2018 CVEs (page 22)
Page 22 of 162 — CVEs published in 2018, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2018-19453 | High | 8.8 | 2019-04-10 | Kentico CMS before 11.0.45 allows unrestricted upload of a file with a dangerous type. |
CVE-2018-1994 | Medium | 6.3 | 2019-04-10 | IBM InfoSphere Information Server 11.5 and 11.7 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allo… |
CVE-2018-1903 | Medium | 6.7 | 2019-04-10 | IBM Sterling Connect:Direct for UNIX 4.2.0, 4.3.0, and 6.0.0 could allow a user with restricted sudo access on a system to manipulate CD UNIX to gain full sudo… |
CVE-2018-20321 | High | 8.8 | 2019-04-10 | An issue was discovered in Rancher 2 through 2.1.5. Any project member with access to the default namespace can mount the netes-default service account in a po… |
CVE-2018-1356 | Medium | 6.1 | 2019-04-09 | A reflected Cross-Site-Scripting (XSS) vulnerability in Fortinet FortiSandbox before 3.0 may allow an attacker to execute unauthorized code or commands via the… |
CVE-2018-18365 | High | 7.5 | 2019-04-09 | Norton Password Manager may be susceptible to an address spoofing issue. This type of issue may allow an attacker to disguise their origin IP address in order… |
CVE-2018-7118 | High | 7.8 | 2019-04-09 | A local access restriction bypass vulnerability was identified in HPE Service Pack for ProLiant (SPP) Bundled Software earlier than version 2018.09.0. |
CVE-2018-7117 | Medium | 6.1 | 2019-04-09 | A remote Cross-Site Scripting in HPE iLO 5 Web User Interface vulnerability was identified in HPE Integrated Lights-Out 5 (iLO 5) for Gen10 ProLiant Servers ea… |
CVE-2018-16530 | Critical | 9.8 | 2019-04-09 | A stack-based buffer overflow in Forcepoint Email Security version 8.5 allows an attacker to craft malicious input and potentially crash a process creating a d… |
CVE-2018-20698 | Medium | 6.1 | 2019-04-09 | The floragunn Search Guard plugin before 6.x-16 for Kibana allows URL injection for login redirects on the login page when basePath is set. |
CVE-2018-19586 | Critical | 9.9 | 2019-04-09 | Silverpeas 5.15 through 6.0.2 is affected by an authenticated Directory Traversal vulnerability that can be triggered during file uploads because core/webapi/u… |
CVE-2018-14894 | High | 7.8 | 2019-04-09 | CyberArk Endpoint Privilege Manager 10.2.1.603 and earlier allows an attacker (who is able to edit permissions of a file) to bypass intended access restriction… |
CVE-2018-19589 | Medium | 6.5 | 2019-04-09 | Incorrect Access Controls of Security Officer (SO) in PKCS11 R2 provider that ships with the Utimaco CryptoServer HSM product package allows an SO authenticate… |
CVE-2018-13366 | Medium | 5.3 | 2019-04-09 | An information disclosure vulnerability in Fortinet FortiOS 6.0.1, 5.6.7 and below allows attacker to reveals serial number of FortiGate via hostname field def… |
CVE-2018-15640 | High | 8.8 | 2019-04-09 | Improper access control in the Helpdesk App of Odoo Enterprise 10.0 through 12.0 allows remote authenticated attackers to obtain elevated privileges via a craf… |
CVE-2018-15635 | Medium | 5.9 | 2019-04-09 | Cross-site scripting vulnerability in the Discuss App of Odoo Community 12.0 and earlier, and Odoo Enterprise 12.0 and earlier allows remote attackers to injec… |
CVE-2018-15631 | Medium | 6.5 | 2019-04-09 | Improper access control in the Discuss App of Odoo Community 12.0 and earlier, and Odoo Enterprise 12.0 and earlier allows remote authenticated attackers to e-… |
CVE-2018-20341 | High | 7.8 | 2019-04-08 | WINMAGIC SecureDoc Disk Encryption software before 8.3 has an Unquoted Service Path vulnerability, which could allow an attacker to execute arbitrary code on a… |
CVE-2018-2000 | Medium | 4.3 | 2019-04-08 | IBM Business Automation Workflow 18.0.0.0 and 18.0.0.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unaut… |
CVE-2018-1999 | Medium | 4.3 | 2019-04-08 | IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, and 18.0.0.2 could reveal sensitive version information about the server from error pages that could aid a… |
CVE-2018-1997 | Medium | 4.3 | 2019-04-08 | IBM Business Automation Workflow and Business Process Manager 18.0.0.0, 18.0.0.1, and 18.0.0.2 are vulnerable to a denial of service attack. An authenticated a… |
CVE-2018-1943 | Medium | 5.4 | 2019-04-08 | IBM Cloud Private 3.1.0 and 3.1.1 is vulnerable to HTTP HOST header injection, caused by improper validation of input. By persuading a victim to visit a specia… |
CVE-2018-19006 | Medium | 4.8 | 2019-04-08 | OSIsoft PI Vision, versions PI Vision 2017, and PI Vision 2017 R2, The application contains a cross-site scripting vulnerability where displays that reference… |
CVE-2018-1885 | Medium | 5.3 | 2019-04-08 | IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, and 18.0.0.2 could allow an unauthenticated attacker to obtain sensitve information using a specially crac… |
CVE-2018-1882 | Medium | 4.7 | 2019-04-08 | In a certain atypical IBM Spectrum Protect 7.1 and 8.1 configurations, the node password could be displayed in plain text in the IBM Spectrum Protect client tr… |
CVE-2018-1853 | Medium | 6.1 | 2019-04-08 | IBM Tivoli Storage Manager (IBM Spectrum Protect 7.1 and 8.1) could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim… |
CVE-2018-1787 | Medium | 5.1 | 2019-04-08 | IBM Spectrum Protect 7.1 and 8.1 is affected by a password exposure vulnerability caused by insecure file permissions. IBM X-Force ID: 148872. |
CVE-2018-20816 | Medium | 6.1 | 2019-04-05 | An XSS combined with CSRF vulnerability discovered in SalesAgility SuiteCRM 7.x before 7.8.24 and 7.10.x before 7.10.11 leads to cookie stealing, aka session h… |
CVE-2018-19282 | Critical | 9.8 | 2019-04-04 | Rockwell Automation PowerFlex 525 AC Drives 5.001 and earlier allow remote attackers to cause a denial of service by crashing the Common Industrial Protocol (C… |
CVE-2018-18068 | Critical | 9.8 | 2019-04-04 | The ARM-based hardware debugging feature on Raspberry Pi 3 module B+ and possibly other devices allows non-secure EL1 code to read/write any EL3 (the highest p… |
CVE-2018-20229 | High | 7.5 | 2019-04-04 | GitLab Community and Enterprise Edition before 11.3.14, 11.4.x before 11.4.12, and 11.5.x before 11.5.5 allows Directory Traversal. |
CVE-2018-20449 | Medium | 5.5 | 2019-04-04 | The hidma_chan_stats function in drivers/dma/qcom/hidma_dbg.c in the Linux kernel 4.14.90 allows local users to obtain sensitive address information by reading… |
CVE-2018-20222 | Critical | 9.8 | 2019-04-04 | XXE issue in Airsonic before 10.1.2 during parse. |
CVE-2018-10244 | Critical | 9.8 | 2019-04-04 | Suricata version 4.0.4 incorrectly handles the parsing of an EtherNet/IP PDU. A malformed PDU can cause the parsing code to read beyond the allocated data beca… |
CVE-2018-10243 | Critical | 9.8 | 2019-04-04 | htp_parse_authorization_digest in htp_parsers.c in LibHTP 0.5.26 allows remote attackers to cause a heap-based buffer over-read via an authorization digest hea… |
CVE-2018-19981 | High | 7.2 | 2019-04-04 | Amazon AWS SDK <=2.8.5 for Android uses Android SharedPreferences to store plain text AWS STS Temporary Credentials retrieved by AWS Cognito Identity Service… |
CVE-2018-13918 | High | 7.8 | 2019-04-04 | kernel could return a received message length higher than expected, which leads to buffer overflow in a subsequent operation and stops normal operation in Snap… |
CVE-2018-11971 | Medium | 5.5 | 2019-04-04 | Interrupt exit code flow may undermine access control policy set forth by secure world can lead to potential secure asset leakage in Snapdragon Auto, Snapdrago… |
CVE-2018-11970 | High | 7.8 | 2019-04-04 | TZ App dynamic allocations not protected from XBL loader in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Consu… |
CVE-2018-11966 | High | 7.8 | 2019-04-04 | Undefined behavior in UE while processing unknown IEI in OTA message in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT… |
CVE-2018-11958 | Medium | 5.5 | 2019-04-04 | Insufficient protection of keys in keypad can lead HLOS to gain access to confidential keypad input data in Snapdragon Auto, Snapdragon Consumer Electronics Co… |
CVE-2018-11830 | High | 7.8 | 2019-04-04 | Improper input validation in QCPE create function may lead to integer overflow in Snapdragon Auto, Snapdragon Consumer Electronics Connectivity, Snapdragon Ind… |
CVE-2018-10242 | High | 7.5 | 2019-04-04 | Suricata version 4.0.4 incorrectly handles the parsing of the SSH banner. A malformed SSH banner can cause the parsing code to read beyond the allocated data b… |
CVE-2018-4470 | Low | 3.3 | 2019-04-03 | A privacy issue in the handling of Open Directory records was addressed with improved indexing. This issue affected versions prior to macOS High Sierra 10.13.6. |
CVE-2018-4465 | High | 7.8 | 2019-04-03 | A memory corruption issue was addressed with improved memory handling. This issue affected versions prior to iOS 12.1.1, macOS Mojave 10.14.2, tvOS 12.1.1, wat… |
CVE-2018-4464 | High | 8.8 | 2019-04-03 | Multiple memory corruption issues were addressed with improved memory handling. This issue affected versions prior to iOS 12.1.1, tvOS 12.1.1, watchOS 5.1.2, S… |
CVE-2018-4463 | High | 7.8 | 2019-04-03 | A memory corruption issue was addressed with improved memory handling. This issue affected versions prior to macOS Mojave 10.14.2. |
CVE-2018-4462 | Medium | 5.5 | 2019-04-03 | A validation issue was addressed with improved input sanitization. This issue affected versions prior to macOS Mojave 10.14.2. |
CVE-2018-4461 | High | 7.8 | 2019-04-03 | A memory corruption issue was addressed with improved input validation. This issue affected versions prior to iOS 12.1.1, macOS Mojave 10.14.2, tvOS 12.1.1, wa… |
CVE-2018-4460 | Medium | 6.5 | 2019-04-03 | A denial of service issue was addressed by removing the vulnerable code. This issue affected versions prior to iOS 12.1.1, macOS Mojave 10.14.2, tvOS 12.1.1, w… |
CVE-2018-4456 | High | 7.8 | 2019-04-03 | A memory corruption issue was addressed with improved input validation. This issue affected versions prior to macOS High Sierra 10.13.6, macOS Mojave 10.14. |
CVE-2018-4450 | High | 7.8 | 2019-04-03 | A memory corruption issue was addressed with improved memory handling. This issue affected versions prior to macOS Mojave 10.14.2. |
CVE-2018-4449 | High | 7.8 | 2019-04-03 | A memory corruption issue was addressed with improved memory handling. This issue affected versions prior to macOS Mojave 10.14.2. |
CVE-2018-4447 | High | 7.8 | 2019-04-03 | A memory corruption issue was addressed with improved state management. This issue affected versions prior to iOS 12.1.1, macOS Mojave 10.14.2, tvOS 12.1.1, wa… |
CVE-2018-4446 | Low | 3.3 | 2019-04-03 | This issue was addressed with improved entitlements. This issue affected versions prior to iOS 12.1.1. |
CVE-2018-4445 | Medium | 4.3 | 2019-04-03 | "Clear History and Website Data" did not clear the history. The issue was addressed with improved data deletion. This issue affected versions prior to iOS 12.1… |
CVE-2018-4443 | High | 8.8 | 2019-04-03 | A memory corruption issue was addressed with improved memory handling. This issue affected versions prior to iOS 12.1.1, tvOS 12.1.1, watchOS 5.1.2, Safari 12… |
CVE-2018-4442 | High | 8.8 | 2019-04-03 | A memory corruption issue was addressed with improved memory handling. This issue affected versions prior to iOS 12.1.1, tvOS 12.1.1, watchOS 5.1.2, Safari 12… |
CVE-2018-4441 | High | 8.8 | 2019-04-03 | A memory corruption issue was addressed with improved memory handling. This issue affected versions prior to iOS 12.1.1, tvOS 12.1.1, watchOS 5.1.2, Safari 12… |
CVE-2018-4440 | Medium | 4.3 | 2019-04-03 | A logic issue was addressed with improved state management. This issue affected versions prior to iOS 12.1.1, Safari 12.0.2, iTunes 12.9.2 for Windows, iCloud… |
CVE-2018-4439 | Medium | 6.5 | 2019-04-03 | A logic issue was addressed with improved validation. This issue affected versions prior to iOS 12.1.1, Safari 12.0.2, iTunes 12.9.2 for Windows, iCloud for Wi… |
CVE-2018-4438 | High | 8.8 | 2019-04-03 | A logic issue existed resulting in memory corruption. This was addressed with improved state management. This issue affected versions prior to iOS 12.1.1, tvOS… |
CVE-2018-4437 | High | 8.8 | 2019-04-03 | Multiple memory corruption issues were addressed with improved memory handling. This issue affected versions prior to iOS 12.1.1, tvOS 12.1.1, watchOS 5.1.2, S… |
CVE-2018-4436 | High | 7.5 | 2019-04-03 | A certificate validation issue existed in configuration profiles. This was addressed with additional checks. This issue affected versions prior to iOS 12.1.1… |
CVE-2018-4435 | High | 7.8 | 2019-04-03 | A logic issue was addressed with improved restrictions. This issue affected versions prior to iOS 12.1.1, macOS Mojave 10.14.2, tvOS 12.1.1, watchOS 5.1.2. |
CVE-2018-4434 | High | 7.1 | 2019-04-03 | An out-of-bounds read was addressed with improved input validation. This issue affected versions prior to macOS Mojave 10.14.2. |
CVE-2018-4431 | Medium | 5.5 | 2019-04-03 | A memory initialization issue was addressed with improved memory handling. This issue affected versions prior to iOS 12.1.1, macOS Mojave 10.14.2, tvOS 12.1.1… |
CVE-2018-4430 | Low | 2.4 | 2019-04-03 | A lock screen issue allowed access to contacts on a locked device. This issue was addressed with improved state management. This issue affected versions prior… |
CVE-2018-4429 | Medium | 6.5 | 2019-04-03 | A spoofing issue existed in the handling of URLs. This issue was addressed with improved input validation. This issue affected versions prior to iOS 12.1.1, wa… |
CVE-2018-4427 | High | 7.8 | 2019-04-03 | A memory corruption issue was addressed with improved memory handling. This issue affected versions prior to: iOS 12.1, watchOS 5.1.2, tvOS 12.1.1, macOS High… |
CVE-2018-4426 | High | 7.8 | 2019-04-03 | A memory corruption issue was addressed with improved memory handling. This issue affected versions prior to iOS 12, macOS Mojave 10.14, tvOS 12, watchOS 5. |
CVE-2018-4425 | High | 7.8 | 2019-04-03 | A memory corruption issue was addressed with improved memory handling. This issue affected versions prior to iOS 12, macOS Mojave 10.14, tvOS 12, watchOS 5. |
CVE-2018-4424 | High | 7.8 | 2019-04-03 | A buffer overflow was addressed with improved size validation. This issue affected versions prior to macOS Mojave 10.14.1. |
CVE-2018-4423 | High | 7.8 | 2019-04-03 | A logic issue was addressed with improved validation. This issue affected versions prior to macOS Mojave 10.14.1. |
CVE-2018-4422 | High | 8.8 | 2019-04-03 | A memory corruption issue was addressed with improved memory handling. This issue affected versions prior to macOS Mojave 10.14.1. |
CVE-2018-4421 | High | 7.8 | 2019-04-03 | A memory initialization issue was addressed with improved memory handling. This issue affected versions prior to macOS Mojave 10.14.1. |
CVE-2018-4420 | High | 7.8 | 2019-04-03 | A memory corruption issue was addressed by removing the vulnerable code. This issue affected versions prior to iOS 12.1, macOS Mojave 10.14.1, tvOS 12.1, watch… |
CVE-2018-4419 | High | 7.8 | 2019-04-03 | A memory corruption issue was addressed with improved memory handling. This issue affected versions prior to iOS 12.1, macOS Mojave 10.14.1, tvOS 12.1, watchOS… |
CVE-2018-4418 | Medium | 5.5 | 2019-04-03 | A validation issue was addressed with improved input sanitization. This issue affected versions prior to macOS Mojave 10.14. |
CVE-2018-4417 | Medium | 5.5 | 2019-04-03 | A validation issue was addressed with improved input sanitization. This issue affected versions prior to macOS Mojave 10.14. |
CVE-2018-4416 | High | 8.8 | 2019-04-03 | Multiple memory corruption issues were addressed with improved memory handling. This issue affected versions prior to iOS 12.1, tvOS 12.1, watchOS 5.1, Safari… |
CVE-2018-4415 | High | 7.8 | 2019-04-03 | A memory corruption issue was addressed with improved memory handling. This issue affected versions prior to macOS Mojave 10.14.1. |
CVE-2018-4414 | High | 7.8 | 2019-04-03 | A memory corruption issue was addressed with improved input validation. This issue affected versions prior to iOS 12, macOS Mojave 10.14, tvOS 12, watchOS 5, i… |
CVE-2018-4413 | Medium | 5.5 | 2019-04-03 | A memory initialization issue was addressed with improved memory handling. This issue affected versions prior to iOS 12.1, macOS Mojave 10.14.1, tvOS 12.1, wat… |
CVE-2018-4412 | High | 7.8 | 2019-04-03 | A memory corruption issue was addressed with improved input validation. This issue affected versions prior to iOS 12, macOS Mojave 10.14, tvOS 12, watchOS 5, i… |
CVE-2018-4411 | High | 7.8 | 2019-04-03 | A memory corruption issue was addressed with improved input validation. This issue affected versions prior to macOS Mojave 10.14. |
CVE-2018-4410 | High | 7.8 | 2019-04-03 | A memory corruption issue was addressed with improved input validation. This issue affected versions prior to macOS Mojave 10.14.1. |
CVE-2018-4409 | Medium | 6.5 | 2019-04-03 | A resource exhaustion issue was addressed with improved input validation. This issue affected versions prior to iOS 12.1, tvOS 12.1, Safari 12.0.1, iTunes 12.9… |
CVE-2018-4408 | High | 7.8 | 2019-04-03 | A memory corruption issue was addressed with improved input validation This issue affected versions prior to iOS 12, macOS Mojave 10.14, tvOS 12, watchOS 5. |
CVE-2018-4407 | High | 8.8 | 2019-04-03 | A memory corruption issue was addressed with improved validation. This issue affected versions prior to iOS 12, macOS Mojave 10.14, tvOS 12, watchOS 5. |
CVE-2018-4406 | Medium | 6.5 | 2019-04-03 | A denial of service issue was addressed with improved validation. This issue affected versions prior to macOS Mojave 10.14. |
CVE-2018-4403 | Medium | 5.5 | 2019-04-03 | This issue was addressed by removing additional entitlements. This issue affected versions prior to macOS Mojave 10.14.1. |
CVE-2018-4402 | High | 7.8 | 2019-04-03 | A memory corruption issue was addressed with improved memory handling. This issue affected versions prior to macOS Mojave 10.14.1. |
CVE-2018-4401 | High | 7.8 | 2019-04-03 | A memory corruption issue was addressed with improved memory handling. This issue affected versions prior to iOS 12, macOS Mojave 10.14, tvOS 12, watchOS 5. |
CVE-2018-4400 | Medium | 5.5 | 2019-04-03 | A validation issue was addressed with improved logic. This issue affected versions prior to iOS 12.1, macOS Mojave 10.14.1, watchOS 5.1. |
CVE-2018-4399 | Medium | 5.5 | 2019-04-03 | An access issue existed with privileged API calls. This issue was addressed with additional restrictions. This issue affected versions prior to iOS 12, macOS M… |
CVE-2018-4398 | High | 7.5 | 2019-04-03 | An issue existed in the method for determining prime numbers. This issue was addressed by using pseudorandom bases for testing of primes. This issue affected v… |
CVE-2018-4397 | Medium | 4.3 | 2019-04-03 | Analytics data was sent using HTTP rather than HTTPS. This was addressed by sending analytics data using HTTPS. This issue affected versions prior to Apple Sup… |
CVE-2018-4396 | Medium | 5.5 | 2019-04-03 | A validation issue was addressed with improved input sanitization. This issue affected versions prior to macOS Mojave 10.14. |
CVE-2018-4395 | Medium | 5.5 | 2019-04-03 | This issue was addressed with improved checks. This issue affected versions prior to iOS 12, macOS Mojave 10.14, tvOS 12, watchOS 5. |