2018 CVEs (page 154)
Page 154 of 162 — CVEs published in 2018, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2018-6845 | Medium | 6.1 | 2018-02-12 | PHP Scripts Mall Multi Language Olx Clone Script 2.0.6 has XSS via the Leave Comment field. |
CVE-2018-6912 | Medium | 6.5 | 2018-02-12 | The decode_plane function in libavcodec/utvideodec.c in FFmpeg through 3.4.2 allows remote attackers to cause a denial of service (out of array read) via a cra… |
CVE-2018-6892 | Critical | 9.8 | 2018-02-11 | An issue was discovered in CloudMe before 1.11.0. An unauthenticated remote attacker that can connect to the "CloudMe Sync" client application listening on por… |
CVE-2018-6891 | Medium | 6.1 | 2018-02-11 | Bookly #1 WordPress Booking Plugin Lite before 14.5 has XSS via a jQuery.ajax request to ng-payment_details_dialog.js. |
CVE-2018-1000062 | Medium | 4.4 | 2018-02-09 | WonderCMS version 2.4.0 contains a Stored Cross-Site Scripting on File Upload through SVG vulnerability in uploadFileAction(), 'svg' => 'image/svg+xml' that ca… |
CVE-2018-1000060 | Critical | 9.8 | 2018-02-09 | Sensu, Inc. Sensu Core version Before 1.2.0 & before commit 46ff10023e8cbf1b6978838f47c51b20b98fe30b contains a CWE-522 vulnerability in Sensu::Utilities.redac… |
CVE-2018-1000059 | Critical | 9.8 | 2018-02-09 | ValidFormBuilder version 4.5.4 contains a PHP Object Injection vulnerability in Valid Form unserialize method that can result in Possible to execute unauthoris… |
CVE-2018-1000058 | High | 8.8 | 2018-02-09 | Jenkins Pipeline: Supporting APIs Plugin 2.17 and earlier have an arbitrary code execution due to incomplete sandbox protection: Methods related to Java deseri… |
CVE-2018-1000057 | Medium | 4.3 | 2018-02-09 | Jenkins Credentials Binding Plugin 1.14 and earlier masks passwords it provides to build processes in their build logs. Jenkins however transforms provided pas… |
CVE-2018-1000056 | High | 8.3 | 2018-02-09 | Jenkins JUnit Plugin 1.23 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers with user permissions… |
CVE-2018-1000055 | High | 8.3 | 2018-02-09 | Jenkins Android Lint Plugin 2.5 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers with user permi… |
CVE-2018-1000054 | High | 8.3 | 2018-02-09 | Jenkins CCM Plugin 3.1 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers with user permissions in… |
CVE-2018-1000053 | High | 8.8 | 2018-02-09 | LimeSurvey version 3.0.0-beta.3+17110 contains a Cross ite Request Forgery (CSRF) vulnerability in Theme Uninstallation that can result in CSRF causing LimeSur… |
CVE-2018-1000052 | High | 7.5 | 2018-02-09 | fmtlib version prior to version 4.1.0 (before commit 0555cea5fc0bf890afe0071a558e44625a34ba85) contains a Memory corruption (SIGSEGV), CWE-134 vulnerability in… |
CVE-2018-1000051 | High | 7.8 | 2018-02-09 | Artifex Mupdf version 1.12.0 contains a Use After Free vulnerability in fz_keep_key_storable that can result in DOS / Possible code execution. This attack appe… |
CVE-2018-1000050 | High | 8.8 | 2018-02-09 | Sean Barrett stb_vorbis version 1.12 and earlier contains a Buffer Overflow vulnerability in All vorbis decoding paths. that can result in memory corruption, d… |
CVE-2018-1000049 | High | 7.5 | 2018-02-09 | Nanopool Claymore Dual Miner version 7.3 and earlier contains a remote code execution vulnerability by abusing the miner API. The flaw can be exploited only if… |
CVE-2018-1000048 | High | 8.8 | 2018-02-09 | NASA RtRetrievalFramework version v1.0 contains a CWE-502 vulnerability in Data retrieval functionality of RtRetrieval framework that can result in remote code… |
CVE-2018-1000047 | High | 8.8 | 2018-02-09 | NASA Kodiak version v1.0 contains a CWE-502 vulnerability in Kodiak library's data processing function that can result in remote code execution. This attack ap… |
CVE-2018-1000046 | High | 7.8 | 2018-02-09 | NASA Pyblock version v1.0 - v1.3 contains a CWE-502 vulnerability in Radar data parsing library that can result in remote code execution. This attack appear to… |
CVE-2018-1000045 | High | 7.8 | 2018-02-09 | NASA Singledop version v1.0 contains a CWE-502 vulnerability in NASA Singledop library (Weather data) that can result in remote code execution. This attack app… |
CVE-2018-1000044 | Critical | 9.8 | 2018-02-09 | Security Onion Solutions Squert version 1.1.1 through 1.6.7 contains a SQL Injection vulnerability in .inc/callback.php that can result in execution of SQL com… |
CVE-2018-1000043 | Critical | 9.8 | 2018-02-09 | Security Onion Solutions Squert version 1.0.1 through 1.6.7 contains a CWE-78: Improper Neutralization of Special Elements used in an OS Command (OS Command In… |
CVE-2018-1000042 | Critical | 9.8 | 2018-02-09 | Security Onion Solutions Squert version 1.3.0 through 1.6.7 contains a CWE-78: Improper Neutralization of Special Elements used in an OS Command (OS Command In… |
CVE-2018-1000041 | High | 8.8 | 2018-02-09 | GNOME librsvg version before commit c6ddf2ed4d768fd88adbea2b63f575cd523022ea contains a Improper input validation vulnerability in rsvg-io.c that can result in… |
CVE-2018-1000035 | High | 7.8 | 2018-02-09 | A heap-based buffer overflow exists in Info-Zip UnZip version <= 6.00 in the processing of password-protected archives that allows an attacker to perform a den… |
CVE-2018-1000034 | Critical | 9.1 | 2018-02-09 | An out-of-bounds read exists in Info-Zip UnZip version 6.10c22 that allows an attacker to perform a denial of service and read sensitive memory. |
CVE-2018-1000033 | Critical | 9.1 | 2018-02-09 | An out-of-bounds read exists in Info-Zip UnZip version 6.10c22 that allows an attacker to perform a denial of service and read sensitive memory. |
CVE-2018-1000032 | High | 7.8 | 2018-02-09 | A heap-based buffer overflow exists in Info-Zip UnZip version 6.10c22 that allows an attacker to perform a denial of service or to possibly achieve code execut… |
CVE-2018-1000031 | High | 7.8 | 2018-02-09 | A heap-based buffer overflow exists in Info-Zip UnZip version 6.10c22 that allows an attacker to perform a denial of service or to possibly achieve code execut… |
CVE-2018-1000029 | Medium | 6.1 | 2018-02-09 | mcholste Enterprise Log Search and Archive (ELSA) version revision 1205, commit 2cc17f1 and earlier contains a Cross Site Scripting (XSS) vulnerability in inde… |
CVE-2018-1000028 | High | 7.4 | 2018-02-09 | Linux kernel version after commit bdcf0a423ea1 - 4.15-rc4+, 4.14.8+, 4.9.76+, 4.4.111+ contains a Incorrect Access Control vulnerability in NFS server (nfsd) t… |
CVE-2018-1000027 | High | 7.5 | 2018-02-09 | The Squid Software Foundation Squid HTTP Caching Proxy version prior to version 4.0.23 contains a NULL Pointer Dereference vulnerability in HTTP Response X-For… |
CVE-2018-1000026 | High | 7.7 | 2018-02-09 | Linux Linux kernel version at least v4.8 onwards, probably well before contains a Insufficient input validation vulnerability in bnx2x network card driver that… |
CVE-2018-1000025 | High | 8.1 | 2018-02-09 | Jerome Gamez Firebase Admin SDK for PHP version from 3.2.0 to 3.8.0 contains a Incorrect Access Control vulnerability in src/Firebase/Auth/IdTokenVerifier.php… |
CVE-2018-1000024 | High | 7.5 | 2018-02-09 | The Squid Software Foundation Squid HTTP Caching Proxy version 3.0 to 3.5.27, 4.0 to 4.0.22 contains a Incorrect Pointer Handling vulnerability in ESI Response… |
CVE-2018-1000023 | Medium | 5.3 | 2018-02-09 | Bitpay/insight-api Insight-api version 5.0.0 and earlier contains a CWE-20: input validation vulnerability in transaction broadcast endpoint that can result in… |
CVE-2018-1000022 | Medium | 5.3 | 2018-02-09 | Electrum Technologies GmbH Electrum Bitcoin Wallet version prior to version 3.0.5 contains a Missing Authorization vulnerability in JSONRPC interface that can… |
CVE-2018-1000021 | Medium | 5.0 | 2018-02-09 | GIT version 2.15.1 and earlier contains a Input Validation Error vulnerability in Client that can result in problems including messing up terminal configuratio… |
CVE-2018-1000020 | Medium | 6.1 | 2018-02-09 | OpenEMR version 5.0.0 contains a Cross Site Scripting (XSS) vulnerability in open-flash-chart.swf and _posteddata.php that can result in . This vulnerability a… |
CVE-2018-1000019 | High | 8.8 | 2018-02-09 | OpenEMR version 5.0.0 contains a OS Command Injection vulnerability in fax_dispatch.php that can result in OS command injection by an authenticated attacker wi… |
CVE-2018-5307 | Medium | 6.1 | 2018-02-09 | Multiple cross-site scripting (XSS) vulnerabilities in Sonatype Nexus Repository Manager (aka NXRM) 2.x before 2.14.6 allow remote attackers to inject arbitrar… |
CVE-2018-5306 | Medium | 6.1 | 2018-02-09 | Multiple cross-site scripting (XSS) vulnerabilities in Sonatype Nexus Repository Manager (aka NXRM) 3.x before 3.8 allow remote attackers to inject arbitrary w… |
CVE-2018-3607 | High | 8.8 | 2018-02-09 | XXXTreeNode method SQL injection remote code execution (RCE) vulnerabilities in Trend Micro Control Manager 6.0 could allow a remote attacker to execute arbitr… |
CVE-2018-3606 | High | 8.8 | 2018-02-09 | XXXStatusXXX, XXXSummary, TemplateXXX and XXXCompliance method SQL injection remote code execution (RCE) vulnerabilities in Trend Micro Control Manager 6.0 cou… |
CVE-2018-3605 | High | 8.8 | 2018-02-09 | TopXXX, ViolationXXX, and IncidentXXX method SQL injection remote code execution (RCE) vulnerabilities in Trend Micro Control Manager 6.0 could allow a remote… |
CVE-2018-3604 | High | 8.8 | 2018-02-09 | GetXXX method SQL injection remote code execution (RCE) vulnerabilities in Trend Micro Control Manager 6.0 could allow a remote attacker to execute arbitrary c… |
CVE-2018-3603 | High | 8.8 | 2018-02-09 | A CGGIServlet SQL injection remote code execution (RCE) vulnerability in Trend Micro Control Manager 6.0 could allow a remote attacker to execute arbitrary cod… |
CVE-2018-3602 | High | 8.8 | 2018-02-09 | An AdHocQuery_Processor SQL injection remote code execution (RCE) vulnerability in Trend Micro Control Manager 6.0 could allow a remote attacker to execute arb… |
CVE-2018-3601 | Critical | 9.8 | 2018-02-09 | A password hash usage authentication bypass vulnerability in Trend Micro Control Manager 6.0 could allow a remote attacker to bypass authentication on vulnerab… |
CVE-2018-3600 | Medium | 6.5 | 2018-02-09 | A external entity processing information disclosure (XXE) vulnerability in Trend Micro Control Manager 6.0 could allow a remote attacker to disclose sensitive… |
CVE-2018-6508 | High | 8.0 | 2018-02-09 | Puppet Enterprise 2017.3.x prior to 2017.3.3 are vulnerable to a remote execution bug when a specially crafted string was passed into the facter_task or puppet… |
CVE-2018-1307 | High | 8.1 | 2018-02-09 | In Apache jUDDI 3.2 through 3.3.4, if using the WADL2Java or WSDL2Java classes, which parse a local or remote XML document and then mediates the data structure… |
CVE-2018-6878 | Medium | 5.4 | 2018-02-09 | Cross Site Scripting (XSS) exists in the review section in PHP Scripts Mall Hot Scripts Clone Script Classified 3.1 via the title or description field. |
CVE-2018-6876 | Medium | 6.5 | 2018-02-09 | The OLEProperty class in ole/oleprop.cpp in libfpx 1.3.1-10, as used in ImageMagick 7.0.7-22 Q16 and other products, allows remote attackers to cause a denial… |
CVE-2018-1401 | Medium | 6.1 | 2018-02-09 | IBM WebSphere Portal 8.0, 8.5, and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI… |
CVE-2018-1368 | Medium | 4.4 | 2018-02-09 | IBM Security Guardium Database Activity Monitor 9.0, 9.1, and 9.5 could allow a local user with low privileges to view report pages and perform some actions th… |
CVE-2018-6827 | High | 8.1 | 2018-02-09 | VOBOT CLOCK before 0.99.30 devices do not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sens… |
CVE-2018-6826 | High | 7.5 | 2018-02-09 | An issue was discovered on VOBOT CLOCK before 0.99.30 devices. Cleartext HTTP is used to download a breakout program, and therefore man-in-the-middle attackers… |
CVE-2018-6825 | Critical | 9.8 | 2018-02-09 | An issue was discovered on VOBOT CLOCK before 0.99.30 devices. An SSH server exists with a hardcoded vobot account that has root access. |
CVE-2018-1298 | Medium | 5.9 | 2018-02-09 | A Denial of Service vulnerability was found in Apache Qpid Broker-J 7.0.0 in functionality for authentication of connections for AMQP protocols 0-8, 0-9, 0-91… |
CVE-2018-1053 | High | 7.0 | 2018-02-09 | In postgresql 9.3.x before 9.3.21, 9.4.x before 9.4.16, 9.5.x before 9.5.11, 9.6.x before 9.6.7 and 10.x before 10.2, pg_upgrade creates file in current workin… |
CVE-2018-1052 | Medium | 6.5 | 2018-02-09 | Memory disclosure vulnerability in table partitioning was found in postgresql 10.x before 10.2, allowing an authenticated attacker to read arbitrary bytes of s… |
CVE-2018-6872 | Medium | 5.5 | 2018-02-09 | The elf_parse_notes function in elf.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, allows remote attackers to… |
CVE-2018-6871 | Critical | 9.8 | 2018-02-09 | LibreOffice before 5.4.5 and 6.x before 6.0.1 allows remote attackers to read arbitrary files via =WEBSERVICE calls in a document, which use the COM.MICROSOFT… |
CVE-2018-6869 | Medium | 6.5 | 2018-02-09 | In ZZIPlib 0.13.68, there is an uncontrolled memory allocation and a crash in the __zzip_parse_root_directory function of zzip/zip.c. Remote attackers could le… |
CVE-2018-6789 | Critical | 9.8 | 2018-02-08 | An issue was discovered in the base64d function in the SMTP listener in Exim before 4.90.1. By sending a handcrafted message, a buffer overflow may happen. Thi… |
CVE-2018-6644 | High | 7.5 | 2018-02-08 | SBLIM Small Footprint CIM Broker (SFCB) 1.4.9 has a null pointer (DoS) vulnerability via a crafted POST request to the /cimom URI. |
CVE-2018-6180 | Critical | 9.8 | 2018-02-08 | A flaw in the profile section of Online Voting System 1.0 allows an unauthenticated user to set an arbitrary password for other accounts. |
CVE-2018-5550 | Medium | 6.1 | 2018-02-08 | Versions of Epson AirPrint released prior to January 19, 2018 contain a reflective cross-site scripting (XSS) vulnerability, which can allow untrusted users on… |
CVE-2018-1163 | Critical | 9.8 | 2018-02-08 | This vulnerability allows remote attackers to bypass authentication on vulnerable installations of Quest NetVault Backup 11.2.0.13. The specific flaw exists wi… |
CVE-2018-1162 | High | 8.1 | 2018-02-08 | This vulnerability allows remote attackers to create a denial-of-service condition on vulnerable installations of Quest NetVault Backup 11.2.0.13. Although aut… |
CVE-2018-1161 | Critical | 9.8 | 2018-02-08 | This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Quest NetVault Backup 11.2.0.13. Authentication is not requ… |
CVE-2018-1000030 | Low | 3.6 | 2018-02-08 | Python 2.7.14 is vulnerable to a Heap-Buffer-Overflow as well as a Heap-Use-After-Free. Python versions prior to 2.7.14 may also be vulnerable and it appears t… |
CVE-2018-6846 | Medium | 5.3 | 2018-02-08 | Z-BlogPHP 1.5.1 allows remote attackers to discover the full path via a direct request to zb_system/function/lib/upload.php. |
CVE-2018-0517 | High | 7.8 | 2018-02-08 | Untrusted search path vulnerability in Anshin net security for Windows Version 16.0.1.44 and earlier allows an attacker to gain privileges via a Trojan horse D… |
CVE-2018-0514 | Critical | 9.8 | 2018-02-08 | MP Form Mail CGI eCommerce Edition Ver 2.0.13 and earlier allows remote attackers to execute arbitrary OS commands via unspecified vectors. |
CVE-2018-0513 | Medium | 6.1 | 2018-02-08 | Cross-site scripting vulnerability in MTS Simple Booking C, MTS Simple Booking Business version 1.28.0 and earlier allows remote attackers to inject arbitrary… |
CVE-2018-0512 | Medium | 6.8 | 2018-02-08 | Devices with IP address setting tool "MagicalFinder" provided by I-O DATA DEVICE, INC. allow authenticated attackers to execute arbitrary OS commands via unspe… |
CVE-2018-6844 | Medium | 5.4 | 2018-02-08 | MyBB 1.8.14 has XSS via the Title or Description field on the Edit Forum screen. |
CVE-2018-6836 | Critical | 9.8 | 2018-02-08 | The netmonrec_comment_destroy function in wiretap/netmon.c in Wireshark through 2.4.4 performs a free operation on an uninitialized memory address, which allow… |
CVE-2018-6835 | Critical | 9.8 | 2018-02-08 | node/hooks/express/apicalls.js in Etherpad Lite before v1.6.3 mishandles JSONP, which allows remote attackers to bypass intended access restrictions. |
CVE-2018-6834 | Medium | 6.1 | 2018-02-08 | static/js/pad_utils.js in Etherpad Lite before v1.6.3 has XSS via window.location.href. |
CVE-2018-0140 | Medium | 6.5 | 2018-02-08 | A vulnerability in the spam quarantine of Cisco Email Security Appliance and Cisco Content Security Management Appliance could allow an authenticated, remote a… |
CVE-2018-0138 | Medium | 5.3 | 2018-02-08 | A vulnerability in the detection engine of Cisco Firepower System Software could allow an unauthenticated, remote attacker to bypass file policies that are con… |
CVE-2018-0137 | High | 8.6 | 2018-02-08 | A vulnerability in the TCP throttling process of Cisco Prime Network could allow an unauthenticated, remote attacker to cause a denial of service (DoS) conditi… |
CVE-2018-0135 | Medium | 4.3 | 2018-02-08 | A vulnerability in Cisco Unified Communications Manager could allow an authenticated, remote attacker to access sensitive information on an affected system. Th… |
CVE-2018-0134 | Medium | 5.3 | 2018-02-08 | A vulnerability in the RADIUS authentication module of Cisco Policy Suite could allow an unauthenticated, remote attacker to determine whether a subscriber use… |
CVE-2018-0132 | High | 8.6 | 2018-02-08 | A vulnerability in the forwarding information base (FIB) code of Cisco IOS XR Software could allow an unauthenticated, remote attacker to cause inconsistency b… |
CVE-2018-0129 | Medium | 6.1 | 2018-02-08 | A vulnerability in the web-based management interface of Cisco Data Center Analytics Framework could allow an unauthenticated, remote attacker to conduct a ref… |
CVE-2018-0128 | Medium | 6.1 | 2018-02-08 | A vulnerability in the web-based management interface of Cisco Data Center Analytics Framework could allow an unauthenticated, remote attacker to conduct a sto… |
CVE-2018-0127 | Critical | 9.8 | 2018-02-08 | A vulnerability in the web interface of Cisco RV132W ADSL2+ Wireless-N VPN Routers and Cisco RV134W VDSL2 Wireless-AC VPN Routers could allow an unauthenticate… |
CVE-2018-0125 | Critical | 9.8 | 2018-02-08 | A vulnerability in the web interface of the Cisco RV132W ADSL2+ Wireless-N VPN and RV134W VDSL2 Wireless-AC VPN Routers could allow an unauthenticated, remote… |
CVE-2018-0123 | Medium | 5.5 | 2018-02-08 | A Path Traversal vulnerability in the diagnostic shell for Cisco IOS and IOS XE Software could allow an authenticated, local attacker to use certain diagnostic… |
CVE-2018-0122 | Medium | 4.4 | 2018-02-08 | A vulnerability in the CLI of the Cisco StarOS operating system for Cisco ASR 5000 Series Aggregation Services Routers could allow an authenticated, local atta… |
CVE-2018-0120 | Medium | 4.3 | 2018-02-08 | A vulnerability in the web framework of Cisco Unified Communications Manager could allow an authenticated, remote attacker to conduct an SQL injection attack a… |
CVE-2018-0119 | Medium | 4.7 | 2018-02-08 | A vulnerability in certain authentication controls in the account services of Cisco Spark could allow an authenticated, remote attacker to interact with and vi… |
CVE-2018-0117 | High | 8.6 | 2018-02-08 | A vulnerability in the ingress packet processing functionality of the Cisco Virtualized Packet Core-Distributed Instance (VPC-DI) Software could allow an unaut… |
CVE-2018-0116 | High | 7.2 | 2018-02-08 | A vulnerability in the RADIUS authentication module of Cisco Policy Suite could allow an unauthenticated, remote attacker to be authorized as a subscriber with… |
CVE-2018-0113 | High | 8.8 | 2018-02-08 | A vulnerability in an operations script of Cisco UCS Central could allow an authenticated, remote attacker to execute arbitrary shell commands with the privile… |