2018 CVEs (page 24)
Page 24 of 162 — CVEs published in 2018, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2018-4275 | High | 8.6 | 2019-04-03 | A memory corruption issue was addressed with improved memory handling. This issue affected versions prior to iOS 11.4.1. |
CVE-2018-4274 | High | 7.5 | 2019-04-03 | A spoofing issue existed in the handling of URLs. This issue was addressed with improved input validation. This issue affected versions prior to iOS 11.4.1, Sa… |
CVE-2018-4273 | Medium | 6.5 | 2019-04-03 | Multiple memory corruption issues were addressed with improved input validation. This issue affected versions prior to iOS 11.4.1, tvOS 11.4.1, watchOS 4.3.2… |
CVE-2018-4272 | High | 8.8 | 2019-04-03 | Multiple memory corruption issues were addressed with improved memory handling. This issue affected versions prior to iOS 11.4.1, tvOS 11.4.1, watchOS 4.3.2, S… |
CVE-2018-4271 | Medium | 6.5 | 2019-04-03 | Multiple memory corruption issues were addressed with improved input validation. This issue affected versions prior to iOS 11.4.1, tvOS 11.4.1, watchOS 4.3.2… |
CVE-2018-4270 | Medium | 6.5 | 2019-04-03 | A memory corruption issue was addressed with improved memory handling. This issue affected versions prior to iOS 11.4.1, tvOS 11.4.1, watchOS 4.3.2, Safari 11… |
CVE-2018-4269 | High | 8.6 | 2019-04-03 | A memory corruption issue was addressed with improved input validation. This issue affected versions prior to iOS 11.4.1, macOS High Sierra 10.13.6, tvOS 11.4… |
CVE-2018-4268 | Critical | 9.8 | 2019-04-03 | A memory corruption issue was addressed with improved memory handling. This issue affected versions prior to macOS High Sierra 10.13.6. |
CVE-2018-4267 | High | 8.8 | 2019-04-03 | Multiple memory corruption issues were addressed with improved memory handling. This issue affected versions prior to iOS 11.4.1, tvOS 11.4.1, Safari 11.1.2, i… |
CVE-2018-4266 | Medium | 5.9 | 2019-04-03 | A race condition was addressed with additional validation. This issue affected versions prior toiVersions prior to: OS 11.4.1, tvOS 11.4.1, watchOS 4.3.2, Safa… |
CVE-2018-4265 | High | 8.8 | 2019-04-03 | Multiple memory corruption issues were addressed with improved memory handling. This issue affected versions prior to iOS 11.4.1, tvOS 11.4.1, Safari 11.1.2, i… |
CVE-2018-4264 | High | 8.8 | 2019-04-03 | Multiple memory corruption issues were addressed with improved memory handling. This issue affected versions prior to iOS 11.4.1, tvOS 11.4.1, watchOS 4.3.2, S… |
CVE-2018-4263 | High | 8.8 | 2019-04-03 | Multiple memory corruption issues were addressed with improved memory handling. This issue affected versions prior to iOS 11.4.1, tvOS 11.4.1, Safari 11.1.2, i… |
CVE-2018-4261 | High | 8.8 | 2019-04-03 | Multiple memory corruption issues were addressed with improved memory handling. This issue affected versions prior to iOS 11.4.1, tvOS 11.4.1, Safari 11.1.2, i… |
CVE-2018-4260 | Medium | 6.5 | 2019-04-03 | An inconsistent user interface issue was addressed with improved state management. This issue affected versions prior to iOS 11.4.1, Safari 11.1.2. |
CVE-2018-4259 | Critical | 9.8 | 2019-04-03 | Multiple memory corruption issues were addressed with improved memory handling. This issue affected versions prior to macOS High Sierra 10.13.6. |
CVE-2018-4248 | High | 7.5 | 2019-04-03 | An out-of-bounds read was addressed with improved input validation. This issue affected versions prior to iOS 11.4.1, macOS High Sierra 10.13.6, tvOS 11.4.1, w… |
CVE-2018-4216 | Medium | 5.5 | 2019-04-03 | A logic issue existed in the handling of call URLs. This issue was addressed with improved state management. This issue affected versions prior to iOS 11.4.1. |
CVE-2018-4203 | High | 7.5 | 2019-04-03 | An out-of-bounds read was addressed with improved bounds checking. This issue affected versions prior to iOS 12, macOS Mojave 10.14, tvOS 12, watchOS 5. |
CVE-2018-4197 | High | 8.8 | 2019-04-03 | A use after free issue was addressed with improved memory management. This issue affected versions prior to iOS 12, tvOS 12, Safari 12, iTunes 12.9 for Windows… |
CVE-2018-4195 | Medium | 6.5 | 2019-04-03 | An inconsistent user interface issue was addressed with improved state management. This issue affected versions prior to Safari 12. |
CVE-2018-4191 | High | 8.8 | 2019-04-03 | A memory corruption issue was addressed with improved validation. This issue affected versions prior to iOS 12, tvOS 12, watchOS 5, Safari 12, iTunes 12.9 for… |
CVE-2018-4178 | Medium | 5.5 | 2019-04-03 | A permissions issue existed in which execute permission was incorrectly granted. This issue was addressed with improved permission validation. This issue affec… |
CVE-2018-4153 | Medium | 5.9 | 2019-04-03 | An injection issue was addressed with improved validation. This issue affected versions prior to macOS Mojave 10.14. |
CVE-2018-4145 | High | 8.8 | 2019-04-03 | Multiple memory corruption issues were addressed with improved memory handling. This issue affected versions prior to iOS 11.3, tvOS 11.3, watchOS 4.3, Safari… |
CVE-2018-4126 | High | 7.8 | 2019-04-03 | A memory corruption issue was addressed with improved memory handling. This issue affected versions prior to iOS 12, macOS Mojave 10.14, tvOS 12, watchOS 5, iT… |
CVE-2018-20506 | High | 8.1 | 2019-04-03 | SQLite before 3.25.3, when the FTS3 extension is enabled, encounters an integer overflow (and resultant buffer overflow) for FTS3 queries in a "merge" operatio… |
CVE-2018-20505 | High | 7.5 | 2019-04-03 | SQLite 3.25.2, when queries are run on a table with a malformed PRIMARY KEY, allows remote attackers to cause a denial of service (application crash) by levera… |
CVE-2018-1936 | High | 8.4 | 2019-04-03 | IBM DB2 9.7, 10.1, 10.5, and 11.1 libdb2e.so.1 is vulnerable to a stack based buffer overflow, caused by improper bounds checking which could allow an attacker… |
CVE-2018-1913 | Medium | 5.4 | 2019-04-03 | IBM DOORS Next Generation (DNG/RRC) 5.0 through 5.0.3 and 6.0 through 6.0.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arb… |
CVE-2018-1731 | Medium | 4.8 | 2019-04-03 | IBM DOORS Next Generation (DNG/RRC) 5.0 through 5.0.3 and 6.0 through 6.0.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arb… |
CVE-2018-18035 | Medium | 6.1 | 2019-04-02 | A vulnerability in flashcanvas.swf in OpenEMR before 5.0.1 Patch 6 could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) atta… |
CVE-2018-12680 | High | 7.5 | 2019-04-02 | The Serialize.deserialize() method in CoAPthon 3.1, 4.0.0, 4.0.1, and 4.0.2 mishandles certain exceptions, leading to a denial of service in applications that… |
CVE-2018-12679 | High | 7.5 | 2019-04-02 | The Serialize.deserialize() method in CoAPthon3 1.0 and 1.0.1 mishandles certain exceptions, leading to a denial of service in applications that use this libra… |
CVE-2018-19275 | Critical | 9.8 | 2019-04-02 | The BluStar component in Mitel InAttend before 2.5 SP3 and CMG before 8.4 SP3 Suite Servers has a default password, which could allow remote attackers to gain… |
CVE-2018-15180 | Medium | 6.1 | 2019-04-02 | qTest Portal in QASymphony qTest Manager 9.0.0 has an Open Redirect via the /portal/loginform redirect parameter. |
CVE-2018-4053 | Medium | 5.5 | 2019-04-02 | An exploitable local denial-of-service vulnerability exists in the privileged helper tool of GOG Galaxy's Games, version 1.2.47 for macOS. An attacker can send… |
CVE-2018-4052 | Medium | 5.5 | 2019-04-02 | An exploitable local information leak vulnerability exists in the privileged helper tool of GOG Galaxy's Games, version 1.2.47 for macOS. An attacker can pass… |
CVE-2018-4051 | Medium | 5.5 | 2019-04-02 | An exploitable local privilege escalation vulnerability exists in the privileged helper tool of GOG Galaxy's Games, version 1.2.47 for macOS. An attacker can g… |
CVE-2018-4049 | High | 7.8 | 2019-04-02 | An exploitable local privilege elevation vulnerability exists in the file system permissions of GOG Galaxy's “Games” directory, version 1.2.48.36 (Windows 64-b… |
CVE-2018-3974 | High | 7.8 | 2019-04-02 | An exploitable local privilege elevation vulnerability exists in the file system permissions of GOG Galaxy's install directory. An attacker can overwrite an ex… |
CVE-2018-1917 | Low | 3.5 | 2019-04-02 | IBM InfoSphere Information Server 11.3, 11.5, and 11.7 could allow an authenticated user to access JSP files and disclose sensitive information. IBM X-Force ID… |
CVE-2018-1906 | Medium | 4.3 | 2019-04-02 | IBM InfoSphere Information Server 11.3, 11.5, and 11.7could allow an authenticated user to download code using a specially crafted HTTP request. IBM X-Force ID… |
CVE-2018-1874 | Medium | 4.6 | 2019-04-02 | IBM API Connect 5.0.0.0 through 5.0.8.5 could display highly sensitive information to an attacker with physical access to the system. IBM X-Force ID: 151636. |
CVE-2018-1680 | Medium | 5.9 | 2019-04-02 | IBM Security Privileged Identity Manager Virtual Appliance 2.2.1 does not require that users should have strong passwords by default, which makes it easier for… |
CVE-2018-1640 | High | 8.8 | 2019-04-02 | IBM Security Privileged Identity Manager Virtual Appliance 2.2.1 could allow a remote authenticated attacker to execute arbitrary commands on the system. By se… |
CVE-2018-1626 | Low | 3.1 | 2019-04-02 | IBM Security Privileged Identity Manager Virtual Appliance 2.2.1 does not renew a session variable after a successful authentication which could lead to sessio… |
CVE-2018-1625 | Medium | 4.3 | 2019-04-02 | IBM Security Privileged Identity Manager Virtual Appliance 2.2.1 generates an error message that includes sensitive information about its environment, users, o… |
CVE-2018-1623 | Medium | 4.0 | 2019-04-02 | IBM Security Privileged Identity Manager Virtual Appliance 2.2.1 allows web pages to be stored locally which can be read by another user on the system. IBM X-F… |
CVE-2018-1622 | Medium | 4.3 | 2019-04-02 | IBM Security Privileged Identity Manager Virtual Appliance 2.2.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious… |
CVE-2018-1618 | High | 7.7 | 2019-04-02 | IBM Security Privileged Identity Manager Virtual Appliance 2.2.1 could allow a remote attacker to traverse directories on the system. An attacker could send a… |
CVE-2018-3979 | Medium | 6.5 | 2019-04-01 | A remote denial-of-service vulnerability exists in the way the Nouveau Display Driver (the default Ubuntu Nvidia display driver) handles GPU shader execution… |
CVE-2018-19113 | High | 7.3 | 2019-04-01 | The Pronestor PNHM (aka Health Monitoring or HealthMonitor) add-in before 8.1.13.0 for Outlook has "BUILTIN\Users:(I)(F)" permissions for the "%PROGRAMFILES(X8… |
CVE-2018-17990 | High | 8.8 | 2019-04-01 | An issue was discovered on D-Link DSL-3782 devices with firmware 1.01. An OS command injection vulnerability in Acl.asp allows a remote authenticated attacker… |
CVE-2018-17989 | Medium | 5.4 | 2019-04-01 | A stored XSS vulnerability exists in the web interface on D-Link DSL-3782 devices with firmware 1.01 that allows authenticated attackers to inject a JavaScript… |
CVE-2018-17565 | Critical | 9.8 | 2019-04-01 | Shell Metacharacter Injection in the SSH configuration interface on Grandstream GXP16xx VoIP 1.0.4.128 phones allows attackers to execute arbitrary system comm… |
CVE-2018-17564 | Critical | 9.8 | 2019-04-01 | A Malformed Input String to /cgi-bin/delete_CA on Grandstream GXP16xx VoIP 1.0.4.128 phones allows attackers to delete configuration parameters and gain admin… |
CVE-2018-17563 | Medium | 5.3 | 2019-04-01 | A Malformed Input String to /cgi-bin/api-get_line_status on Grandstream GXP16xx VoIP 1.0.4.128 phones allows attackers to dump the device's configuration in cl… |
CVE-2018-4050 | High | 7.8 | 2019-04-01 | An exploitable local privilege escalation vulnerability exists in the privileged helper tool of GOG Galaxy's Games, version 1.2.47 for macOS. An attacker can g… |
CVE-2018-5757 | High | 8.8 | 2019-04-01 | An issue was discovered on AudioCodes 450HD IP Phone devices with firmware 3.0.0.535.106. The traceroute and ping functionality, which uses a parameter in a re… |
CVE-2018-8913 | High | 7.1 | 2019-04-01 | Missing custom error page vulnerability in Synology Web Station before 2.1.3-0139 allows remote attackers to conduct phishing attacks via a crafted URL. |
CVE-2018-13299 | Medium | 4.3 | 2019-04-01 | Relative path traversal vulnerability in Attachment Uploader in Synology Calendar before 2.2.2-0532 allows remote authenticated users to upload arbitrary files… |
CVE-2018-13298 | Medium | 4.2 | 2019-04-01 | Channel accessible by non-endpoint vulnerability in privacy page in Synology Android Moments before 1.2.3-199 allows man-in-the-middle attackers to execute arb… |
CVE-2018-13297 | Medium | 5.3 | 2019-04-01 | Information exposure vulnerability in SYNO.SynologyDrive.Files in Synology Drive before 1.1.2-10562 allows remote attackers to obtain sensitive system informat… |
CVE-2018-13296 | High | 7.5 | 2019-04-01 | Uncontrolled resource consumption vulnerability in TLS configuration in Synology MailPlus Server before 2.0.5-0606 allows remote attackers to conduct denial-of… |
CVE-2018-13295 | Medium | 4.3 | 2019-04-01 | Information exposure vulnerability in SYNO.Personal.Application.Info in Synology Application Service before 1.5.4-0320 allows remote authenticated users to obt… |
CVE-2018-13294 | Medium | 4.3 | 2019-04-01 | Information exposure vulnerability in SYNO.Personal.Profile in Synology Application Service before 1.5.4-0320 allows remote authenticated users to obtain sensi… |
CVE-2018-13293 | Medium | 5.9 | 2019-04-01 | Cross-site scripting (XSS) vulnerability in Control Panel SSO Settings in Synology DiskStation Manager (DSM) before 6.2.1-23824 allows remote authenticated use… |
CVE-2018-13292 | Medium | 4.3 | 2019-04-01 | Information exposure vulnerability in /usr/syno/etc/mount.conf in Synology Router Manager (SRM) before 1.1.7-6941-2 allows remote authenticated users to obtain… |
CVE-2018-13291 | Medium | 4.3 | 2019-04-01 | Information exposure vulnerability in /usr/syno/etc/mount.conf in Synology DiskStation Manager (DSM) before 6.2.1-23824 allows remote authenticated users to ob… |
CVE-2018-13290 | Medium | 4.3 | 2019-04-01 | Information exposure vulnerability in SYNO.Core.ACL in Synology Router Manager (SRM) before 1.1.7-6941-2 allows remote authenticated users to determine the exi… |
CVE-2018-13289 | Medium | 5.3 | 2019-04-01 | Information exposure vulnerability in SYNO.FolderSharing.List in Synology Router Manager (SRM) before 1.1.7-6941-2 allows remote attackers to obtain sensitive… |
CVE-2018-13288 | Medium | 5.3 | 2019-04-01 | Information exposure vulnerability in SYNO.FolderSharing.List in Synology File Station before 1.2.3-0252 and before 1.1.5-0125 allows remote attackers to obtai… |
CVE-2018-13287 | Medium | 6.5 | 2019-04-01 | Incorrect default permissions vulnerability in synouser.conf in Synology Router Manager (SRM) before 1.1.7-6941-1 allows remote authenticated users to obtain s… |
CVE-2018-13286 | Medium | 6.5 | 2019-04-01 | Incorrect default permissions vulnerability in synouser.conf in Synology Diskstation Manager (DSM) before 6.2-23739-1 allows remote authenticated users to obta… |
CVE-2018-13285 | High | 7.5 | 2019-04-01 | Command injection vulnerability in ftpd in Synology Router Manager (SRM) before 1.1.7-6941-1 allows remote authenticated users to execute arbitrary OS commands… |
CVE-2018-13284 | High | 7.5 | 2019-04-01 | Command injection vulnerability in ftpd in Synology Diskstation Manager (DSM) before 6.2-23739-1 allows remote authenticated users to execute arbitrary OS comm… |
CVE-2018-13283 | High | 8.8 | 2019-04-01 | Lack of administrator control over security vulnerability in client.cgi in Synology SSL VPN Client before 1.2.5-0226 allows remote attackers to conduct man-in-… |
CVE-2018-18766 | Critical | 9.8 | 2019-03-29 | An elevation of privilege vulnerability exists in the Call Dispatcher in Provisio SiteKiosk before 9.7.4905. |
CVE-2018-19201 | Medium | 6.1 | 2019-03-29 | A reflected XSS vulnerability in the ModCP Profile Editor in MyBB before 1.8.20 allows remote attackers to inject JavaScript via the 'username' parameter. |
CVE-2018-15840 | High | 7.5 | 2019-03-29 | TP-Link TL-WR840N devices allow remote attackers to cause a denial of service (networking outage) via fragmented packets, as demonstrated by an "nmap -f" comma… |
CVE-2018-20378 | High | 7.5 | 2019-03-29 | The L2CAP signaling channel implementation and SDP server implementation in OpenSynergy Blue SDK 3.2 through 6.0 allow remote, unauthenticated attackers to exe… |
CVE-2018-19879 | High | 7.1 | 2019-03-28 | An issue was discovered in /cgi-bin/luci on Teltonika RTU9XX (e.g., RUT950) R_31.04.89 before R_00.05.00.5 devices. The authentication functionality is not pro… |
CVE-2018-16529 | Critical | 9.8 | 2019-03-28 | A password reset vulnerability has been discovered in Forcepoint Email Security 8.5.x. The password reset URL can be used after the intended expiration period… |
CVE-2018-6330 | High | 8.8 | 2019-03-28 | Laravel 5.4.15 is vulnerable to Error based SQL injection in save.php via dhx_user and dhx_version parameters. |
CVE-2018-20678 | High | 8.8 | 2019-03-28 | LibreNMS through 1.47 allows SQL injection via the html/ajax_table.php sort[hostname] parameter, exploitable by authenticated users during a search. |
CVE-2018-20144 | High | 7.5 | 2019-03-28 | GitLab Community and Enterprise Edition 11.x before 11.3.13, 11.4.x before 11.4.11, and 11.5.x before 11.5.4 has Incorrect Access Control. |
CVE-2018-19648 | High | 8.8 | 2019-03-27 | An issue was discovered in ADTRAN PMAA 1.6.2-1, 1.6.3, and 1.6.4. NETCONF Access Management (NACM) allows unprivileged users to create privileged users and exe… |
CVE-2018-3613 | High | 7.8 | 2019-03-27 | Logic issue in variable service module for EDK II/UDK2018/UDK2017/UDK2015 may allow an authenticated user to potentially enable escalation of privilege, inform… |
CVE-2018-15585 | Medium | 6.1 | 2019-03-27 | Cross-Site Scripting (XSS) vulnerability in newwinform.php in GNUBOARD5 before 5.3.1.6 allows remote attackers to inject arbitrary web script or HTML via the p… |
CVE-2018-14814 | Medium | 6.5 | 2019-03-27 | WECON Technology PI Studio HMI versions 4.1.9 and prior and PI Studio versions 4.2.34 and prior lacks proper validation of user-supplied data, which may result… |
CVE-2018-12545 | High | 7.5 | 2019-03-27 | In Eclipse Jetty version 9.3.x and 9.4.x, the server is vulnerable to Denial of Service conditions if a remote client sends either large SETTINGs frames contai… |
CVE-2018-12183 | Medium | 6.8 | 2019-03-27 | Stack overflow in DxeCore for EDK II may allow an unauthenticated user to potentially enable escalation of privilege, information disclosure and/or denial of s… |
CVE-2018-12182 | Medium | 6.7 | 2019-03-27 | Insufficient memory write check in SMM service for EDK II may allow an authenticated user to potentially enable escalation of privilege, information disclosure… |
CVE-2018-12181 | Medium | 6.0 | 2019-03-27 | Stack overflow in corrupted bmp for EDK II may allow unprivileged user to potentially enable denial of service or elevation of privilege via local access. |
CVE-2018-12180 | High | 8.8 | 2019-03-27 | Buffer overflow in BlockIo service for EDK II may allow an unauthenticated user to potentially enable escalation of privilege, information disclosure and/or de… |
CVE-2018-12179 | High | 7.8 | 2019-03-27 | Improper configuration in system firmware for EDK II may allow unauthenticated user to potentially enable escalation of privilege, information disclosure and/o… |
CVE-2018-12178 | Critical | 9.1 | 2019-03-27 | Buffer overflow in network stack for EDK II may allow unprivileged user to potentially enable escalation of privilege and/or denial of service via network. |
CVE-2018-19644 | Medium | 5.0 | 2019-03-27 | Reflected cross site script issue in Micro Focus Solutions Business Manager (SBM) (formerly Serena Business Manager (SBM)) versions prior to 11.5. |
CVE-2018-19643 | Medium | 4.7 | 2019-03-27 | Information leakage issue in Micro Focus Solutions Business Manager (SBM) (formerly Serena Business Manager (SBM)) versions prior to 11.5. |