2018 CVEs (page 20)
Page 20 of 162 — CVEs published in 2018, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2018-7119 | High | 7.0 | 2019-05-10 | A Local Disclosure of Sensitive Information vulnerability was identified in HPE NonStop Safeguard earlier than version SPR T9750L01^AIC or T9750H05^AIH, and la… |
CVE-2018-7084 | Critical | 9.8 | 2019-05-10 | A command injection vulnerability is present that permits an unauthenticated user with access to the Aruba Instant web interface to execute arbitrary system co… |
CVE-2018-7064 | Medium | 6.1 | 2019-05-10 | A reflected cross-site scripting (XSS) vulnerability is present in an unauthenticated Aruba Instant web interface. An attacker could use this vulnerability to… |
CVE-2018-7083 | High | 7.5 | 2019-05-10 | If a process running within Aruba Instant crashes, it may leave behind a "core dump", which contains the memory contents of the process at the time it crashed… |
CVE-2018-7082 | High | 7.2 | 2019-05-10 | A command injection vulnerability is present in Aruba Instant that permits an authenticated administrative user to execute arbitrary commands on the underlying… |
CVE-2018-1990 | Medium | 5.3 | 2019-05-10 | IBM Cloud App Management V2018.2.0, V2018.4.0, and V2018.4.1 could allow an attacker to obtain sensitive configuration information using a specially crafted HT… |
CVE-2018-1790 | Medium | 4.3 | 2019-05-10 | IBM Financial Transaction Manager for Digital Payments for Multi-Platform 3.0.2 is vulnerable to cross-site request forgery which could allow an attacker to ex… |
CVE-2018-20837 | Medium | 4.8 | 2019-05-09 | include/admin/Menu/Ajax.php in Typesetter 5.1 has index.php/Admin/Menu/Ajax?cmd=AddHidden title XSS. |
CVE-2018-5409 | Critical | 9.8 | 2019-05-08 | The PrinterLogic Print Management software, versions up to and including 18.3.1.96, updates and executes the code without sufficiently verifying the origin and… |
CVE-2018-5408 | High | 7.4 | 2019-05-08 | The PrinterLogic Print Management software, versions up to and including 18.3.1.96, does not validate, or incorrectly validates, the PrinterLogic management po… |
CVE-2018-6634 | Critical | 9.8 | 2019-05-07 | A vulnerability in Parsec Windows 142-0 and Parsec 'Linux Ubuntu 16.04 LTS Desktop' Build 142-1 allows unauthorized users to maintain access to an account. |
CVE-2018-6243 | High | 7.8 | 2019-05-07 | NVIDIA Tegra TLK Widevine Trust Application contains a vulnerability in which missing the input parameter checking of video metadata count may lead to Arbitrar… |
CVE-2018-20503 | Medium | 6.1 | 2019-05-07 | Allied Telesis 8100L/8 devices allow XSS via the edit-ipv4_interface.php vlanid or subnet_mask parameter. |
CVE-2018-2008 | Medium | 4.3 | 2019-05-07 | IBM TRIRIGA Application Platform 3.5.3 and 3.6.0 could disclose sensitive information to an authenticated user that could aid in further attacks against the sy… |
CVE-2018-2001 | Medium | 4.3 | 2019-05-07 | IBM Cram Social Program Management 6.1.1, 6.2.0, 7.0.4, and 7.0.5 is vulnerable to cross-site request forgery which could allow an attacker to execute maliciou… |
CVE-2018-19456 | High | 7.5 | 2019-05-07 | The WP Backup+ (aka WPbackupplus) plugin through 2018-11-22 for WordPress allows remote attackers to obtain sensitive information from server folders and files… |
CVE-2018-14485 | Critical | 9.8 | 2019-05-07 | BlogEngine.NET 3.3 allows XXE attacks via the POST body to metaweblog.axd. |
CVE-2018-14478 | Medium | 6.1 | 2019-05-07 | ecard.php in Coppermine Photo Gallery (CPG) 1.5.46 has XSS via the sender_name, recipient_email, greetings, or recipient_name parameter. |
CVE-2018-13994 | High | 7.5 | 2019-05-07 | The WebUI of PHOENIX CONTACT FL SWITCH 3xxx, 4xxx, 48xx versions 1.0 to 1.34 is vulnerable to a denial-of-service attack by making more than 120 connections. |
CVE-2018-13993 | High | 8.8 | 2019-05-07 | The WebUI of PHOENIX CONTACT FL SWITCH 3xxx, 4xxx, 48xx versions 1.0 to 1.34 is prone to CSRF. |
CVE-2018-13992 | High | 8.2 | 2019-05-07 | The WebUI of PHOENIX CONTACT FL SWITCH 3xxx, 4xxx, 48xx versions 1.0 to 1.34 allows for plaintext transmission (HTTP) of user credentials by default. |
CVE-2018-13991 | Medium | 5.3 | 2019-05-07 | The WebUI of PHOENIX CONTACT FL SWITCH 3xxx, 4xxx, 48xx versions 1.0 to 1.34 leaks private information in firmware images. |
CVE-2018-20836 | High | 8.1 | 2019-05-07 | An issue was discovered in the Linux kernel before 4.20. There is a race condition in smp_task_timedout() and smp_task_done() in drivers/scsi/libsas/sas_expand… |
CVE-2018-18979 | High | 7.4 | 2019-05-06 | An issue was discovered in the Ascensia Contour NEXT ONE application for Android before 2019-01-15. It has a statically coded initialization vector. Extraction… |
CVE-2018-18978 | High | 7.4 | 2019-05-06 | An issue was discovered in the Ascensia Contour NEXT ONE application for Android before 2019-01-15. It has a statically coded encryption key. Extraction of the… |
CVE-2018-18977 | High | 7.5 | 2019-05-06 | An issue was discovered in the Ascensia Contour NEXT ONE application for Android before 2019-01-15. An attacker may reverse engineer the codebase to extract se… |
CVE-2018-18976 | Medium | 5.3 | 2019-05-06 | An issue was discovered in the Ascensia Contour NEXT ONE application for iOS and Android before 2019-01-15. An attacker may retrieve encrypted medical informat… |
CVE-2018-18975 | High | 7.5 | 2019-05-06 | An issue was discovered in the Ascensia Contour NEXT ONE app for iOS before 2019-01-15. An attacker may proxy communications between the app and Ascensia backe… |
CVE-2018-4073 | High | 8.8 | 2019-05-06 | An exploitable Permission Assignment vulnerability exists in the ACEManager EmbeddedAceSet_Task.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. Th… |
CVE-2018-4072 | High | 8.8 | 2019-05-06 | An exploitable Permission Assignment vulnerability exists in the ACEManager EmbeddedAceSet_Task.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. Th… |
CVE-2018-4071 | High | 8.8 | 2019-05-06 | An exploitable Information Disclosure vulnerability exists in the ACEManager EmbeddedAceGet_Task.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. T… |
CVE-2018-4070 | High | 8.8 | 2019-05-06 | An exploitable Information Disclosure vulnerability exists in the ACEManager EmbeddedAceGet_Task.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. T… |
CVE-2018-4067 | Medium | 6.5 | 2019-05-06 | An exploitable information disclosure vulnerability exists in the ACEManager template_load.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. A speci… |
CVE-2018-4066 | High | 8.8 | 2019-05-06 | An exploitable cross-site request forgery vulnerability exists in the ACEManager functionality of Sierra Wireless AirLink ES450 FW 4.9.3. A specially crafted H… |
CVE-2018-4065 | Medium | 6.1 | 2019-05-06 | An exploitable cross-site scripting vulnerability exists in the ACEManager ping_result.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. A specially… |
CVE-2018-4063 | High | 8.8 | 2019-05-06 | An exploitable remote code execution vulnerability exists in the upload.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. A specially crafted HTTP r… |
CVE-2018-4062 | High | 8.1 | 2019-05-06 | A hard-coded credentials vulnerability exists in the snmpd function of the Sierra Wireless AirLink ES450 FW 4.9.3. Activating snmpd outside of the WebUI can ca… |
CVE-2018-13990 | High | 8.6 | 2019-05-06 | The WebUI of PHOENIX CONTACT FL SWITCH 3xxx, 4xxx, 48xx versions prior to 1.35 is vulnerable to brute-force attacks, because of Improper Restriction of Excessi… |
CVE-2018-13983 | Medium | 6.1 | 2019-05-06 | ImpressCMS 1.3.10 has XSS via the PATH_INFO to htdocs/install/index.php, htdocs/install/page_langselect.php, or htdocs/install/page_modcheck.php. |
CVE-2018-4069 | High | 7.5 | 2019-05-06 | An information disclosure vulnerability exists in the ACEManager authentication functionality of Sierra Wireless AirLink ES450 FW 4.9.3. The ACEManager authent… |
CVE-2018-4068 | Medium | 5.3 | 2019-05-06 | An exploitable information disclosure vulnerability exists in the ACEManager functionality of Sierra Wireless AirLink ES450 FW 4.9.3. A HTTP request can result… |
CVE-2018-4061 | High | 8.8 | 2019-05-06 | An exploitable command injection vulnerability exists in the ACEManager iplogging.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. A specially craf… |
CVE-2018-17202 | High | 7.5 | 2019-05-06 | Certain input files could make the code to enter into an infinite loop when Apache Sanselan 0.97-incubator was used to parse them, which could be used in a DoS… |
CVE-2018-17201 | High | 7.5 | 2019-05-06 | Certain input files could make the code hang when Apache Sanselan 0.97-incubator was used to parse them, which could be used in a DoS attack. Note that Apache… |
CVE-2018-20824 | Medium | 6.1 | 2019-05-03 | The WallboardServlet resource in Jira before version 7.13.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vul… |
CVE-2018-20580 | High | 8.8 | 2019-05-03 | The WSDL import functionality in SmartBear ReadyAPI 2.5.0 and 2.6.0 allows remote attackers to execute arbitrary Java code via a crafted request parameter in a… |
CVE-2018-15462 | High | 8.6 | 2019-05-03 | A vulnerability in the TCP ingress handler for the data interfaces that are configured with management access to Cisco Firepower Threat Defense (FTD) Software… |
CVE-2018-15388 | High | 8.6 | 2019-05-03 | A vulnerability in the WebVPN login process of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow a… |
CVE-2018-16988 | Critical | 9.8 | 2019-05-02 | An issue was discovered in Open XDMoD through 7.5.0. An authentication bypass (account takeover) exists due to a weak password reset mechanism. A brute-force a… |
CVE-2018-16961 | High | 7.5 | 2019-05-02 | An issue was discovered in Open XDMoD through 7.5.0. html/gui/general/dl_publication.php allows Path traversal via the file parameter, allowing remote attacker… |
CVE-2018-16960 | Medium | 6.1 | 2019-05-02 | An issue was discovered in Open XDMoD through 7.5.0. html/gui/general/login.php has Reflected XSS via the xd_user_formal_name parameter. |
CVE-2018-16718 | Medium | 6.1 | 2019-05-02 | An XSS vulnerability exists in wwwblast.c in the 2.0.7 through 2.2.26 legacy versions of the NCBI ToolBox via a crafted -z1 argument. |
CVE-2018-16717 | Critical | 9.8 | 2019-05-02 | A heap-based buffer overflow exists in nph-viewgif.cgi in the 2.0.7 through 2.2.26 legacy versions of the NCBI ToolBox. |
CVE-2018-16716 | Critical | 9.1 | 2019-05-02 | A path traversal vulnerability exists in viewcgi.c in the 2.0.7 through 2.2.26 legacy versions of the NCBI ToolBox, which may result in reading of arbitrary fi… |
CVE-2018-10383 | Medium | 6.1 | 2019-05-02 | Lantronix SecureLinx Spider (SLS) 2.2+ devices have XSS in the auth.asp login page. |
CVE-2018-12404 | Medium | 5.9 | 2019-05-02 | A cached side channel attack during handshakes using RSA encryption could allow for the decryption of encrypted content. This is a variant of the Adaptive Chos… |
CVE-2018-2015 | Medium | 6.4 | 2019-05-02 | IBM API Connect 2018.1 and 2018.4.1.4 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious We… |
CVE-2018-8035 | Medium | 6.1 | 2019-05-01 | This vulnerability relates to the user's browser processing of DUCC webpage input data.The javascript comprising Apache UIMA DUCC (<= 2.2.2) which runs in the… |
CVE-2018-1933 | Medium | 5.4 | 2019-05-01 | IBM Planning Analytics 2.0 through 2.0.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web U… |
CVE-2018-1608 | Medium | 5.9 | 2019-05-01 | IBM Rational Engineering Lifecycle Manager 6.0 through 6.0.6 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly… |
CVE-2018-20835 | High | 7.5 | 2019-04-30 | A vulnerability was found in tar-fs before 1.16.2. An Arbitrary File Overwrite issue exists when extracting a tarball containing a hardlink to a file that alre… |
CVE-2018-20834 | High | 7.5 | 2019-04-30 | A vulnerability was found in node-tar before version 4.4.2 (excluding version 2.2.2). An Arbitrary File Overwrite issue exists when extracting a tarball contai… |
CVE-2018-15208 | High | 7.5 | 2019-04-30 | BPC SmartVista 2 has Session Fixation via the JSESSIONID parameter. |
CVE-2018-15207 | High | 7.2 | 2019-04-30 | BPC SmartVista 2 has Improper Access Control in the SVFE module, where it fails to appropriately restrict access: a normal user is able to access the SVFE2/pag… |
CVE-2018-15206 | High | 8.8 | 2019-04-30 | BPC SmartVista 2 has CSRF via SVFE2/pages/admpages/roles/createrole.jsf. |
CVE-2018-14931 | Medium | 6.1 | 2019-04-30 | An issue was discovered in the Core and Portal modules in Polaris FT Intellect Core Banking 9.7.1. An open redirect exists via a /IntellectMain.jsp?IntellectSy… |
CVE-2018-14930 | High | 8.8 | 2019-04-30 | An issue was discovered in the Armor module in Polaris FT Intellect Core Banking 9.7.1. CSRF can occur via a /CollatWebApp/gcmsRefInsert?name=SUPP URI. |
CVE-2018-14875 | Medium | 5.4 | 2019-04-30 | An issue was discovered in the Core and Portal modules in Polaris FT Intellect Core Banking 9.7.1. Reflected XSS exists with an authenticated session via the C… |
CVE-2018-14874 | High | 8.8 | 2019-04-30 | An issue was discovered in the Armor module in Polaris FT Intellect Core Banking 9.7.1. Input passed through the code parameter in three pages as collaterals/c… |
CVE-2018-20510 | Medium | 5.5 | 2019-04-30 | The print_binder_transaction_ilocked function in drivers/android/binder.c in the Linux kernel 4.14.90 allows local users to obtain sensitive address informatio… |
CVE-2018-20509 | Medium | 5.5 | 2019-04-30 | The print_binder_ref_olocked function in drivers/android/binder.c in the Linux kernel 4.14.90 allows local users to obtain sensitive address information by rea… |
CVE-2018-19374 | High | 7.0 | 2019-04-30 | Zoho ManageEngine ADManager Plus 6.6 Build 6657 allows local users to gain privileges (after a reboot) by placing a Trojan horse file into the permissive bin d… |
CVE-2018-20239 | Medium | 5.4 | 2019-04-30 | Application Links before version 5.0.11, from version 5.1.0 before 5.2.10, from version 5.3.0 before 5.3.6, from version 5.4.0 before 5.4.12, and from version… |
CVE-2018-2007 | Medium | 5.9 | 2019-04-29 | IBM API Connect 2018.1 and 2018.4.1.2 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information… |
CVE-2018-2004 | Medium | 5.4 | 2019-04-29 | IBM Jazz Reporting Service (JRS) 6.0 through 6.0.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in… |
CVE-2018-1961 | Medium | 5.3 | 2019-04-29 | IBM Emptoris Contract Management 10.0.0 and 10.1.3.0 could disclose sensitive information from detailed information from error messages. IBM X-Force ID: 153657. |
CVE-2018-5123 | High | 8.8 | 2019-04-29 | A third party website can access information available to a user with access to a restricted bug entry using the image generation in report.cgi in all Bugzilla… |
CVE-2018-12384 | Medium | 5.9 | 2019-04-29 | When handling a SSLv2-compatible ClientHello request, the server doesn't generate a new random value but sends an all-zero value instead. This results in full… |
CVE-2018-18276 | Medium | 4.8 | 2019-04-26 | XSS exists in the ProFiles 1.5 component for Joomla! via the name or path parameter when creating a new folder in the administrative panel. |
CVE-2018-15584 | Medium | 6.1 | 2019-04-26 | Cross-Site Scripting (XSS) vulnerability in adm/boardgroup_form_update.php and adm/boardgroup_list_update.php in gnuboard5 before 5.3.1.6 allows remote attacke… |
CVE-2018-15582 | Medium | 6.1 | 2019-04-26 | Cross-Site Scripting (XSS) vulnerability in adm/sms_admin/num_book_write.php and adm/sms_admin/num_book_update.php in gnuboard5 before 5.3.1.6 allows remote at… |
CVE-2018-15581 | Medium | 6.1 | 2019-04-26 | Cross-Site Scripting (XSS) vulnerability in adm/faqmasterformupdate.php in gnuboard5 before 5.3.1.6 allows remote attackers to inject arbitrary web script or H… |
CVE-2018-15580 | Medium | 6.1 | 2019-04-26 | Cross-Site Scripting (XSS) vulnerability in adm/contentformupdate.php in gnuboard5 before 5.3.1.6 allows remote attackers to inject arbitrary web script or HTM… |
CVE-2018-5124 | Medium | 6.1 | 2019-04-26 | Unsanitized output in the browser UI leaves HTML tags in place and can result in arbitrary code execution in Firefox before version 58.0.1. |
CVE-2018-18513 | High | 7.5 | 2019-04-26 | A crash can occur when processing a crafted S/MIME message or an XPI package containing a crafted signature. This can be used as a denial-of-service (DOS) atta… |
CVE-2018-18512 | Critical | 9.8 | 2019-04-26 | A use-after-free vulnerability can occur while playing a sound notification in Thunderbird. The memory storing the sound data is immediately freed, although th… |
CVE-2018-18511 | Medium | 4.3 | 2019-04-26 | Cross-origin images can be read from a canvas element in violation of the same-origin policy using the transferFromImageBitmap method. *Note: This only affects… |
CVE-2018-18510 | Medium | 6.5 | 2019-04-26 | The about:crashcontent and about:crashparent pages can be triggered by web content. These pages are used to crash the loaded page or the browser for test purpo… |
CVE-2018-18509 | Medium | 5.3 | 2019-04-26 | A flaw during verification of certain S/MIME signatures causes emails to be shown in Thunderbird as having a valid digital signature, even if the shown message… |
CVE-2018-5179 | High | 7.5 | 2019-04-26 | A service worker can send the activate event on itself periodically which allows it to run perpetually, allowing it to monitor activity by users. Affects all v… |
CVE-2018-19359 | High | 8.8 | 2019-04-25 | GitLab Community and Enterprise Edition 8.9 and later and before 11.5.0-rc12, 11.4.6, and 11.3.10 has Incorrect Access Control. |
CVE-2018-18643 | Medium | 6.1 | 2019-04-25 | GitLab CE & EE 11.2 and later and before 11.5.0-rc12, 11.4.6, and 11.3.10 have Persistent XSS. |
CVE-2018-18824 | Medium | 4.8 | 2019-04-25 | WolfCMS v0.8.3.1 allows XSS via an SVG file to /?/admin/plugin/file_manager/browse/. |
CVE-2018-18823 | Medium | 4.8 | 2019-04-25 | WolfCMS 0.8.3.1 allows XSS via an SVG file to /?/admin/plugin/file_manager/browse/. |
CVE-2018-18367 | High | 7.8 | 2019-04-25 | Symantec Endpoint Protection Manager (SEPM) prior to and including 12.1 RU6 MP9 and prior to 14.2 RU1 may be susceptible to a DLL Preloading vulnerability, whi… |
CVE-2018-18366 | Medium | 6.5 | 2019-04-25 | Symantec Norton Security prior to 22.16.3, SEP (Windows client) prior to and including 12.1 RU6 MP9, and prior to 14.2 RU1, SEP SBE prior to Cloud Agent 3.00.3… |
CVE-2018-18285 | Critical | 9.8 | 2019-04-25 | SQL injection vulnerabilities in CMG Suite 8.4 SP2 and earlier, could allow an unauthenticated attacker to conduct an SQL injection attack due to insufficient… |
CVE-2018-16660 | High | 8.8 | 2019-04-25 | A command injection vulnerability in PWS in Imperva SecureSphere 13.0.0.10 and 13.1.0.10 Gateway allows an attacker with authenticated access to execute arbitr… |
CVE-2018-16220 | Medium | 6.1 | 2019-04-25 | Cross Site Scripting in different input fields (domain field and personal settings) in AudioCodes 405HD VoIP phone with firmware 2.2.12 allows an attacker (loc… |
CVE-2018-16219 | High | 8.8 | 2019-04-25 | A missing password verification in the web interface in AudioCodes 405HD VoIP phone with firmware 2.2.12 allows an remote attacker (in the same network as the… |