2018 CVEs (page 21)
Page 21 of 162 — CVEs published in 2018, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2018-16216 | High | 8.0 | 2019-04-25 | A command injection (missing input validation, escaping) in the monitoring or memory status web interface in AudioCodes 405HD (firmware 2.2.12) VoIP phone allo… |
CVE-2018-15003 | High | 7.5 | 2019-04-25 | The Coolpad Defiant (Coolpad/cp3632a/cp3632a:7.1.1/NMF26F/099480857:user/release-keys) and the T-Mobile Revvl Plus (Coolpad/alchemy/alchemy:7.1.1/143.14.171129… |
CVE-2018-15000 | Medium | 6.3 | 2019-04-25 | The Vivo V7 Android device with a build fingerprint of vivo/1718/1718:7.1.2/N2G47H/compil11021857:user/release-keys contains a platform app with a package name… |
CVE-2018-14999 | Critical | 9.1 | 2019-04-25 | The Leagoo P1 device with a build fingerprint of sp7731c_1h10_32v4_bird:6.0/MRA58K/android.20170629.214736:user/release-keys contains a pre-installed platform… |
CVE-2018-14997 | Medium | 5.5 | 2019-04-25 | The Leagoo P1 Android device with a build fingerprint of sp7731c_1h10_32v4_bird:6.0/MRA58K/android.20170629.214736:user/release-keys contains the android frame… |
CVE-2018-14996 | High | 7.8 | 2019-04-25 | The Oppo F5 Android device with a build fingerprint of OPPO/CPH1723/CPH1723:7.1.1/N6F26Q/1513597833:user/release-keys contains a pre-installed platform app wit… |
CVE-2018-14994 | High | 7.5 | 2019-04-25 | The Essential Phone Android device with a build fingerprint of essential/mata/mata:8.1.0/OPM1.180104.166/297:user/release-keys contains a pre-installed platfor… |
CVE-2018-14993 | High | 7.8 | 2019-04-25 | The ASUS Zenfone V Live Android device with a build fingerprint of asus/VZW_ASUS_A009/ASUS_A009:7.1.1/NMF26F/14.0610.1802.78-20180313:user/release-keys and the… |
CVE-2018-14991 | Critical | 9.8 | 2019-04-25 | The Coolpad Defiant device with a build fingerprint of Coolpad/cp3632a/cp3632a:7.1.1/NMF26F/099480857:user/release-keys, the ZTE ZMAX Pro with a build fingerpr… |
CVE-2018-14990 | High | 7.5 | 2019-04-25 | The Coolpad Defiant device with a build fingerprint of Coolpad/cp3632a/cp3632a:7.1.1/NMF26F/099480857:user/release-keys, the ZTE ZMAX Pro with a build fingerpr… |
CVE-2018-14989 | High | 7.5 | 2019-04-25 | The Plum Compass Android device with a build fingerprint of PLUM/c179_hwf_221/c179_hwf_221:6.0/MRA58K/W16.51.5-22:user/release-keys contains a pre-installed pl… |
CVE-2018-14983 | Medium | 5.5 | 2019-04-25 | The Sony Xperia L1 Android device with a build fingerprint of Sony/G3313/G3313:7.0/43.0.A.6.49/2867558199:user/release-keys contains the android framework (i.e… |
CVE-2018-14980 | High | 7.1 | 2019-04-25 | The ASUS ZenFone 3 Max Android device with a build fingerprint of asus/US_Phone/ASUS_X008_1:7.0/NRD90M/US_Phone-14.14.1711.92-20171208:user/release-keys contai… |
CVE-2018-14559 | High | 7.5 | 2019-04-25 | An issue was discovered on Tenda AC7 devices with firmware through V15.03.06.44_CN(AC7), AC9 devices with firmware through V15.03.05.19(6318)_CN(AC9), and AC10… |
CVE-2018-14557 | High | 7.5 | 2019-04-25 | An issue was discovered on Tenda AC7 devices with firmware through V15.03.06.44_CN(AC7), AC9 devices with firmware through V15.03.05.19(6318)_CN(AC9), and AC10… |
CVE-2018-18286 | Critical | 9.8 | 2019-04-25 | SQL injection vulnerabilities in CMG Suite 8.4 SP2 and earlier, could allow an unauthenticated attacker to conduct an SQL injection attack due to insufficient… |
CVE-2018-12244 | Medium | 6.3 | 2019-04-25 | SEP (Mac client) prior to and including 12.1 RU6 MP9 and prior to 14.2 RU1 may be susceptible to a CSV/DDE injection (also known as formula injection) vulnerab… |
CVE-2018-1360 | High | 8.1 | 2019-04-25 | A cleartext transmission of sensitive information vulnerability in Fortinet FortiManager 5.2.0 through 5.2.7, 5.4.0 and 5.4.1 may allow an unauthenticated atta… |
CVE-2018-19442 | Critical | 9.8 | 2019-04-25 | A Buffer Overflow in Network::AuthenticationClient::VerifySignature in /bin/astro in Neato Botvac Connected 2.2.0 allows a remote attacker to execute arbitrary… |
CVE-2018-18369 | High | 7.8 | 2019-04-25 | Norton Security (Windows client) prior to 22.16.3 and SEP SBE (Windows client) prior to Cloud Agent 3.00.31.2817, NIS-22.15.2.22 & SEP-12.1.7484.7002, may be s… |
CVE-2018-20053 | Critical | 9.8 | 2019-04-25 | An issue was discovered on Cerner Connectivity Engine (CCE) 4 devices. The hostname, timezone, and NTP server configurations on the CCE device are vulnerable t… |
CVE-2018-20052 | High | 7.8 | 2019-04-25 | An issue was discovered on Cerner Connectivity Engine (CCE) 4 devices. The user running the main CCE firmware has NOPASSWD sudo privileges to several utilities… |
CVE-2018-1720 | Medium | 5.9 | 2019-04-25 | IBM Sterling B2B Integrator Standard Edition 5.2.0.1, 5.2.6.3_6, 6.0.0.0, and 6.0.0.1 uses weaker than expected cryptographic algorithms that could allow an at… |
CVE-2018-20823 | High | 7.5 | 2019-04-25 | The gyroscope on Xiaomi Mi 5s devices allows attackers to cause a denial of service (resonance and false data) via a 20.4 kHz audio signal, aka a MEMS ultrasou… |
CVE-2018-7575 | Critical | 9.8 | 2019-04-24 | Google TensorFlow 1.7.x and earlier is affected by a Buffer Overflow vulnerability. The type of exploitation is context-dependent. |
CVE-2018-20434 | Critical | 9.8 | 2019-04-24 | LibreNMS 1.46 allows remote attackers to execute arbitrary OS commands by using the $_POST['community'] parameter to html/pages/addhost.inc.php during creation… |
CVE-2018-18251 | Critical | 9.8 | 2019-04-24 | Deltek Vision 7.x before 7.6 permits the execution of any attacker supplied SQL statement through a custom RPC over HTTP protocol. The Vision system relies on… |
CVE-2018-7577 | High | 8.1 | 2019-04-24 | Memcpy parameter overlap in Google Snappy library 1.1.4, as used in Google TensorFlow before 1.7.1, could result in a crash or read from other parts of process… |
CVE-2018-10055 | High | 8.1 | 2019-04-24 | Invalid memory access and/or a heap buffer overflow in the TensorFlow XLA compiler in Google TensorFlow before 1.7.1 could cause a crash or read from other par… |
CVE-2018-13443 | High | 8.8 | 2019-04-24 | EOS.IO jit-wasm 4.1 has a heap-based buffer overflow via a crafted wast file. |
CVE-2018-8825 | High | 8.8 | 2019-04-23 | Google TensorFlow 1.7 and below is affected by: Buffer Overflow. The impact is: execute arbitrary code (local). |
CVE-2018-7576 | Medium | 6.5 | 2019-04-23 | Google TensorFlow 1.6.x and earlier is affected by: Null Pointer Dereference. The type of exploitation is: context-dependent. |
CVE-2018-3314 | High | 8.2 | 2019-04-23 | Vulnerability in the MICROS Relate CRM Software component of Oracle Retail Applications (subcomponent: Customer). The supported version that is affected is 11… |
CVE-2018-3312 | Medium | 5.5 | 2019-04-23 | Vulnerability in the Oracle Retail Customer Engagement component of Oracle Retail Applications (subcomponent: Segment). Supported versions that are affected ar… |
CVE-2018-3123 | Medium | 5.9 | 2019-04-23 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: libmysqld). Supported versions that are affected are 5.6.42 and prior, 5.7.2… |
CVE-2018-3120 | High | 7.5 | 2019-04-23 | Vulnerability in the MICROS Lucas component of Oracle Retail Applications (subcomponent: Security). Supported versions that are affected are 2.9.5.6 and 2.9.5… |
CVE-2018-2880 | High | 7.5 | 2019-04-23 | Vulnerability in the MICROS Retail-J component of Oracle Retail Applications (subcomponent: Back Office). The supported version that is affected is 12.1.2. Eas… |
CVE-2018-1328 | Medium | 6.1 | 2019-04-23 | Apache Zeppelin prior to 0.8.0 had a stored XSS issue via Note permissions. Issue reported by "Josna Joseph". |
CVE-2018-1317 | High | 8.8 | 2019-04-23 | In Apache Zeppelin prior to 0.8.0 the cron scheduler was enabled by default and could allow users to run paragraphs as other users without authentication. |
CVE-2018-20822 | Medium | 6.5 | 2019-04-23 | LibSass 3.5.4 allows attackers to cause a denial-of-service (uncontrolled recursion in Sass::Complex_Selector::perform in ast.hpp and Sass::Inspect::operator i… |
CVE-2018-20821 | Medium | 6.5 | 2019-04-23 | The parsing component in LibSass through 3.5.5 allows attackers to cause a denial-of-service (uncontrolled recursion in Sass::Parser::parse_css_variable_value… |
CVE-2018-20820 | Medium | 5.5 | 2019-04-23 | read_ujpg in jpgcoder.cc in Dropbox Lepton 1.2.1 allows attackers to cause a denial-of-service (application runtime crash because of an integer overflow) via a… |
CVE-2018-20819 | High | 7.8 | 2019-04-23 | io/ZlibCompression.cc in the decompression component in Dropbox Lepton 1.2.1 allows attackers to cause a denial of service (heap-based buffer overflow and appl… |
CVE-2018-17169 | High | 7.7 | 2019-04-23 | An XML external entity (XXE) vulnerability in PrinterOn version 4.1.4 and lower allows remote authenticated users to read arbitrary files or conduct server-sid… |
CVE-2018-20818 | Critical | 9.8 | 2019-04-22 | A buffer overflow vulnerability was discovered in the OpenPLC controller, in the OpenPLC_v2 and OpenPLC_v3 versions. It occurs in the modbus.cpp mapUnusedIO()… |
CVE-2018-20817 | Critical | 9.8 | 2019-04-19 | SV_SteamAuthClient in various Activision Infinity Ward Call of Duty games before 2015-08-11 is missing a size check when reading authBlob data into a buffer, w… |
CVE-2018-1729 | Medium | 5.3 | 2019-04-19 | IBM QRadar SIEM 7.3 discloses sensitive information to unauthorized users. The information can be used to mount further attacks on the system. IBM X-Force ID… |
CVE-2018-20200 | Medium | 5.9 | 2019-04-18 | CertificatePinner.java in OkHttp 3.x through 3.12.0 allows man-in-the-middle attackers to bypass certificate pinning by changing SSLContext and the boolean val… |
CVE-2018-17289 | Medium | 6.5 | 2019-04-18 | An XML external entity (XXE) vulnerability in Kofax Front Office Server Administration Console version 4.1.1.11.0.5212 allows remote authenticated users to rea… |
CVE-2018-17288 | Medium | 5.4 | 2019-04-18 | Kofax Front Office Server version 4.1.1.11.0.5212 (both Thin Client and Administration Console) suffers from multiple authenticated stored XSS vulnerabilities… |
CVE-2018-17287 | Medium | 4.9 | 2019-04-18 | In Kofax Front Office Server Administration Console 4.1.1.11.0.5212, some fields, such as passwords, are obfuscated in the front-end, but the cleartext value c… |
CVE-2018-16878 | Medium | 5.5 | 2019-04-18 | A flaw was found in pacemaker up to and including version 2.0.1. An insufficient verification inflicted preference of uncontrolled processes can lead to DoS |
CVE-2018-16877 | High | 7.8 | 2019-04-18 | A flaw was found in the way pacemaker's client-server authentication was implemented in versions up to and including 2.0.0. A local attacker could use this fla… |
CVE-2018-17168 | Medium | 6.5 | 2019-04-18 | PrinterOn Enterprise 4.1.4 contains multiple Cross Site Request Forgery (CSRF) vulnerabilities in the Administration page. For example, an administrator, by fo… |
CVE-2018-0382 | Medium | 5.3 | 2019-04-17 | A vulnerability in the session identification management functionality of the web-based interface of Cisco Wireless LAN Controller (WLC) Software could allow a… |
CVE-2018-0248 | Medium | 6.8 | 2019-04-17 | A vulnerability in the administrative GUI configuration feature of Cisco Wireless LAN Controller (WLC) Software could allow an aUTHENTICated, remote attacker t… |
CVE-2018-20028 | Medium | 6.5 | 2019-04-17 | Contao 3.x before 3.5.37, 4.4.x before 4.4.31 and 4.6.x before 4.6.11 has Incorrect Access Control. |
CVE-2018-18094 | High | 7.8 | 2019-04-17 | Improper directory permissions in installer for Intel(R) Media SDK before 2018 R2.1 may allow an authenticated user to potentially enable escalation of privile… |
CVE-2018-7340 | High | 7.5 | 2019-04-17 | Duo Network Gateway 1.2.9 and earlier may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be… |
CVE-2018-4007 | High | 7.1 | 2019-04-17 | An exploitable privilege escalation vulnerability exists in the Shimo VPN 4.1.5.1 helper service in the deleteConfig functionality. The program is able to dele… |
CVE-2018-4006 | High | 7.8 | 2019-04-17 | An exploitable privilege escalation vulnerability exists in the Shimo VPN 4.1.5.1 helper service in the writeConfig functionality. A non-root user is able to w… |
CVE-2018-4005 | High | 7.8 | 2019-04-17 | An exploitable privilege escalation vulnerability exists in the Shimo VPN 4.1.5.1 helper service in the configureRoutingWithCommand function. A user with local… |
CVE-2018-4004 | Medium | 5.5 | 2019-04-17 | An exploitable privilege escalation vulnerability exists in the Shimo VPN 4.1.5.1 helper service in the disconnectService functionality. A non-root user is abl… |
CVE-2018-13378 | High | 7.2 | 2019-04-17 | An information disclosure vulnerability in Fortinet FortiSIEM 5.2.0 and below versions exposes the LDAP server plaintext password via the HTML source code. |
CVE-2018-10959 | High | 7.5 | 2019-04-17 | Avecto Defendpoint 4 prior to 4.4 SR6 and 5 prior to 5.1 SR1 has an Untrusted Search Path vulnerability, exploitable by modifying environment variables to trig… |
CVE-2018-16561 | High | 7.5 | 2019-04-17 | A vulnerability has been identified in SIMATIC S7-300 CPUs (All versions < V3.X.16). The affected CPUs improperly validate S7 communication packets which could… |
CVE-2018-16559 | High | 7.5 | 2019-04-17 | A vulnerability has been identified in SIMATIC S7-1500 CPU (All versions >= V2.0 and < V2.5), SIMATIC S7-1500 CPU (All versions <= V1.8.5). Specially crafted n… |
CVE-2018-16558 | High | 7.5 | 2019-04-17 | A vulnerability has been identified in SIMATIC S7-1500 CPU (All versions >= V2.0 and < V2.5), SIMATIC S7-1500 CPU (All versions <= V1.8.5). Specially crafted n… |
CVE-2018-13810 | Medium | 6.5 | 2019-04-17 | A vulnerability has been identified in CP 1604 (All versions), CP 1616 (All versions). The integrated configuration web server of the affected CP devices could… |
CVE-2018-13809 | Medium | 6.1 | 2019-04-17 | A vulnerability has been identified in CP 1604 (All versions), CP 1616 (All versions). The integrated web server of the affected CP devices could allow Cross-S… |
CVE-2018-13808 | Critical | 9.1 | 2019-04-17 | A vulnerability has been identified in CP 1604 (All versions), CP 1616 (All versions). An attacker with network access to port 23/tcp could extract internal co… |
CVE-2018-19971 | Critical | 9.8 | 2019-04-16 | JFrog Artifactory Pro 6.5.9 has Incorrect Access Control. |
CVE-2018-18489 | Medium | 4.9 | 2019-04-16 | The ping feature in the Diagnostic functionality on TP-LINK WR840N v2 Firmware 3.16.9 Build 150701 Rel.51516n devices allows remote attackers to cause a denial… |
CVE-2018-18019 | Medium | 6.1 | 2019-04-15 | XSS exists in the Tribulant Slideshow Gallery plugin 1.6.8 for WordPress via the wp-admin/admin.php?page=slideshow-slides&method=save Slide[title], Slide[media… |
CVE-2018-18018 | Critical | 9.8 | 2019-04-15 | SQL Injection exists in the Tribulant Slideshow Gallery plugin 1.6.8 for WordPress via the wp-admin/admin.php?page=slideshow-galleries&method=save Gallery[id]… |
CVE-2018-18017 | Medium | 6.1 | 2019-04-15 | XSS exists in the Tribulant Slideshow Gallery plugin 1.6.8 for WordPress via the wp-admin/admin.php?page=slideshow-galleries&method=save Gallery[id] or Gallery… |
CVE-2018-16967 | Medium | 6.1 | 2019-04-15 | There is an XSS vulnerability in the mndpsingh287 File Manager plugin 3.0 for WordPress via the page=wp_file_manager_root public_path parameter. |
CVE-2018-16966 | High | 8.8 | 2019-04-15 | There is a CSRF vulnerability in the mndpsingh287 File Manager plugin 3.0 for WordPress via the page=wp_file_manager_root public_path parameter. |
CVE-2018-4009 | High | 7.8 | 2019-04-15 | An exploitable privilege escalation vulnerability exists in the Shimo VPN helper service due to improper validation of code signing. A user with local access c… |
CVE-2018-4008 | High | 7.8 | 2019-04-15 | An exploitable privilege escalation vulnerability exists in the Shimo VPN 4.1.5.1 helper service in the RunVpncScript command. The command takes a user-supplie… |
CVE-2018-17586 | Medium | 6.1 | 2019-04-15 | The WP Fastest Cache plugin 0.8.8.5 for WordPress has XSS via the rules[0][content] parameter in a wpfc_save_timeout_pages action. |
CVE-2018-17585 | Medium | 6.1 | 2019-04-15 | The WP Fastest Cache plugin 0.8.8.5 for WordPress has XSS via the wpfastestcacheoptions wpFastestCachePreload_number or wpFastestCacheLanguage parameter. |
CVE-2018-17584 | High | 8.8 | 2019-04-15 | The WP Fastest Cache plugin 0.8.8.5 for WordPress has CSRF via the wp-admin/admin.php wpfastestcacheoptions page. |
CVE-2018-17583 | Medium | 6.1 | 2019-04-15 | The WP Fastest Cache plugin 0.8.8.5 for WordPress has XSS via the rules[0][content] parameter in a wpfc_save_exclude_pages action. |
CVE-2018-1925 | Medium | 5.9 | 2019-04-15 | IBM WebShere MQ 9.1.0.0, 9.1.0.1, 9.1.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information… |
CVE-2018-18261 | Medium | 6.1 | 2019-04-15 | In waimai Super Cms 20150505, there is an XSS vulnerability via the /admin.php/Foodcat/addsave fcname parameter. |
CVE-2018-16259 | Medium | 6.1 | 2019-04-12 | There is an XSS vulnerability in WP All Import plugin 3.4.9 for WordPress via pmxi-admin-settings large_feed_limit. NOTE: The vendor states that this is not a… |
CVE-2018-16258 | Medium | 6.1 | 2019-04-12 | There is an XSS vulnerability in WP All Import plugin 3.4.9 for WordPress via pmxi-admin-import custom_type. NOTE: The vendor states that this is not a vulnera… |
CVE-2018-16257 | Medium | 6.1 | 2019-04-12 | There are multiple XSS vulnerabilities in WP All Import plugin 3.4.9 for WordPress via action=template. NOTE: The vendor states that this is not a vulnerabilit… |
CVE-2018-16256 | Medium | 6.1 | 2019-04-12 | There is an XSS vulnerability in WP All Import plugin 3.4.9 for WordPress via Add Filtering Options(Add Rule). NOTE: The vendor states that this is not a vulne… |
CVE-2018-16255 | Medium | 6.1 | 2019-04-12 | There is an XSS vulnerability in WP All Import plugin 3.4.9 for WordPress via action=evaluate. NOTE: The vendor states that this is not a vulnerability. WP All… |
CVE-2018-16254 | Medium | 6.1 | 2019-04-12 | There is an XSS vulnerability in WP All Import plugin 3.4.9 for WordPress via action=options. NOTE: The vendor states that this is not a vulnerability. WP All… |
CVE-2018-13137 | Medium | 4.8 | 2019-04-12 | The Events Manager plugin 5.9.4 for WordPress has XSS via the dbem_event_reapproved_email_body parameter to the wp-admin/edit.php?post_type=event&page=events-m… |
CVE-2018-6269 | High | 7.8 | 2019-04-12 | NVIDIA Jetson TX2 contains a vulnerability in the kernel driver where input/output control (IOCTL) handling for user mode requests could create a non-trusted p… |
CVE-2018-6239 | Medium | 5.5 | 2019-04-12 | NVIDIA Jetson TX2 contains a vulnerability by means of speculative execution where local and unprivileged code may access the contents of cached information in… |
CVE-2018-20487 | High | 8.8 | 2019-04-11 | An issue was discovered in the firewall3 component in Inteno IOPSYS 1.0 through 3.16. The attacker must make a JSON-RPC method call to add a firewall rule as a… |
CVE-2018-19202 | Medium | 6.1 | 2019-04-11 | A reflected XSS vulnerability in index.php in MyBB 1.8.x through 1.8.19 allows remote attackers to inject JavaScript via the 'upsetting[bburl]' parameter. |
CVE-2018-17305 | High | 8.8 | 2019-04-11 | UiPath Orchestrator through 2018.2.4 allows any authenticated user to change the information of arbitrary users (even administrators) leading to privilege esca… |
CVE-2018-19300 | Critical | 9.8 | 2019-04-11 | On D-Link DAP-1530 (A1) before firmware version 1.06b01, DAP-1610 (A1) before firmware version 1.06b01, DWR-111 (A1) before firmware version 1.02v02, DWR-116 (… |
CVE-2018-14683 | Medium | 6.1 | 2019-04-10 | PRTG before 19.1.49.1966 has Cross Site Scripting (XSS) in the WEBGUI. |