2018 CVEs (page 19)
Page 19 of 162 — CVEs published in 2018, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2018-7201 | High | 8.8 | 2019-05-22 | CSV Injection was discovered in ProjectSend before r1053, affecting victims who import the data into Microsoft Excel. |
CVE-2018-7852 | High | 7.5 | 2019-05-22 | A CWE-248: Uncaught Exception vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause de… |
CVE-2018-7851 | Medium | 6.5 | 2019-05-22 | CWE-119: Buffer errors vulnerability exists in Modicon M580 with firmware prior to V2.50, Modicon M340 with firmware prior to V3.01, BMxCRA312xx with firmware… |
CVE-2018-7850 | Medium | 5.3 | 2019-05-22 | A CWE-807: Reliance on Untrusted Inputs in a Security Decision vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Mod… |
CVE-2018-7849 | High | 7.5 | 2019-05-22 | A CWE-248: Uncaught Exception vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum and Modicon Premium which could cause a p… |
CVE-2018-7848 | High | 7.5 | 2019-05-22 | A CWE-200: Information Exposure vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause… |
CVE-2018-7847 | Critical | 9.8 | 2019-05-22 | A CWE-284: Improper Access Control vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cau… |
CVE-2018-7846 | Critical | 9.8 | 2019-05-22 | A CWE-501: Trust Boundary Violation vulnerability on connection to the Controller exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum and… |
CVE-2018-7845 | High | 7.5 | 2019-05-22 | A CWE-125: Out-of-bounds Read vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause th… |
CVE-2018-7843 | High | 7.5 | 2019-05-22 | A CWE-248: Uncaught Exception vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause de… |
CVE-2018-7842 | Critical | 9.8 | 2019-05-22 | A CWE-290: Authentication Bypass by Spoofing vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which… |
CVE-2018-7841 | Critical | 9.8 | 2019-05-22 | A SQL Injection (CWE-89) vulnerability exists in U.motion Builder software version 1.3.4 which could cause unwanted code execution when an improper set of char… |
CVE-2018-7840 | High | 7.8 | 2019-05-22 | A Uncontrolled Search Path Element (CWE-427) vulnerability exists in VideoXpert OpsCenter versions prior to 3.1 which could allow an attacker to cause the syst… |
CVE-2018-7834 | Medium | 6.1 | 2019-05-22 | A CWE-79 Cross-Site Scripting vulnerability exists in all versions of the TSXETG100 allowing an attacker to send a specially crafted URL with an embedded scrip… |
CVE-2018-7829 | High | 8.8 | 2019-05-22 | An Improper Neutralization of Special Elements in Query vulnerability exists in the 1st Gen. Pelco Sarix Enhanced Camera and Spectra Enhanced PTZ Camera which… |
CVE-2018-7828 | High | 8.8 | 2019-05-22 | A Cross-Site Request Forgery (CSRF) vulnerability exists in the 1st Gen. Pelco Sarix Enhanced Camera and Spectra Enhanced PTZ Camera when an authenticated user… |
CVE-2018-7827 | Medium | 5.4 | 2019-05-22 | A Cross-Site Scripting (XSS) vulnerability exists in the 1st Gen. Pelco Sarix Enhanced Camera and Spectra Enhanced PTZ Camera which a remote attacker can execu… |
CVE-2018-7826 | High | 8.8 | 2019-05-22 | A Command Injection vulnerability exists in the web-based GUI of the 1st Gen Pelco Sarix Enhanced Camera that could allow a remote attacker to execute arbitrar… |
CVE-2018-7825 | High | 8.8 | 2019-05-22 | A Command Injection vulnerability exists in the web-based GUI of the 1st Gen PelcoSarix Enhanced Camera that could allow a remote attacker to execute arbitrary… |
CVE-2018-7824 | Medium | 4.9 | 2019-05-22 | An Externally Controlled Reference to a Resource (CWE-610) vulnerability exists in Schneider Electric Modbus Serial Driver (For 64-bit Windows OS:V3.17 IE 37 a… |
CVE-2018-7823 | Medium | 5.3 | 2019-05-22 | A Environment (CWE-2) vulnerability exists in SoMachine Basic, all versions, and Modicon M221(all references, all versions prior to firmware V1.10.0.0) which c… |
CVE-2018-7822 | Medium | 5.5 | 2019-05-22 | An Incorrect Default Permissions (CWE-276) vulnerability exists in SoMachine Basic, all versions, and Modicon M221(all references, all versions prior to firmwa… |
CVE-2018-7821 | High | 7.5 | 2019-05-22 | An Environment (CWE-2) vulnerability exists in SoMachine Basic, all versions, and Modicon M221(all references, all versions prior to firmware V1.10.0.0) which… |
CVE-2018-7816 | Medium | 6.5 | 2019-05-22 | A Permissions, Privileges, and Access Control vulnerability exists in the web-based GUI of the 1st Gen Pelco Sarix Enhanced Camera that could allow a remote at… |
CVE-2018-7788 | Medium | 6.5 | 2019-05-22 | A CWE-255 Credentials Management vulnerability exists in Modicon Quantum with firmware versions prior to V2.40. which could cause a Denial Of Service when usin… |
CVE-2018-12886 | High | 8.1 | 2019-05-22 | stack_protect_prologue in cfgexpand.c and stack_protect_epilogue in function.c in GNU Compiler Collection (GCC) 4.1 through 8 (under certain circumstances) gen… |
CVE-2018-7202 | Medium | 6.1 | 2019-05-22 | An issue was discovered in ProjectSend before r1053. XSS exists in the "Name" field on the My Account page. |
CVE-2018-14729 | High | 8.8 | 2019-05-22 | The database backup feature in upload/source/admincp/admincp_db.php in Discuz! 2.5 and 3.4 allows remote attackers to execute arbitrary PHP code. |
CVE-2018-1991 | Low | 2.7 | 2019-05-22 | IBM API Connect 5.0.0.0, and 5.0.8.6 could could return sensitive information that could provide critical information as to the underlying software stack in CM… |
CVE-2018-2005 | Low | 3.3 | 2019-05-20 | IBM BigFix Platform 9.2 and 9.5 stores potentially sensitive information in process memory that could be read by a local attacker with elevated permissions. IB… |
CVE-2018-12270 | Medium | 5.4 | 2019-05-20 | In Valve Steam 1528829181 BETA, it is possible to perform a homograph / homoglyph attack to create fake URLs in the client, which may trick users into visiting… |
CVE-2018-16156 | High | 7.8 | 2019-05-17 | In PaperStream IP (TWAIN) 1.42.0.5685 (Service Update 7), the FJTWSVIC service running with SYSTEM privilege processes unauthenticated messages received over t… |
CVE-2018-3701 | High | 7.8 | 2019-05-17 | Improper directory permissions in the installer for Intel(R) PROSet/Wireless WiFi Software version 20.100 and earlier may allow an authenticated user to potent… |
CVE-2018-20500 | High | 7.5 | 2019-05-17 | An insecure permissions issue was discovered in GitLab Community and Enterprise Edition 9.4 and later but before 11.4.13, 11.5.x before 11.5.6, and 11.6.x befo… |
CVE-2018-19585 | High | 7.5 | 2019-05-17 | GitLab CE/EE versions 8.18 up to 11.x before 11.3.11, 11.4.x before 11.4.8, and 11.5.x before 11.5.1 have CRLF Injection in Project Mirroring when using the Gi… |
CVE-2018-17181 | Critical | 9.8 | 2019-05-17 | An issue was discovered in OpenEMR before 5.0.1 Patch 7. SQL Injection exists in the SaveAudit function in /portal/lib/paylib.php and the portalAudit function… |
CVE-2018-17180 | Medium | 5.3 | 2019-05-17 | An issue was discovered in OpenEMR before 5.0.1 Patch 7. Directory Traversal exists via docid=../ to /portal/lib/download_template.php. |
CVE-2018-17179 | Critical | 9.8 | 2019-05-17 | An issue was discovered in OpenEMR before 5.0.1 Patch 7. There is SQL Injection in the make_task function in /interface/forms/eye_mag/php/taskman_functions.php… |
CVE-2018-7191 | Medium | 5.5 | 2019-05-17 | In the tun subsystem in the Linux kernel before 4.13.14, dev_get_valid_name is not called before register_netdevice. This allows local users to cause a denial… |
CVE-2018-20839 | Medium | 4.3 | 2019-05-17 | systemd 242 changes the VT1 mode upon a logout, which allows attackers to read cleartext passwords in certain circumstances, such as watching a shutdown, or us… |
CVE-2018-20007 | Medium | 6.8 | 2019-05-16 | Yeelight Smart AI Speaker 3.3.10_0074 devices have improper access control over the UART interface, allowing physical attackers to obtain a root shell. The att… |
CVE-2018-12556 | Medium | 5.9 | 2019-05-16 | The signature verification routine in install.sh in yarnpkg/website through 2018-06-05 only verifies that the yarn release is signed by any (arbitrary) key in… |
CVE-2018-1975 | Medium | 5.4 | 2019-05-16 | IBM Rational DOORS Web Access 9.5.1 through 9.5.2.9, and 9.6 through 9.6.1.9 is vulnerable to cross-site scripting. This vulnerability allows users to embed ar… |
CVE-2018-17048 | High | 7.5 | 2019-05-16 | admin/Lib/Action/FpluginAction.class.php in FDCMS (aka Fangfa Content Manage System) 4.2 allows SQL Injection. |
CVE-2018-14839 | Critical | 9.8 | 2019-05-14 | LG N1A1 NAS 3718.510 is affected by: Remote Command Execution. The impact is: execute arbitrary code (remote). The attack vector is: HTTP POST with parameters. |
CVE-2018-16656 | High | 7.5 | 2019-05-14 | DoBox_CstmBox_Info.model.htm on Kyocera TASKalfa 4002i and 6002i devices allows remote attackers to read the documents of arbitrary users via a modified HTTP r… |
CVE-2018-8940 | Critical | 9.8 | 2019-05-14 | ClientServiceConfigController.cs in Enghouse Cloud Contact Center Platform 7.2.5 has functionality for loading external XML files and parsing them, allowing an… |
CVE-2018-6885 | Critical | 9.8 | 2019-05-14 | An issue was discovered in MicroStrategy Web Services (the Microsoft Office plugin) before 10.4 Hotfix 7, and before 10.11. The vulnerability is unauthenticate… |
CVE-2018-11691 | Critical | 9.8 | 2019-05-14 | Emerson DeltaV Smart Switch Command Center application, available in versions 11.3.x and 12.3.1, was unable to change the DeltaV Smart Switches’ management pas… |
CVE-2018-18800 | Critical | 9.8 | 2019-05-14 | The Tubigan "Welcome to our Resort" 1.0 software allows SQL Injection via index.php?p=accomodation&q=[SQL], index.php?p=rooms&q=[SQL], or admin/login.php. |
CVE-2018-16138 | Medium | 4.8 | 2019-05-13 | An issue was discovered in the administration page in IPBRICK OS 6.3. There are multiple XSS vulnerabilities. |
CVE-2018-16137 | High | 8.8 | 2019-05-13 | An issue was discovered in the Web Management Console in IPBRICK OS 6.3. There are multiple SQL injections. |
CVE-2018-16136 | High | 8.8 | 2019-05-13 | An issue was discovered in the administrator interface in IPBRICK OS 6.3. The application doesn't check for Anti-CSRF tokens, allowing the submission of multip… |
CVE-2018-18912 | Critical | 9.8 | 2019-05-13 | An issue was discovered in Easy File Sharing (EFS) Web Server 7.2. A stack-based buffer overflow vulnerability occurs when a malicious POST request has been ma… |
CVE-2018-16139 | Medium | 6.1 | 2019-05-13 | Cross-site scripting (XSS) vulnerability in BIBLIOsoft BIBLIOpac 2008 allows remote attackers to inject arbitrary web script or HTML via the db or action param… |
CVE-2018-4029 | Critical | 9.8 | 2019-05-13 | An exploitable code execution vulnerability exists in the HTTP request-parsing function of the NT9665X Chipset firmware running on the Anker Roav A1 Dashcam, v… |
CVE-2018-4028 | High | 7.5 | 2019-05-13 | An exploitable firmware update vulnerability exists in the NT9665X Chipset firmware running on the Anker Roav A1 Dashcam, version RoavA1SWV1.9. The HTTP server… |
CVE-2018-4027 | High | 7.5 | 2019-05-13 | An exploitable denial-of-service vulnerability exists in the XML_UploadFile Wi-Fi command of the NT9665X Chipset firmware, running on the Anker Roav A1 Dashcam… |
CVE-2018-4026 | High | 7.5 | 2019-05-13 | An exploitable denial-of-service vulnerability exists in the XML_GetScreen Wi-Fi command of the NT9665X Chipset firmware, running on the Anker Roav A1 Dashcam… |
CVE-2018-4025 | High | 7.5 | 2019-05-13 | An exploitable denial-of-service vulnerability exists in the XML_GetRawEncJpg Wi-Fi command of the NT9665X Chipset firmware, running on the Anker Roav A1 Dashc… |
CVE-2018-4024 | High | 7.5 | 2019-05-13 | An exploitable denial-of-service vulnerability exists in the thumbnail display functionality of the NT9665X Chipset firmware, running on the Anker Roav A1 Dash… |
CVE-2018-4023 | Critical | 9.8 | 2019-05-13 | An exploitable code execution vulnerability exists in the XML_UploadFile Wi-Fi command of the NT9665X Chipset firmware, running on the Anker Roav A1 Dashcam, v… |
CVE-2018-4018 | Critical | 9.8 | 2019-05-13 | An exploitable firmware update vulnerability exists in the NT9665X Chipset firmware, running on Anker Roav A1 Dashcam version RoavA1SWV1.9. The HTTP server all… |
CVE-2018-4017 | High | 8.8 | 2019-05-13 | An exploitable vulnerability exists in the Wi-Fi Access Point feature of the Roav A1 Dashcam running version RoavA1SWV1.9. A set of default credentials can pot… |
CVE-2018-4016 | High | 8.8 | 2019-05-13 | An exploitable code execution vulnerability exists in the URL-parsing functionality of the Roav A1 Dashcam running version RoavA1SWV1.9. A specially crafted pa… |
CVE-2018-4014 | Critical | 9.8 | 2019-05-13 | An exploitable code execution vulnerability exists in Wi-Fi Command 9999 of the Roav A1 Dashcam running version RoavA1SWV1.9. A specially crafted packet can ca… |
CVE-2018-19990 | Critical | 9.8 | 2019-05-13 | In the /HNAP1/SetWiFiVerifyAlpha message, the WPSPIN parameter is vulnerable, and the vulnerability affects D-Link DIR-822 B1 202KRb06 devices. In the SetWiFiV… |
CVE-2018-19989 | Critical | 9.8 | 2019-05-13 | In the /HNAP1/SetQoSSettings message, the uplink parameter is vulnerable, and the vulnerability affects D-Link DIR-822 Rev.B 202KRb06 and DIR-822 Rev.C 3.10B06… |
CVE-2018-19988 | Critical | 9.8 | 2019-05-13 | In the /HNAP1/SetClientInfoDemo message, the AudioMute and AudioEnable parameters are vulnerable, and the vulnerabilities affect D-Link DIR-868L Rev.B 2.05B02… |
CVE-2018-19987 | Critical | 9.8 | 2019-05-13 | D-Link DIR-822 Rev.B 202KRb06, DIR-822 Rev.C 3.10B06, DIR-860L Rev.B 2.03.B03, DIR-868L Rev.B 2.05B02, DIR-880L Rev.A 1.20B01_01_i3se_BETA, and DIR-890L Rev.A… |
CVE-2018-19986 | Critical | 9.8 | 2019-05-13 | In the /HNAP1/SetRouterSettings message, the RemotePort parameter is vulnerable, and the vulnerability affects D-Link DIR-818LW Rev.A 2.05.B03 and DIR-822 B1 2… |
CVE-2018-19048 | Medium | 6.1 | 2019-05-13 | Simditor through 2.3.21 allows DOM XSS via an onload attribute within a malformed SVG element. |
CVE-2018-18872 | Medium | 5.4 | 2019-05-13 | The Kieran O'Shea Calendar plugin before 1.3.11 for WordPress has Stored XSS via the event_title parameter in a wp-admin/admin.php?page=calendar add action, or… |
CVE-2018-18524 | Medium | 6.1 | 2019-05-13 | Evernote 6.15 on Windows has an incorrectly repaired stored XSS vulnerability. An attacker can use this XSS issue to inject Node.js code under Present mode. Af… |
CVE-2018-15128 | Critical | 9.8 | 2019-05-13 | An issue was discovered in Polycom Group Series 6.1.6.1 and earlier, HDX 3.1.12 and earlier, and Pano 1.1.1 and earlier. A remote code execution vulnerability… |
CVE-2018-19037 | High | 7.5 | 2019-05-13 | On Virgin Media wireless router 3.0 hub devices, the web interface is vulnerable to denial of service. When POST requests are sent and keep the connection open… |
CVE-2018-18558 | Medium | 6.4 | 2019-05-13 | An issue was discovered in Espressif ESP-IDF 2.x and 3.x before 3.0.6 and 3.1.x before 3.1.1. Insufficient validation of input data in the 2nd stage bootloader… |
CVE-2018-16639 | Medium | 5.4 | 2019-05-13 | Typesetter 5.1 allows XSS via the index.php/Admin LABEL parameter during new page creation. |
CVE-2018-16626 | Medium | 4.8 | 2019-05-13 | index.php/Admin/Classes in Typesetter 5.1 allows XSS via the description of a new class name. |
CVE-2018-16625 | Medium | 4.8 | 2019-05-13 | index.php/Admin/Uploaded in Typesetter 5.1 allows XSS via an SVG file with JavaScript in a SCRIPT element. |
CVE-2018-16624 | Medium | 5.4 | 2019-05-13 | panel/pages/home/edit in Kirby v2.5.12 allows XSS via the title of a new page. |
CVE-2018-16623 | Medium | 4.8 | 2019-05-13 | Kirby V2.5.12 is prone to a Persistent XSS attack via the Title of the "Site options" in the admin panel dashboard dropdown. |
CVE-2018-15530 | Medium | 6.1 | 2019-05-13 | Cross-site scripting (XSS) in the web interface of the Xerox ColorQube 8580 allows remote persistent injection of custom HTML / JavaScript code. |
CVE-2018-14714 | Critical | 9.8 | 2019-05-13 | System command injection in appGet.cgi on ASUS RT-AC3200 version 3.0.0.4.382.50010 allows attackers to execute system commands via the "load_script" URL parame… |
CVE-2018-14713 | High | 8.1 | 2019-05-13 | Format string vulnerability in appGet.cgi on ASUS RT-AC3200 version 3.0.0.4.382.50010 allows attackers to read arbitrary sections of memory and CPU registers v… |
CVE-2018-14712 | Medium | 6.5 | 2019-05-13 | Buffer overflow in appGet.cgi on ASUS RT-AC3200 version 3.0.0.4.382.50010 allows attackers to inject system commands via the "hook" URL parameter. |
CVE-2018-14711 | Medium | 6.5 | 2019-05-13 | Missing cross-site request forgery protection in appGet.cgi on ASUS RT-AC3200 version 3.0.0.4.382.50010 allows attackers to cause state-changing actions with s… |
CVE-2018-14710 | Medium | 6.1 | 2019-05-13 | Cross-site scripting in appGet.cgi on ASUS RT-AC3200 version 3.0.0.4.382.50010 allows attackers to execute JavaScript via the "hook" URL parameter. |
CVE-2018-12304 | Medium | 6.1 | 2019-05-13 | Cross-site scripting in Application Manager in Seagate NAS OS version 4.3.15.1 allows attackers to execute JavaScript via multiple application metadata fields… |
CVE-2018-12303 | Medium | 5.4 | 2019-05-13 | Cross-site scripting in filebrowser in Seagate NAS OS version 4.3.15.1 allows attackers to execute JavaScript via directory names. |
CVE-2018-12302 | Medium | 6.1 | 2019-05-13 | Missing HTTPOnly flag on session cookies in the Seagate NAS OS version 4.3.15.1 web application allows attackers to steal session tokens via cross-site scripti… |
CVE-2018-12301 | High | 7.5 | 2019-05-13 | Unvalidated URL in Download Manager in Seagate NAS OS version 4.3.15.1 allows attackers to access the loopback interface via a Download URL of 127.0.0.1 or loc… |
CVE-2018-12300 | Medium | 6.1 | 2019-05-13 | Arbitrary Redirect in echo-server.html in Seagate NAS OS version 4.3.15.1 allows attackers to disclose information in the Referer header via the 'state' URL pa… |
CVE-2018-12299 | Medium | 5.4 | 2019-05-13 | Cross-site scripting in filebrowser in Seagate NAS OS version 4.3.15.1 allows attackers to execute JavaScript via uploaded file names. |
CVE-2018-12298 | High | 7.5 | 2019-05-13 | Directory Traversal in filebrowser in Seagate NAS OS 4.3.15.1 allows attackers to read files within the application's container via a URL path. |
CVE-2018-12297 | Medium | 6.1 | 2019-05-13 | Cross-site scripting in API error pages in Seagate NAS OS version 4.3.15.1 allows attackers to execute JavaScript via URL path names. |
CVE-2018-12296 | High | 7.5 | 2019-05-13 | Insufficient access control in /api/external/7.0/system.System.get_infos in Seagate NAS OS version 4.3.15.1 allows attackers to obtain information about the NA… |
CVE-2018-12295 | Critical | 9.8 | 2019-05-13 | SQL injection in folderViewSpecific.psp in Seagate NAS OS version 4.3.15.1 allows attackers to execute arbitrary SQL commands via the dirId URL parameter. |
CVE-2018-20838 | Medium | 5.4 | 2019-05-13 | ampforwp_save_steps_data in the AMP for WP plugin before 0.9.97.21 for WordPress allows stored XSS. |
CVE-2018-7120 | Critical | 9.8 | 2019-05-10 | A security vulnerability in the HPE Virtual Connect SE 16Gb Fibre Channel Module for HPE Synergy running firmware 5.00.50, which is part of the HPE Synergy Cus… |