2018 CVEs (page 162)
Page 162 of 162 — CVEs published in 2018, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2018-5270 | High | 7.8 | 2018-01-08 | In Malwarebytes Premium 3.3.1.2183, the driver file (FARFLT.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impa… |
CVE-2018-5269 | Medium | 5.5 | 2018-01-08 | In OpenCV 3.3.1, an assertion failure happens in cv::RBaseStream::setPos in modules/imgcodecs/src/bitstrm.cpp because of an incorrect integer cast. |
CVE-2018-5268 | Medium | 5.5 | 2018-01-08 | In OpenCV 3.3.1, a heap-based buffer overflow happens in cv::Jpeg2KDecoder::readComponent8u in modules/imgcodecs/src/grfmt_jpeg2000.cpp when parsing a crafted… |
CVE-2018-3815 | Medium | 5.7 | 2018-01-08 | The "XML Interface to Messaging, Scheduling, and Signaling" (XIMSS) protocol implementation in CommuniGate Pro (CGP) 6.2 suffers from a Missing XIMSS Protocol… |
CVE-2018-5267 | Critical | 9.8 | 2018-01-08 | Cobham Sea Tel 121 build 222701 devices allow remote attackers to bypass authentication via a direct request to MenuDealerGx.html, MenuDealer.html, MenuEuNCGx… |
CVE-2018-5266 | High | 7.5 | 2018-01-08 | Cobham Sea Tel 121 build 222701 devices allow remote attackers to obtain potentially sensitive information about valid usernames by reading the loginName lines… |
CVE-2018-5071 | Medium | 5.4 | 2018-01-08 | Persistent XSS exists in the web server on Cobham Sea Tel 116 build 222429 satellite communication system devices: remote attackers can inject malicious JavaSc… |
CVE-2018-5208 | Critical | 9.8 | 2018-01-06 | In Irssi before 1.0.6, a calculation error in the completion code could cause a heap buffer overflow when completing certain strings. |
CVE-2018-5207 | High | 7.5 | 2018-01-06 | When using an incomplete variable argument, Irssi before 1.0.6 may access data beyond the end of the string. |
CVE-2018-5206 | Critical | 9.8 | 2018-01-06 | When the channel topic is set without specifying a sender, Irssi before 1.0.6 may dereference a NULL pointer. |
CVE-2018-5205 | High | 7.5 | 2018-01-06 | When using incomplete escape codes, Irssi before 1.0.6 may access data beyond the end of the string. |
CVE-2018-5253 | High | 7.8 | 2018-01-05 | The AP4_FtypAtom class in Core/Ap4FtypAtom.cpp in Bento4 1.5.1.0 has an Infinite loop via a crafted MP4 file that triggers size mishandling. |
CVE-2018-5252 | Medium | 5.3 | 2018-01-05 | libimageworsener.a in ImageWorsener 1.3.2, when libjpeg 8d is used, has a large loop in the get_raw_sample_int function in imagew-main.c. |
CVE-2018-5251 | Medium | 6.5 | 2018-01-05 | In libming 0.4.8, there is an integer signedness error vulnerability (left shift of a negative value) in the readSBits function (util/read.c). Remote attackers… |
CVE-2018-5249 | Medium | 6.1 | 2018-01-05 | Cross-site scripting (XSS) vulnerability in Shaarli before 0.8.5 and 0.9.x before 0.9.3 allows remote attackers to inject arbitrary code via the login form's u… |
CVE-2018-5248 | High | 8.8 | 2018-01-05 | In ImageMagick 7.0.7-17 Q16, there is a heap-based buffer over-read in coders/sixel.c in the ReadSIXELImage function, related to the sixel_decode function. |
CVE-2018-5247 | Medium | 6.5 | 2018-01-05 | In ImageMagick 7.0.7-17 Q16, there are memory leaks in ReadRLAImage in coders/rla.c. |
CVE-2018-5246 | Medium | 6.5 | 2018-01-05 | In ImageMagick 7.0.7-17 Q16, there are memory leaks in ReadPATTERNImage in coders/pattern.c. |
CVE-2018-5244 | Medium | 6.5 | 2018-01-05 | In Xen 4.10, new infrastructure was introduced as part of an overhaul to how MSR emulation happens for guests. Unfortunately, one tracking structure isn't free… |
CVE-2018-5220 | High | 7.8 | 2018-01-04 | In K7 Antivirus 15.1.0306, the driver file (K7Sentry.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact beca… |
CVE-2018-5219 | High | 7.8 | 2018-01-04 | In K7 Antivirus 15.1.0306, the driver file (K7FWHlpr.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact beca… |
CVE-2018-5218 | High | 7.8 | 2018-01-04 | In K7 Antivirus 15.1.0306, the driver file (K7Sentry.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact beca… |
CVE-2018-5217 | High | 7.8 | 2018-01-04 | In K7 Antivirus 15.1.0306, the driver file (K7Sentry.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact beca… |
CVE-2018-5216 | Medium | 5.4 | 2018-01-04 | Radiant CMS 1.1.4 has XSS via crafted Markdown input in the part_body_content parameter to an admin/pages/*/edit resource. |
CVE-2018-5215 | Medium | 5.4 | 2018-01-04 | Fork CMS 5.0.7 has XSS in /private/en/pages/edit via the title parameter. |
CVE-2018-5214 | Medium | 5.4 | 2018-01-04 | The "Add Link to Facebook" plugin through 2.3 for WordPress has XSS via the al2fb_facebook_id parameter to wp-admin/profile.php. |
CVE-2018-5213 | Medium | 5.4 | 2018-01-04 | The Simple Download Monitor plugin before 3.5.4 for WordPress has XSS via the sdm_upload (aka Downloadable File) parameter in an edit action to wp-admin/post.p… |
CVE-2018-5212 | Medium | 5.4 | 2018-01-04 | The Simple Download Monitor plugin before 3.5.4 for WordPress has XSS via the sdm_upload_thumbnail (aka File Thumbnail) parameter in an edit action to wp-admin… |
CVE-2018-0803 | Medium | 4.2 | 2018-01-04 | Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows an attacker to access information from one domain and injec… |
CVE-2018-0800 | Medium | 5.3 | 2018-01-04 | Microsoft Edge in Microsoft Windows 10 1709 allows an attacker to obtain information to further compromise the user's system, due to how the scripting engine h… |
CVE-2018-0788 | High | 7.0 | 2018-01-04 | The Windows Adobe Type Manager Font Driver (Atmfd.dll) in Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2008 SP2 and R2 SP1, and Windows Server 2012 an… |
CVE-2018-0781 | High | 7.5 | 2018-01-04 | Microsoft Edge in Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the current u… |
CVE-2018-0780 | Medium | 5.3 | 2018-01-04 | Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows an attacker to obtain information to further compromise the… |
CVE-2018-0778 | High | 7.5 | 2018-01-04 | Microsoft Edge in Windows 10 1709 allows an attacker to execute arbitrary code in the context of the current user, due to how the scripting engine handles obje… |
CVE-2018-0777 | High | 7.5 | 2018-01-04 | Microsoft Edge in Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the current u… |
CVE-2018-0776 | High | 7.5 | 2018-01-04 | Microsoft Edge in Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the current u… |
CVE-2018-0775 | High | 7.5 | 2018-01-04 | Microsoft Edge in Windows 10 1709 allows an attacker to execute arbitrary code in the context of the current user, due to how the scripting engine handles obje… |
CVE-2018-0774 | High | 7.5 | 2018-01-04 | Microsoft Edge in Windows 10 1709 allows an attacker to execute arbitrary code in the context of the current user, due to how the scripting engine handles obje… |
CVE-2018-0773 | High | 7.5 | 2018-01-04 | Microsoft Edge in Windows 10 1709 allows an attacker to execute arbitrary code in the context of the current user, due to how the scripting engine handles obje… |
CVE-2018-0772 | High | 7.5 | 2018-01-04 | Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, and Internet Explorer… |
CVE-2018-0770 | High | 7.5 | 2018-01-04 | Microsoft Edge in Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the current u… |
CVE-2018-0769 | High | 7.5 | 2018-01-04 | Microsoft Edge in Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the current u… |
CVE-2018-0768 | High | 7.5 | 2018-01-04 | Microsoft Edge in Windows 10 1709 allows an attacker to execute arbitrary code in the context of the current user, due to how the scripting engine handles obje… |
CVE-2018-0767 | Medium | 5.3 | 2018-01-04 | Microsoft Edge in Microsoft Windows 10 1511, 1607, 1703, 1709, and Windows Server 2016 allows an attacker to obtain information to further compromise the user'… |
CVE-2018-0766 | Medium | 4.3 | 2018-01-04 | Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows an attacker to obtain information to further compromise the… |
CVE-2018-0762 | High | 7.5 | 2018-01-04 | Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, and Internet Explorer… |
CVE-2018-0758 | High | 7.5 | 2018-01-04 | Microsoft Edge in Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the current u… |
CVE-2018-0754 | Medium | 5.5 | 2018-01-04 | The Windows Adobe Type Manager Font Driver (Atmfd.dll) in Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2008 SP2 and R2 SP1, Windows Server 2012 and R2… |
CVE-2018-0753 | Medium | 5.9 | 2018-01-04 | Windows 8.1 and RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703 and 1709, Windows Server 2016 and Windows Server, version 1709 allow a de… |
CVE-2018-0752 | High | 7.8 | 2018-01-04 | The Windows Kernel API in Windows 8.1 and RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703 and 1709, Windows Server 2016 and Windows Serve… |
CVE-2018-0751 | High | 7.1 | 2018-01-04 | The Windows Kernel API in Windows 8.1 and RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703 and 1709, Windows Server 2016 and Windows Serve… |
CVE-2018-0750 | Medium | 5.5 | 2018-01-04 | The Windows GDI component in Windows 7 SP1 and Windows Server 2008 SP2 and R2 SP1 allows an information disclosure vulnerability due to the way objects are han… |
CVE-2018-0749 | High | 7.8 | 2018-01-04 | The Microsoft Server Message Block (SMB) Server in Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2008 SP2 and R2 SP1, Windows Server 2012 and R2, Windo… |
CVE-2018-0748 | High | 7.8 | 2018-01-04 | The Windows kernel in Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2008 SP2 and R2 SP1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703… |
CVE-2018-0747 | Medium | 4.7 | 2018-01-04 | The Windows kernel in Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2008 SP2 and R2 SP1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703… |
CVE-2018-0746 | Medium | 4.7 | 2018-01-04 | The Windows kernel in Windows 8.1 and RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703 and 1709, Windows Server 2016 and Windows Server, v… |
CVE-2018-0745 | Medium | 4.7 | 2018-01-04 | The Windows kernel in Windows 10 version 1703. Windows 10 version 1709, and Windows Server, version 1709 allows an information disclosure vulnerability due to… |
CVE-2018-0744 | High | 7.0 | 2018-01-04 | The Windows kernel in Windows 8.1 and RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703 and 1709, Windows Server 2016 and Windows Server, v… |
CVE-2018-0743 | High | 7.0 | 2018-01-04 | Windows Subsystem for Linux in Windows 10 version 1703, Windows 10 version 1709, and Windows Server, version 1709 allows an elevation of privilege vulnerabilit… |
CVE-2018-0741 | Medium | 5.3 | 2018-01-04 | The Color Management Module (Icm32.dll) in Windows 7 SP1 and Windows Server 2008 SP2 and R2 SP1 allows an information disclosure vulnerability due to the way o… |
CVE-2018-5210 | High | 8.1 | 2018-01-04 | On Samsung mobile devices with N(7.x) software and Exynos chipsets, attackers can conduct a Trustlet stack overflow attack for arbitrary TEE code execution, in… |
CVE-2018-1190 | Medium | 6.1 | 2018-01-04 | An issue was discovered in these Pivotal Cloud Foundry products: all versions prior to cf-release v270, UAA v3.x prior to v3.20.2, and UAA bosh v30.x versions… |
CVE-2018-0114 | High | 7.5 | 2018-01-04 | A vulnerability in the Cisco node-jose open source library before 0.11.0 could allow an unauthenticated, remote attacker to re-sign tokens using a key that is… |
CVE-2018-0104 | Critical | 9.6 | 2018-01-04 | A vulnerability in Cisco WebEx Network Recording Player for Advanced Recording Format (ARF) files could allow a remote attacker to execute arbitrary code on th… |
CVE-2018-0103 | High | 7.8 | 2018-01-04 | A Buffer Overflow vulnerability in Cisco WebEx Network Recording Player for Advanced Recording Format (ARF) files could allow a local attacker to execute arbit… |
CVE-2018-5088 | High | 7.8 | 2018-01-03 | In K7 AntiVirus 15.1.0306, the driver file (K7FWHlpr.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact beca… |
CVE-2018-5087 | High | 7.8 | 2018-01-03 | In K7 AntiVirus 15.1.0306, the driver file (K7FWHlpr.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact beca… |
CVE-2018-5086 | High | 7.8 | 2018-01-03 | In K7 AntiVirus 15.1.0306, the driver file (K7FWHlpr.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact beca… |
CVE-2018-5085 | High | 7.8 | 2018-01-03 | In K7 AntiVirus 15.1.0306, the driver file (K7FWHlpr.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact beca… |
CVE-2018-5084 | High | 7.8 | 2018-01-03 | In K7 AntiVirus 15.1.0306, the driver file (K7FWHlpr.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact beca… |
CVE-2018-5083 | High | 7.8 | 2018-01-03 | In K7 AntiVirus 15.1.0306, the driver file (K7FWHlpr.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact beca… |
CVE-2018-5082 | High | 7.8 | 2018-01-03 | In K7 AntiVirus 15.1.0306, the driver file (K7FWHlpr.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact beca… |
CVE-2018-5081 | High | 7.8 | 2018-01-03 | In K7 AntiVirus 15.1.0306, the driver file (K7FWHlpr.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact beca… |
CVE-2018-5080 | High | 7.8 | 2018-01-03 | In K7 AntiVirus 15.1.0306, the driver file (K7FWHlpr.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact beca… |
CVE-2018-5079 | High | 7.8 | 2018-01-03 | In K7 AntiVirus 15.1.0306, the driver file (K7FWHlpr.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact beca… |
CVE-2018-5078 | Medium | 4.8 | 2018-01-03 | Online Ticket Booking has XSS via the admin/eventlist.php cast parameter. |
CVE-2018-5077 | Medium | 4.8 | 2018-01-03 | Online Ticket Booking has XSS via the admin/movieedit.php moviename parameter. |
CVE-2018-5076 | Medium | 4.8 | 2018-01-03 | Online Ticket Booking has XSS via the admin/newsedit.php newstitle parameter. |
CVE-2018-5075 | Medium | 4.8 | 2018-01-03 | Online Ticket Booking has XSS via the admin/snacks_edit.php snacks_name parameter. |
CVE-2018-5074 | Medium | 4.8 | 2018-01-03 | Online Ticket Booking has XSS via the admin/manageownerlist.php contact parameter. |
CVE-2018-5073 | Medium | 6.8 | 2018-01-03 | Online Ticket Booking has CSRF via admin/movieedit.php. |
CVE-2018-5072 | Medium | 4.8 | 2018-01-03 | Online Ticket Booking has XSS via the admin/sitesettings.php keyword parameter. |
CVE-2018-4868 | Medium | 5.5 | 2018-01-03 | The Exiv2::Jp2Image::readMetadata function in jp2image.cpp in Exiv2 0.26 allows remote attackers to cause a denial of service (excessive memory allocation) via… |
CVE-2018-4862 | High | 8.8 | 2018-01-03 | In Octopus Deploy versions 3.2.11 - 4.1.5 (fixed in 4.1.6), an authenticated user with ProcessEdit permission could reference an Azure account in such a way as… |
CVE-2018-3814 | High | 8.8 | 2018-01-01 | Craft CMS 2.6.3000 allows remote attackers to execute arbitrary PHP code by using the "Assets->Upload files" screen and then the "Replace it" option, because t… |
CVE-2018-3813 | Critical | 9.8 | 2018-01-01 | getConfigExportFile.cgi on FLIR Brickstream 2300 devices 2.0 4.1.53.166 has Incorrect Access Control, as demonstrated by reading the AVI_USER_ID and AVI_USER_P… |
CVE-2018-3811 | Critical | 9.8 | 2018-01-01 | SQL Injection vulnerability in the Oturia Smart Google Code Inserter plugin before 3.5 for WordPress allows unauthenticated attackers to execute SQL queries in… |
CVE-2018-3810 | Critical | 9.8 | 2018-01-01 | Authentication Bypass vulnerability in the Oturia Smart Google Code Inserter plugin before 3.5 for WordPress allows unauthenticated attackers to insert arbitra… |