2018 CVEs (page 25)
Page 25 of 162 — CVEs published in 2018, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2018-19016 | High | 7.5 | 2019-03-27 | Rockwell Automation EtherNet/IP Web Server Modules 1756-EWEB (includes 1756-EWEBK) Version 5.001 and earlier, and CompactLogix 1768-EWEB Version 2.005 and earl… |
CVE-2018-18994 | High | 7.1 | 2019-03-27 | LCDS Laquis SCADA prior to version 4.1.0.4150 allows an out of bounds read when opening a specially crafted project file, which may cause a system crash or all… |
CVE-2018-12551 | High | 8.1 | 2019-03-27 | When Eclipse Mosquitto version 1.0 to 1.5.5 (inclusive) is configured to use a password file for authentication, any malformed data in the password file will b… |
CVE-2018-12550 | High | 8.1 | 2019-03-27 | When Eclipse Mosquitto version 1.0 to 1.5.5 (inclusive) is configured to use an ACL file, and that ACL file is empty, or contains only comments or blank lines… |
CVE-2018-12546 | Medium | 6.5 | 2019-03-27 | In Eclipse Mosquitto version 1.0 to 1.5.5 (inclusive) when a client publishes a retained message to a topic, then has its access to that topic revoked, the ret… |
CVE-2018-19642 | Medium | 5.1 | 2019-03-27 | Denial of service issue in Micro Focus Solutions Business Manager (SBM) (formerly Serena Business Manager (SBM)) versions prior to 11.5. |
CVE-2018-19641 | Medium | 6.1 | 2019-03-27 | Unauthenticated remote code execution issue in Micro Focus Solutions Business Manager (SBM) (formerly Serena Business Manager (SBM)) versions prior to 11.5. |
CVE-2018-19466 | Critical | 9.8 | 2019-03-27 | A vulnerability was found in Portainer before 1.20.0. Portainer stores LDAP credentials, corresponding to a master password, in cleartext and allows their retr… |
CVE-2018-5927 | High | 7.3 | 2019-03-27 | HP Support Assistant before 8.7.50.3 allows an unauthorized person with local access to load arbitrary code. |
CVE-2018-5926 | Critical | 9.1 | 2019-03-27 | A potential vulnerability has been identified in HP Remote Graphics Software’s certificate authentication process version 7.5.0 and earlier. |
CVE-2018-5923 | Critical | 9.8 | 2019-03-27 | In HP LaserJet Enterprise, HP PageWide Enterprise, HP LaserJet Managed, and HP OfficeJet Enterprise Printers, solution application signature checking may allow… |
CVE-2018-16207 | Medium | 6.5 | 2019-03-27 | PowerAct Pro Master Agent for Windows Version 5.13 and earlier allows authenticated attackers to bypass access restriction to alter or edit unauthorized files… |
CVE-2018-10934 | Medium | 5.4 | 2019-03-27 | A cross-site scripting (XSS) vulnerability was found in the JBoss Management Console versions before 7.1.6.CR1, 7.1.6.GA. Users with roles that can create obje… |
CVE-2018-15817 | Medium | 5.5 | 2019-03-26 | FastStone Image Viewer 6.5 has a Read Access Violation on Block Data Move starting at image00400000+0x0000000000002d63 via a crafted image file. |
CVE-2018-15816 | Medium | 5.5 | 2019-03-26 | FastStone Image Viewer 6.5 has a Read Access Violation on Block Data Move starting at image00400000+0x0000000000002d7d via a crafted image file. |
CVE-2018-15815 | Medium | 5.5 | 2019-03-26 | FastStone Image Viewer 6.5 has an Exception Handler Chain Corrupted issue starting at image00400000+0x00000000003ef68a via a crafted image file. |
CVE-2018-15814 | Medium | 5.5 | 2019-03-26 | FastStone Image Viewer 6.5 has a User Mode Write AV starting at image00400000+0x00000000001cb509 via a crafted image file. |
CVE-2018-15813 | Medium | 5.5 | 2019-03-26 | FastStone Image Viewer 6.5 has a User Mode Write AV starting at image00400000+0x00000000000e1237 via a crafted image file. |
CVE-2018-16856 | Medium | 5.5 | 2019-03-26 | In a default Red Hat Openstack Platform Director installation, openstack-octavia before versions openstack-octavia 2.0.2-5 and openstack-octavia-3.0.1-0.201810… |
CVE-2018-19856 | High | 7.5 | 2019-03-26 | GitLab CE/EE before 11.3.12, 11.4.x before 11.4.10, and 11.5.x before 11.5.3 allows Directory Traversal in Templates API. |
CVE-2018-15583 | Medium | 6.1 | 2019-03-25 | Cross-Site Scripting (XSS) vulnerability in point_list.php in GNUBOARD5 before 5.3.1.6 allows remote attackers to inject arbitrary web script or HTML via the p… |
CVE-2018-12653 | Medium | 6.1 | 2019-03-25 | A Reflected Cross Site Scripting (XSS) vulnerability exists in Adrenalin HRMS 5.4.0. An attacker can input malicious JavaScript code in /RPT/SSRSDynamicEditRep… |
CVE-2018-12652 | Medium | 6.1 | 2019-03-25 | A Reflected Cross Site Scripting (XSS) Vulnerability was discovered in Adrenalin 5.4 HRMS Software. The user supplied input containing JavaScript is echoed bac… |
CVE-2018-16858 | High | 7.8 | 2019-03-25 | It was found that libreoffice before versions 6.0.7 and 6.1.3 was vulnerable to a directory traversal attack which could be used to execute arbitrary macros bu… |
CVE-2018-16838 | Medium | 5.4 | 2019-03-25 | A flaw was found in sssd Group Policy Objects implementation. When the GPO is not readable by SSSD due to a too strict permission settings on the server side… |
CVE-2018-20165 | Medium | 6.1 | 2019-03-22 | Cross-site scripting (XSS) vulnerability in OpenText Portal 7.4.4 allows remote attackers to inject arbitrary web script or HTML via the vgnextoid parameter to… |
CVE-2018-18913 | High | 7.8 | 2019-03-21 | Opera before 57.0.3098.106 is vulnerable to a DLL Search Order hijacking attack where an attacker can send a ZIP archive composed of an HTML page along with a… |
CVE-2018-20034 | High | 7.5 | 2019-03-21 | A Denial of Service vulnerability related to adding an item to a list in lmgrd and vendor daemon components of FlexNet Publisher version 11.16.1.0 and earlier… |
CVE-2018-20032 | High | 7.5 | 2019-03-21 | A Denial of Service vulnerability related to message decoding in lmgrd and vendor daemon components of FlexNet Publisher version 11.16.1.0 and earlier allows a… |
CVE-2018-20031 | High | 7.5 | 2019-03-21 | A Denial of Service vulnerability related to preemptive item deletion in lmgrd and vendor daemon components of FlexNet Publisher version 11.16.1.0 and earlier… |
CVE-2018-13798 | High | 7.5 | 2019-03-21 | A vulnerability has been identified in SICAM A8000 CP-8000 (All versions < V14), SICAM A8000 CP-802X (All versions < V14), SICAM A8000 CP-8050 (All versions <… |
CVE-2018-3968 | High | 7.0 | 2019-03-21 | An exploitable vulnerability exists in the verified boot protection of the Das U-Boot from version 2013.07-rc1 to 2014.07-rc2. The affected versions lack prope… |
CVE-2018-4030 | High | 7.5 | 2019-03-21 | An exploitable vulnerability exists the safe browsing function of the CUJO Smart Firewall, version 7003. The bug lies in the way the safe browsing function par… |
CVE-2018-4011 | High | 7.5 | 2019-03-21 | An exploitable integer underflow vulnerability exists in the mdnscap binary of the CUJO Smart Firewall, version 7003. When parsing SRV records in an mDNS packe… |
CVE-2018-4003 | Critical | 9.8 | 2019-03-21 | An exploitable heap overflow vulnerability exists in the mdnscap binary of the CUJO Smart Firewall running firmware 7003. The string lengths are handled incorr… |
CVE-2018-3985 | Critical | 9.8 | 2019-03-21 | An exploitable double free vulnerability exists in the mdnscap binary of the CUJO Smart Firewall. When parsing mDNS packets, a memory space is freed twice if a… |
CVE-2018-3969 | High | 7.8 | 2019-03-21 | An exploitable vulnerability exists in the verified boot protection of the CUJO Smart Firewall. It is possible to add arbitrary shell commands into the dhcpd.c… |
CVE-2018-3963 | High | 8.0 | 2019-03-21 | An exploitable command injection vulnerability exists in the DHCP daemon configuration of the CUJO Smart Firewall. When adding a new static DHCP address, its c… |
CVE-2018-6517 | High | 7.5 | 2019-03-21 | Prior to version 0.3.0, chloride's use of net-ssh resulted in host fingerprints for previously unknown hosts getting added to the user's known_hosts file witho… |
CVE-2018-4059 | Critical | 9.8 | 2019-03-21 | An exploitable unsafe default configuration vulnerability exists in the TURN server function of coTURN prior to version 4.5.0.9. By default, the TURN server ru… |
CVE-2018-4058 | High | 7.7 | 2019-03-21 | An exploitable unsafe default configuration vulnerability exists in the TURN server functionality of coTURN prior to 4.5.0.9. By default, the TURN server allow… |
CVE-2018-20737 | Medium | 5.4 | 2019-03-21 | An issue was discovered in WSO2 API Manager 2.1.0 and 2.6.0. Reflected XSS exists in the carbon part of the product. |
CVE-2018-20736 | Medium | 5.4 | 2019-03-21 | An issue was discovered in WSO2 API Manager 2.1.0 and 2.6.0. A DOM-based XSS exists in the store part of the product. |
CVE-2018-20669 | High | 7.8 | 2019-03-21 | An issue where a provided address with access_ok() is not checked was discovered in i915_gem_execbuffer2_ioctl in drivers/gpu/drm/i915/i915_gem_execbuffer.c in… |
CVE-2018-20648 | High | 8.8 | 2019-03-21 | PHP Scripts Mall Car Rental Script 2.0.8 has Cross-Site Request Forgery (CSRF) via accountedit.php. |
CVE-2018-20647 | Medium | 6.5 | 2019-03-21 | PHP Scripts Mall Car Rental Script 2.0.8 has directory traversal via a direct request for a listing of an image directory such as an images/ directory. |
CVE-2018-20646 | Medium | 6.5 | 2019-03-21 | PHP Scripts Mall Basic B2B Script 2.0.9 has has directory traversal via a direct request for a listing of an image directory such as an uploads/ directory. |
CVE-2018-20645 | Medium | 5.4 | 2019-03-21 | PHP Scripts Mall Basic B2B Script 2.0.9 has HTML injection via the First Name or Last Name field. |
CVE-2018-20644 | High | 8.8 | 2019-03-21 | PHP Scripts Mall Basic B2B Script 2.0.9 has Cross-Site Request Forgery (CSRF) via the Edit profile feature. |
CVE-2018-20643 | Medium | 6.5 | 2019-03-21 | PHP Scripts Mall Entrepreneur Job Portal Script 3.0.1 has directory traversal via a direct request for a listing of an image directory such as an assets/ direc… |
CVE-2018-20642 | Medium | 6.5 | 2019-03-21 | PHP Scripts Mall Entrepreneur Job Portal Script 3.0.1 allows remote attackers to cause a denial of service (outage of profile editing) via crafted JavaScript c… |
CVE-2018-20641 | High | 8.8 | 2019-03-21 | PHP Scripts Mall Entrepreneur Job Portal Script 3.0.1 has Cross-Site Request Forgery (CSRF) via the Edit Profile feature. |
CVE-2018-20640 | Medium | 5.4 | 2019-03-21 | PHP Scripts Mall Entrepreneur Job Portal Script 3.0.1 has stored Cross-Site Scripting (XSS) via the Full Name field. |
CVE-2018-20639 | Medium | 6.1 | 2019-03-21 | PHP Scripts Mall Entrepreneur Job Portal Script 3.0.1 has HTML injection via the Search Bar. |
CVE-2018-20638 | Medium | 6.5 | 2019-03-21 | PHP Scripts Mall Chartered Accountant : Auditor Website 2.0.1 has directory traversal via a direct request for a listing of an image directory such as an asset… |
CVE-2018-20637 | Medium | 6.5 | 2019-03-21 | PHP Scripts Mall Chartered Accountant : Auditor Website 2.0.1 allows remote attackers to cause a denial of service (unrecoverable blank profile) via crafted Ja… |
CVE-2018-20636 | Medium | 5.4 | 2019-03-21 | PHP Scripts Mall Chartered Accountant : Auditor Website 2.0.1 has HTML injection via the First Name field. |
CVE-2018-20635 | Medium | 4.3 | 2019-03-21 | PHP Scripts Mall Advance B2B Script 2.1.4 has directory traversal via a direct request for a listing of an image directory such as an assets/ directory. |
CVE-2018-20634 | Medium | 6.5 | 2019-03-21 | PHP Scripts Mall Advance B2B Script 2.1.4 allows remote attackers to cause a denial of service (changed Page structure) via JavaScript code in the First Name f… |
CVE-2018-20633 | High | 8.8 | 2019-03-21 | PHP Scripts Mall Advance B2B Script 2.1.4 has Cross-Site Request Forgery (CSRF) via the Edit Profile feature. |
CVE-2018-20632 | Medium | 5.4 | 2019-03-21 | PHP Scripts Mall Advance B2B Script 2.1.4 has stored Cross-Site Scripting (XSS) via the FIRST NAME or LAST NAME field. |
CVE-2018-20631 | Medium | 5.3 | 2019-03-21 | PHP Scripts Mall Website Seller Script 2.0.5 allows full Path Disclosure via a request for an arbitrary image URL such as a .png file. |
CVE-2018-20630 | Medium | 5.3 | 2019-03-21 | PHP Scripts Mall Advance Crowdfunding Script 2.0.3 has directory traversal via a direct request for a listing of an uploads directory such as the wp-content/up… |
CVE-2018-20629 | Medium | 5.3 | 2019-03-21 | PHP Scripts Mall Charity Donation Script readymadeb2bscript has directory traversal via a direct request for a listing of an uploads directory such as the wp-c… |
CVE-2018-20628 | High | 7.5 | 2019-03-21 | PHP Scripts Mall Charity Foundation Script 1 through 3 allows directory traversal via a direct request for a listing of an uploads directory such as the wp-con… |
CVE-2018-20627 | Medium | 5.4 | 2019-03-21 | PHP Scripts Mall Consumer Reviews Script 4.0.3 has HTML injection via the search box. |
CVE-2018-20626 | Medium | 6.5 | 2019-03-21 | PHP Scripts Mall Consumer Reviews Script 4.0.3 has directory traversal via a direct request for a listing of an uploads directory such as the wp-content/upload… |
CVE-2018-20615 | High | 7.5 | 2019-03-21 | An out-of-bounds read issue was discovered in the HTTP/2 protocol decoder in HAProxy 1.8.x and 1.9.x through 1.9.0 which can result in a crash. The processing… |
CVE-2018-20556 | High | 8.8 | 2019-03-21 | SQL injection vulnerability in Booking Calendar plugin 8.4.3 for WordPress allows remote attackers to execute arbitrary SQL commands via the booking_id paramet… |
CVE-2018-20555 | Critical | 9.8 | 2019-03-21 | The Design Chemical Social Network Tabs plugin 1.7.1 for WordPress allows remote attackers to discover Twitter access_token, access_token_secret, consumer_key… |
CVE-2018-20526 | Critical | 9.8 | 2019-03-21 | Roxy Fileman 1.4.5 allows unrestricted file upload in upload.php. |
CVE-2018-20525 | Critical | 9.1 | 2019-03-21 | Roxy Fileman 1.4.5 allows Directory Traversal in copydir.php, copyfile.php, and fileslist.php. |
CVE-2018-20340 | Medium | 6.8 | 2019-03-21 | Yubico libu2f-host 1.1.6 contains unchecked buffers in devs.c, which could enable a malicious token to exploit a buffer overflow. An attacker could use this to… |
CVE-2018-20323 | High | 8.8 | 2019-03-21 | www/soap/application/MCSoap/Logs.php in MailCleaner Community Edition 2018.08 allows remote attackers to execute arbitrary OS commands. |
CVE-2018-20221 | High | 8.8 | 2019-03-21 | Secure/SAService.rem in Deltek Ajera Timesheets 9.10.16 and prior are vulnerable to remote code execution via deserialization of untrusted user input from an a… |
CVE-2018-20220 | High | 7.5 | 2019-03-21 | An issue was discovered on Teracue ENC-400 devices with firmware 2.56 and below. While the web interface requires authentication before it can be interacted wi… |
CVE-2018-20219 | High | 8.1 | 2019-03-21 | An issue was discovered on Teracue ENC-400 devices with firmware 2.56 and below. After successful authentication, the device sends an authentication cookie to… |
CVE-2018-20218 | Critical | 9.8 | 2019-03-21 | An issue was discovered on Teracue ENC-400 devices with firmware 2.56 and below. The login form passes user input directly to a shell command without any kind… |
CVE-2018-20212 | Medium | 6.1 | 2019-03-21 | bin/statistics in TWiki 6.0.2 allows cross-site scripting (XSS) via the webs parameter. |
CVE-2018-20162 | Critical | 9.9 | 2019-03-21 | Digi TransPort LR54 4.4.0.26 and possible earlier devices have Improper Input Validation that allows users with 'super' CLI access privileges to bypass a restr… |
CVE-2018-20141 | Medium | 6.1 | 2019-03-21 | AbanteCart 1.2.12 has reflected cross-site scripting (XSS) via the sort parameter, as demonstrated by a /apparel--accessories?sort= substring. |
CVE-2018-20140 | Medium | 6.1 | 2019-03-21 | Zenphoto 1.4.14 has multiple cross-site scripting (XSS) vulnerabilities via different URL parameters. |
CVE-2018-20121 | Medium | 6.1 | 2019-03-21 | Podcast Generator 2.7 has stored cross-site scripting (XSS) via the URL addcategory parameter. |
CVE-2018-19985 | Medium | 4.6 | 2019-03-21 | The function hso_get_config_data in drivers/net/usb/hso.c in the Linux kernel through 4.19.8 reads if_num from the USB device (as a u8) and uses it to index a… |
CVE-2018-19934 | Medium | 4.8 | 2019-03-21 | SolarWinds Serv-U FTP Server 15.1.6.25 has reflected cross-site scripting (XSS) in the Web management interface via URL path and HTTP POST parameter. |
CVE-2018-1992 | Medium | 6.4 | 2019-03-21 | The IBM Power 9 OP910, OP920, and FW910 boot firmware's bootloader is responsible for loading and validating the initial boot firmware image that drives the re… |
CVE-2018-19917 | Medium | 6.1 | 2019-03-21 | Microweber 1.0.8 has reflected cross-site scripting (XSS) vulnerabilities. |
CVE-2018-19872 | Medium | 5.5 | 2019-03-21 | An issue was discovered in Qt 5.11. A malformed PPM image causes a division by zero and a crash in qppmhandler.cpp. |
CVE-2018-19783 | Critical | 9.8 | 2019-03-21 | Kentix MultiSensor-LAN 5.63.00 devices and previous allow Authentication Bypass via an Alternate Path or Channel. |
CVE-2018-19694 | Medium | 6.1 | 2019-03-21 | HMS Industrial Networks Netbiter WS100 3.30.5 devices and previous have reflected XSS in the login form. |
CVE-2018-19525 | Medium | 6.1 | 2019-03-21 | An issue was discovered on Systrome ISG-600C, ISG-600H, and ISG-800W 1.1-R2.1_TRUNK-20180914.bin devices. There is CSRF via /ui/?g=obj_keywords_add and /ui/?g=… |
CVE-2018-19524 | Critical | 9.8 | 2019-03-21 | An issue was discovered on Shenzhen Skyworth DT741 Converged Intelligent Terminal (G/EPON+IPTV) SDOTBGN1, DT721-cb SDOTBGN1, and DT741-cb SDOTBGN1 devices. A l… |
CVE-2018-19515 | Critical | 9.8 | 2019-03-21 | In Webgalamb through 7.0, system/ajax.php functionality is supposed to be available only to the administrator. However, by using one of the bgsend, atment_sddd… |
CVE-2018-19514 | Critical | 9.8 | 2019-03-21 | In Webgalamb through 7.0, an arbitrary code execution vulnerability could be exploited remotely without authentication. Exploitation requires authentication by… |
CVE-2018-19513 | High | 7.5 | 2019-03-21 | In Webgalamb through 7.0, log files are exposed to the internet with predictable files/logs/sql_error_log/YYYY-MM-DD-sql_error_log.log filenames. The log file… |
CVE-2018-19512 | High | 7.2 | 2019-03-21 | In Webgalamb through 7.0, a system/ajax.php "wgmfile restore" directory traversal vulnerability could lead to arbitrary code execution by authenticated adminis… |
CVE-2018-19511 | Medium | 6.5 | 2019-03-21 | wg7.php in Webgalamb 7.0 lacks security measures to prevent CSRF attacks, as demonstrated by wg7.php?options=1 to change the administrator password. |
CVE-2018-19510 | Critical | 9.8 | 2019-03-21 | subscriber.php in Webgalamb through 7.0 is vulnerable to SQL injection via the Client-IP HTTP request header. |
CVE-2018-19509 | Medium | 6.1 | 2019-03-21 | wg7.php in Webgalamb 7.0 makes opportunistic calls to htmlspecialchars() instead of using a templating engine with proper contextual encoding. Because it is po… |
CVE-2018-19498 | Medium | 6.1 | 2019-03-21 | The Simplenia Pages plugin 2.6.0 for Atlassian Bitbucket Server has XSS. |