVE-2018-0821 | High | 7.0 | 2018-02-15 | AppContainer in Windows 10 Gold, 1511, 1607, 1703 and 1709, Windows Server 2016 and Windows Server, version 1709 allows an elevation of privilege vulnerability… |
CVE-2018-0820 | High | 7.8 | 2018-02-15 | The Windows kernel in Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2008 SP2 and R2 SP1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703… |
CVE-2018-0810 | Medium | 4.7 | 2018-02-15 | The Windows kernel in Windows 7 SP1, Windows Server 2008 SP2 and R2, and Windows Server 2012 allows an information disclosure vulnerability due to the way memo… |
CVE-2018-0809 | High | 7.0 | 2018-02-15 | The Windows kernel in Windows 10, versions 1703 and 1709, and Windows Server, version 1709 allows an elevation of privilege vulnerability due to the way object… |
CVE-2018-0771 | Medium | 4.3 | 2018-02-15 | Microsoft Edge in Microsoft Windows 10 1607, 1703, and Windows Server 2016 allows a security feature bypass, due to how Edge handles different-origin requests… |
CVE-2018-0763 | Low | 3.1 | 2018-02-15 | Microsoft Edge in Microsoft Windows 10 1703 and 1709 allows information disclosure, due to how Edge handles objects in memory, aka "Microsoft Edge Information… |
CVE-2018-0761 | Medium | 5.5 | 2018-02-15 | The Microsoft Windows Embedded OpenType (EOT) font engine in Microsoft Windows 7 SP1 and Windows Server 2008 R2 allows information disclosure, due to how the W… |
CVE-2018-0760 | Medium | 5.5 | 2018-02-15 | The Microsoft Windows Embedded OpenType (EOT) font engine in Microsoft Windows 7 SP1, Windows Server 2008 R2, and Windows Server 2012 allows information disclo… |
CVE-2018-0757 | Medium | 4.7 | 2018-02-15 | The Windows kernel in Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2008 SP2 and R2 SP1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703… |
CVE-2018-0756 | High | 7.8 | 2018-02-15 | The Windows kernel in Windows 10 Gold, 1511, 1607, 1703 and 1709, Windows Server 2016 and Windows Server, version 1709 allows an elevation of privilege vulnera… |
CVE-2018-0755 | Medium | 5.5 | 2018-02-15 | The Microsoft Windows Embedded OpenType (EOT) font engine in Microsoft Windows 7 SP1 and Windows Server 2008 R2 allows information disclosure, due to how the W… |
CVE-2018-0742 | High | 7.8 | 2018-02-15 | The Windows kernel in Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2008 SP2 and R2 SP1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703… |
CVE-2018-7039 | Critical | 9.8 | 2018-02-14 | CCN-lite 2.0.0 Beta allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact because the ccnl_ndntlv_pr… |
CVE-2018-7034 | High | 7.5 | 2018-02-14 | TRENDnet TEW-751DR v1.03B03, TEW-752DRU v1.03B01, and TEW733GR v1.03B01 devices allow authentication bypass via an AUTHORIZED_GROUP=1 value, as demonstrated by… |
CVE-2018-7032 | High | 7.5 | 2018-02-14 | webcheckout in myrepos through 1.20171231 does not sanitize URLs that are passed to git clone, allowing a malicious website operator or a MitM attacker to take… |
CVE-2018-1287 | Critical | 9.8 | 2018-02-14 | In Apache JMeter 2.X and 3.X, when using Distributed Test only (RMI based), jmeter server binds RMI Registry to wildcard host. This could allow an attacker to… |
CVE-2018-2396 | Medium | 6.5 | 2018-02-14 | Under certain conditions a malicious user can prevent legitimate users from accessing the SAP Internet Graphics Server (IGS), 7.20, 7.20EXT, 7.45, 7.49, 7.53… |
CVE-2018-2395 | High | 8.8 | 2018-02-14 | Under certain conditions a malicious user may retrieve information on SAP Internet Graphic Server (IGS), 7.20, 7.20EXT, 7.45, 7.49, 7.53, overwrite existing im… |
CVE-2018-2394 | Medium | 6.5 | 2018-02-14 | Under certain conditions an unauthenticated malicious user can prevent legitimate users from accessing the SAP Internet Graphics Server (IGS), 7.20, 7.20EXT, 7… |
CVE-2018-2393 | High | 7.5 | 2018-02-14 | Under certain conditions SAP Internet Graphics Server (IGS) 7.20, 7.20EXT, 7.45, 7.49, 7.53, fails to validate XML External Entity appropriately causing the SA… |
CVE-2018-2392 | High | 7.5 | 2018-02-14 | Under certain conditions SAP Internet Graphics Server (IGS) 7.20, 7.20EXT, 7.45, 7.49, 7.53, fails to validate XML External Entity appropriately causing the SA… |
CVE-2018-2391 | Medium | 6.5 | 2018-02-14 | Under certain conditions a malicious user can prevent legitimate users from accessing the SAP Internet Graphics Server (IGS), 7.20, 7.20EXT, 7.45, 7.49, 7.53… |
CVE-2018-2390 | Medium | 6.5 | 2018-02-14 | Under certain conditions a malicious user can prevent legitimate users from accessing the SAP Internet Graphics Server (IGS), 7.20, 7.20EXT, 7.45, 7.49, 7.53… |
CVE-2018-2389 | Medium | 5.7 | 2018-02-14 | Under certain conditions a malicious user can inject log files of SAP Internet Graphics Server (IGS), 7.20, 7.20EXT, 7.45, 7.49, 7.53, hiding important informa… |
CVE-2018-2388 | Medium | 6.1 | 2018-02-14 | Stored cross-site scripting vulnerability in SAP internet Graphics Server, 7.20, 7.20EXT, 7.45, 7.49, 7.53. |
CVE-2018-2387 | Medium | 6.5 | 2018-02-14 | A vulnerability in the SAP internet Graphics Server, 7.20, 7.20EXT, 7.45, 7.49, 7.53, could allow a malicious user to obtain information on ports, which is not… |
CVE-2018-2386 | Medium | 6.5 | 2018-02-14 | Under certain conditions a malicious user provoking an out of bounds buffer overflow can prevent legitimate users from accessing the SAP Internet Graphics Serv… |
CVE-2018-2385 | Medium | 6.5 | 2018-02-14 | Under certain conditions a malicious user provoking a divide by zero crash can prevent legitimate users from accessing the SAP Internet Graphics Server, 7.20… |
CVE-2018-2384 | Medium | 6.5 | 2018-02-14 | Under certain conditions a malicious user provoking a Null Pointer dereference can prevent legitimate users from accessing the SAP Internet Graphics Server, 7… |
CVE-2018-2383 | Medium | 6.1 | 2018-02-14 | Reflected cross-site scripting vulnerability in SAP internet Graphics Server, 7.20, 7.20EXT, 7.45, 7.49, 7.53. |
CVE-2018-2382 | Medium | 6.5 | 2018-02-14 | A vulnerability in the SAP internet Graphics Server, 7.20, 7.20EXT, 7.45, 7.49, 7.53, could allow a malicious user to store graphics in a controlled area and a… |
CVE-2018-2381 | High | 8.8 | 2018-02-14 | SAP ERP Financials Information System (SAP_APPL 6.00, 6.02, 6.03, 6.04, 6.05, 6.06, 6.16; SAP_FIN 6.17, 6.18, 7.00, 7.20, 7.30 S4CORE 1.00, 1.01, 1.02) does no… |
CVE-2018-2379 | Medium | 6.5 | 2018-02-14 | In SAP HANA Extended Application Services, 1.0, an unauthenticated user could test if a given username is valid by evaluating error messages of a specific endp… |
CVE-2018-2378 | Medium | 6.5 | 2018-02-14 | In SAP HANA Extended Application Services, 1.0, unauthorized users can read statistical data about deployed applications including resource consumption. |
CVE-2018-2377 | Medium | 6.5 | 2018-02-14 | In SAP HANA Extended Application Services, 1.0, some general server statistics and status information could be retrieved by unauthorized users. |
CVE-2018-2376 | High | 8.1 | 2018-02-14 | In SAP HANA Extended Application Services, 1.0, a controller user who has SpaceAuditor authorization in a specific space could retrieve application environment… |
CVE-2018-2375 | High | 8.1 | 2018-02-14 | In SAP HANA Extended Application Services, 1.0, a controller user who has SpaceAuditor authorization in a specific space could retrieve application environment… |
CVE-2018-2374 | Medium | 6.5 | 2018-02-14 | In SAP HANA Extended Application Services, 1.0, a controller user who has SpaceAuditor authorization in a specific space could retrieve sensitive application d… |
CVE-2018-2373 | High | 7.5 | 2018-02-14 | Under certain circumstances, a specific endpoint of the Controller's API could be misused by unauthenticated users to execute SQL statements that deliver infor… |
CVE-2018-2372 | Medium | 6.5 | 2018-02-14 | A plain keystore password is written to a system log file in SAP HANA Extended Application Services, 1.0, which could endanger confidentiality of SSL communica… |
CVE-2018-2371 | Medium | 6.1 | 2018-02-14 | The SAML 2.0 service provider of SAP Netweaver AS Java Web Application, 7.50, does not sufficiently encode user controlled inputs, which results in Cross-Site… |
CVE-2018-2370 | Medium | 5.3 | 2018-02-14 | Server Side Request Forgery (SSRF) vulnerability in SAP Central Management Console, BI Launchpad and Fiori BI Launchpad, 4.10, from 4.20, from 4.30, could allo… |
CVE-2018-2369 | Medium | 5.3 | 2018-02-14 | Under certain conditions SAP HANA, 1.00, 2.00, allows an unauthenticated attacker to access information which would otherwise be restricted. An attacker can mi… |
CVE-2018-2364 | Medium | 6.1 | 2018-02-14 | SAP CRM WebClient UI 7.01, 7.31, 7.46, 7.47, 7.48, 8.00, 8.01, S4FND 1.02, does not sufficiently validate and/or encode hidden fields, resulting in Cross-Site… |
CVE-2018-6910 | High | 7.5 | 2018-02-13 | DedeCMS 5.7 allows remote attackers to discover the full path via a direct request for include/downmix.inc.php or inc/inc_archives_functions.php. |
CVE-2018-5459 | Critical | 9.8 | 2018-02-13 | An Improper Authentication issue was discovered in WAGO PFC200 Series 3S CoDeSys Runtime versions 2.3.X and 2.4.X. An attacker can execute different unauthenti… |
CVE-2018-6954 | High | 7.8 | 2018-02-13 | systemd-tmpfiles in systemd through 237 mishandles symlinks present in non-terminal path components, which allows local users to obtain ownership of arbitrary… |
CVE-2018-6953 | Critical | 9.8 | 2018-02-13 | In CCN-lite 2, the Parser of NDNTLV does not verify whether a certain component's length field matches the actual component length, which has a resultant buffe… |
CVE-2018-1383 | Critical | 9.1 | 2018-02-13 | A software logic bug creates a vulnerability in an AIX 6.1, 7.1, and 7.2 daemon which could allow a user with root privileges on one system, to obtain root acc… |
CVE-2018-6952 | High | 7.5 | 2018-02-13 | A double free exists in the another_hunk function in pch.c in GNU patch through 2.7.6. |
CVE-2018-6951 | High | 7.5 | 2018-02-13 | An issue was discovered in GNU patch through 2.7.6. There is a segmentation fault, associated with a NULL pointer dereference, leading to a denial of service i… |
CVE-2018-6948 | Critical | 9.8 | 2018-02-13 | In CCN-lite 2, the function ccnl_prefix_to_str_detailed can cause a buffer overflow, when writing a prefix to the buffer buf. The maximal size of the prefix is… |
CVE-2018-6928 | Critical | 9.8 | 2018-02-13 | PHP Scripts Mall News Website Script 2.0.4 has SQL Injection via a search term. |
CVE-2018-0488 | Critical | 9.8 | 2018-02-13 | ARM mbed TLS before 1.3.22, before 2.1.10, and before 2.7.0, when the truncated HMAC extension and CBC are used, allows remote attackers to execute arbitrary c… |
CVE-2018-0487 | Critical | 9.8 | 2018-02-13 | ARM mbed TLS before 1.3.22, before 2.1.10, and before 2.7.0 allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow) vi… |
CVE-2018-6911 | Critical | 9.8 | 2018-02-13 | The VBWinExec function in Node\AspVBObj.dll in Advantech WebAccess 8.3.0 allows remote attackers to execute arbitrary OS commands via a single argument (aka th… |
CVE-2018-6293 | High | 7.5 | 2018-02-13 | Arbitrary File Read in Saperion Web Client version 7.5.2 83166. |
CVE-2018-6292 | Critical | 9.8 | 2018-02-13 | Remote Code Execution in Saperion Web Client version 7.5.2 83166. |
CVE-2018-1297 | Critical | 9.8 | 2018-02-13 | When using Distributed Test only (RMI based), Apache JMeter 2.x and 3.x uses an unsecured RMI connection. This could allow an attacker to get Access to JMeterE… |
CVE-2018-6942 | Medium | 6.5 | 2018-02-13 | An issue was discovered in FreeType 2 through 2.9. A NULL pointer dereference in the Ins_GETVARIATION() function within ttinterp.c could lead to DoS via a craf… |
CVE-2018-6930 | Medium | 6.5 | 2018-02-13 | A stack-based buffer over-read in the ComputeResizeImage function in the MagickCore/accelerate.c file of ImageMagick 7.0.7-22 allows a remote attacker to cause… |
CVE-2018-1214 | High | 7.0 | 2018-02-12 | Dell EMC SupportAssist Enterprise version 1.1 creates a local Windows user account named "OMEAdapterUser" with a default password as part of the installation p… |
CVE-2018-6927 | High | 7.8 | 2018-02-12 | The futex_requeue function in kernel/futex.c in the Linux kernel before 4.14.15 might allow attackers to cause a denial of service (integer overflow) or possib… |
CVE-2018-6926 | High | 7.2 | 2018-02-12 | In app/Controller/ServersController.php in MISP 2.4.87, a server setting permitted the override of a path variable on certain Red Hed Enterprise Linux and Cent… |
CVE-2018-6893 | Critical | 9.8 | 2018-02-12 | controllers/member/Api.php in dayrui FineCms 5.2.0 has SQL Injection: a request with s=member,c=api,m=checktitle, and the parameter 'module' with a SQL stateme… |
CVE-2018-6506 | Medium | 4.8 | 2018-02-12 | Cross-Site Scripting (XSS) exists in the Add Forum feature in the Administrative Panel in miniBB 3.2.2 via crafted use of an onload attribute of an SVG element… |
CVE-2018-6889 | High | 8.8 | 2018-02-12 | An issue was discovered in Typesetter 5.1. It suffers from a Host header injection vulnerability, Using this attack, a malicious user can poison the web cache… |
CVE-2018-6888 | High | 8.0 | 2018-02-12 | An issue was discovered in Typesetter 5.1. The User Permissions page (aka Admin/Users) suffers from critical flaw of Cross Site Request forgery: using a forged… |
CVE-2018-6881 | Medium | 5.3 | 2018-02-12 | EmpireCMS 6.6 allows remote attackers to discover the full path via an array value for a parameter to admin/tool/ShowPic.php. |
CVE-2018-6880 | Medium | 5.3 | 2018-02-12 | EmpireCMS 6.6 through 7.2 allows remote attackers to discover the full path via an array value for a parameter to class/connect.php. |
CVE-2018-6864 | Medium | 5.4 | 2018-02-12 | Cross Site Scripting (XSS) exists in PHP Scripts Mall Multi religion Responsive Matrimonial 4.7.2 via a user profile update parameter. |
CVE-2018-6863 | Critical | 9.8 | 2018-02-12 | SQL Injection exists in PHP Scripts Mall Select Your College Script 2.0.2 via a Login Parameter. |
CVE-2018-6862 | Medium | 5.4 | 2018-02-12 | Cross Site Scripting (XSS) exists in PHP Scripts Mall Bitcoin MLM Software 1.0.2 via a profile field. |
CVE-2018-6861 | Medium | 5.4 | 2018-02-12 | Cross Site Scripting (XSS) exists in PHP Scripts Mall Lawyer Search Script 1.0.2 via a profile update parameter. |
CVE-2018-6860 | High | 8.8 | 2018-02-12 | Arbitrary File Upload and Remote Code Execution exist in PHP Scripts Mall Schools Alert Management Script 2.0.2 via a profile picture. |
CVE-2018-6858 | Medium | 5.4 | 2018-02-12 | Cross Site Scripting (XSS) exists in PHP Scripts Mall Facebook Clone Script. |