2018 CVEs (page 34)
Page 34 of 162 — CVEs published in 2018, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2018-4277 | High | 7.5 | 2019-01-11 | In iOS before 11.4.1, watchOS before 4.3.2, tvOS before 11.4.1, Safari before 11.1.1, macOS High Sierra before 10.13.6, a spoofing issue existed in the handlin… |
CVE-2018-4262 | High | 8.8 | 2019-01-11 | In Safari before 11.1.2, iTunes before 12.8 for Windows, iOS before 11.4.1, tvOS before 11.4.1, iCloud for Windows before 7.6, multiple memory corruption issue… |
CVE-2018-4258 | Critical | 9.8 | 2019-01-11 | In macOS High Sierra before 10.13.5, a buffer overflow was addressed with improved bounds checking. |
CVE-2018-4257 | Critical | 9.8 | 2019-01-11 | In macOS High Sierra before 10.13.5, a buffer overflow was addressed with improved size validation. |
CVE-2018-4256 | Medium | 5.5 | 2019-01-11 | In macOS High Sierra before 10.13.5, an out-of-bounds read was addressed with improved input validation. |
CVE-2018-4255 | Medium | 5.5 | 2019-01-11 | In macOS High Sierra before 10.13.5, an out-of-bounds read was addressed with improved input validation. |
CVE-2018-4254 | Critical | 9.8 | 2019-01-11 | In macOS High Sierra before 10.13.5, an input validation issue existed in the kernel. This issue was addressed with improved input validation. |
CVE-2018-4217 | High | 7.5 | 2019-01-11 | In macOS High Sierra before 10.13.5, a privacy issue in the handling of Open Directory records was addressed with improved indexing. |
CVE-2018-4213 | High | 8.8 | 2019-01-11 | In iOS before 11.3, Safari before 11.1, iCloud for Windows before 7.4, tvOS before 11.3, watchOS before 4.3, iTunes before 12.7.4 for Windows, unexpected inter… |
CVE-2018-4212 | High | 8.8 | 2019-01-11 | In iOS before 11.3, Safari before 11.1, iCloud for Windows before 7.4, tvOS before 11.3, watchOS before 4.3, iTunes before 12.7.4 for Windows, unexpected inter… |
CVE-2018-4210 | High | 8.8 | 2019-01-11 | In iOS before 11.3, Safari before 11.1, tvOS before 11.3, watchOS before 4.3, iTunes before 12.7.4 for Windows, an array indexing issue existed in the handling… |
CVE-2018-4209 | High | 8.8 | 2019-01-11 | In iOS before 11.3, Safari before 11.1, iCloud for Windows before 7.4, tvOS before 11.3, watchOS before 4.3, iTunes before 12.7.4 for Windows, unexpected inter… |
CVE-2018-4208 | High | 8.8 | 2019-01-11 | In iOS before 11.3, Safari before 11.1, iCloud for Windows before 7.4, tvOS before 11.3, watchOS before 4.3, iTunes before 12.7.4 for Windows, unexpected inter… |
CVE-2018-4207 | High | 8.8 | 2019-01-11 | In iOS before 11.3, Safari before 11.1, iCloud for Windows before 7.4, tvOS before 11.3, watchOS before 4.3, iTunes before 12.7.4 for Windows, unexpected inter… |
CVE-2018-4194 | High | 8.8 | 2019-01-11 | In iOS before 11.4, iCloud for Windows before 7.5, watchOS before 4.3.1, iTunes before 12.7.5 for Windows, and macOS High Sierra before 10.13.5, an out-of-boun… |
CVE-2018-4189 | Critical | 9.8 | 2019-01-11 | In iOS before 11.2.5, macOS High Sierra before 10.13.3, Security Update 2018-001 Sierra, and Security Update 2018-001 El Capitan, watchOS before 4.2.2, and tvO… |
CVE-2018-4186 | High | 7.5 | 2019-01-11 | In Safari before 11.1, an information leakage issue existed in the handling of downloads in Safari Private Browsing. This issue was addressed with additional v… |
CVE-2018-4185 | High | 7.5 | 2019-01-11 | In iOS before 11.3, tvOS before 11.3, watchOS before 4.3, and macOS before High Sierra 10.13.4, an information disclosure issue existed in the transition of pr… |
CVE-2018-4183 | High | 8.2 | 2019-01-11 | In macOS High Sierra before 10.13.5, an access issue was addressed with additional sandbox restrictions. |
CVE-2018-4182 | High | 8.2 | 2019-01-11 | In macOS High Sierra before 10.13.5, an access issue was addressed with additional sandbox restrictions on CUPS. |
CVE-2018-4181 | Medium | 5.5 | 2019-01-11 | In macOS High Sierra before 10.13.5, an issue existed in CUPS. This issue was addressed with improved access restrictions. |
CVE-2018-4180 | High | 7.8 | 2019-01-11 | In macOS High Sierra before 10.13.5, an issue existed in CUPS. This issue was addressed with improved access restrictions. |
CVE-2018-4179 | Medium | 5.5 | 2019-01-11 | In macOS High Sierra before 10.13.4, there was an issue with the handling of smartcard PINs. This issue was addressed with additional logic. |
CVE-2018-4169 | Critical | 9.8 | 2019-01-11 | In macOS High Sierra before 10.13.3, Security Update 2018-001 Sierra, and Security Update 2018-001 El Capitan, an out-of-bounds read was addressed with improve… |
CVE-2018-4147 | Critical | 9.8 | 2019-01-11 | In iCloud for Windows before 7.3, Safari before 11.0.3, iTunes before 12.7.3 for Windows, and iOS before 11.2.5, multiple memory corruption issues exist and we… |
CVE-2018-15467 | Medium | 6.1 | 2019-01-11 | A vulnerability in the web-based management interface of Cisco TelePresence Management Suite (TMS) could allow an unauthenticated, remote attacker to conduct a… |
CVE-2018-15466 | Medium | 5.3 | 2019-01-11 | A vulnerability in the Graphite web interface of the Policy and Charging Rules Function (PCRF) of Cisco Policy Suite (CPS) could allow an unauthenticated, remo… |
CVE-2018-15464 | Medium | 5.8 | 2019-01-11 | A vulnerability in Cisco 900 Series Aggregation Services Router (ASR) software could allow an unauthenticated, remote attacker to cause a partial denial of ser… |
CVE-2018-15461 | Medium | 6.1 | 2019-01-10 | A vulnerability in the MyWebex component of Cisco Webex Business Suite could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS)… |
CVE-2018-5413 | High | 8.8 | 2019-01-10 | Imperva SecureSphere running v13.0, v12.0, or v11.5 allows low privileged users to add SSH login keys to the admin user, resulting in privilege escalation. |
CVE-2018-5412 | High | 7.8 | 2019-01-10 | Imperva SecureSphere running v12.0.0.50 is vulnerable to local arbitrary code execution, escaping sealed-mode. |
CVE-2018-5403 | High | 8.1 | 2019-01-10 | Imperva SecureSphere gateway (GW) running v13, for both pre-First Time Login or post-First Time Login (FTL), if the attacker knows the basic authentication pas… |
CVE-2018-15460 | High | 8.6 | 2019-01-10 | A vulnerability in the email message filtering feature of Cisco AsyncOS Software for Cisco Email Security Appliances (ESA) could allow an unauthenticated, remo… |
CVE-2018-20685 | Medium | 5.3 | 2019-01-10 | In OpenSSH 7.9, scp.c in the scp client allows remote SSH servers to bypass intended access restrictions via the filename of . or an empty filename. The impact… |
CVE-2018-20684 | High | 7.5 | 2019-01-10 | In WinSCP before 5.14 beta, due to missing validation, the scp implementation would accept arbitrary files sent by the server, potentially overwriting unrelate… |
CVE-2018-3703 | High | 7.8 | 2019-01-10 | Improper directory permissions in the installer for the Intel(R) SSD Data Center Tool for Windows before v3.0.17 may allow authenticated users to potentially e… |
CVE-2018-18098 | High | 7.3 | 2019-01-10 | Improper file verification in install routine for Intel(R) SGX SDK and Platform Software for Windows before 2.2.100 may allow an escalation of privilege via lo… |
CVE-2018-12177 | High | 7.8 | 2019-01-10 | Improper directory permissions in the ZeroConfig service in Intel(R) PROSet/Wireless WiFi Software before version 20.90.0.7 may allow an authorized user to pot… |
CVE-2018-12167 | Medium | 4.4 | 2019-01-10 | Firmware update routine in bootloader for Intel(R) Optane(TM) SSD DC P4800X before version E2010435 may allow a privileged user to potentially enable a denial… |
CVE-2018-12166 | Medium | 4.4 | 2019-01-10 | Insufficient write protection in firmware for Intel(R) Optane(TM) SSD DC P4800X before version E2010435 may allow a privileged user to potentially enable a den… |
CVE-2018-15458 | Medium | 5.3 | 2019-01-10 | A vulnerability in the Shell Access Filter feature of Cisco Firepower Management Center (FMC), when used in conjunction with remote authentication, could allow… |
CVE-2018-15457 | Medium | 6.1 | 2019-01-10 | A vulnerability in the web-based management interface of Cisco Prime Infrastructure could allow an unauthenticated, remote attacker to conduct a cross-site scr… |
CVE-2018-16803 | Critical | 9.8 | 2019-01-10 | In CIMTechniques CIMScan 6.x through 6.2, the SOAP WSDL parser allows attackers to execute SQL code. |
CVE-2018-15456 | Medium | 4.3 | 2019-01-10 | A vulnerability in the Admin Portal of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to view saved passwords in plain text… |
CVE-2018-15453 | High | 8.6 | 2019-01-10 | A vulnerability in the Secure/Multipurpose Internet Mail Extensions (S/MIME) Decryption and Verification or S/MIME Public Key Harvesting features of Cisco Asyn… |
CVE-2018-0484 | Medium | 5.3 | 2019-01-10 | A vulnerability in the access control logic of the Secure Shell (SSH) server of Cisco IOS and IOS XE Software may allow connections sourced from a virtual rout… |
CVE-2018-0483 | Medium | 4.6 | 2019-01-10 | A vulnerability in Cisco Jabber Client Framework (JCF) could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a u… |
CVE-2018-0482 | Medium | 5.4 | 2019-01-10 | A vulnerability in the web-based management interface of Cisco Prime Network Control System could allow an authenticated, remote attacker to conduct a stored c… |
CVE-2018-0474 | High | 8.8 | 2019-01-10 | A vulnerability in the web-based management interface of Cisco Unified Communications Manager could allow an authenticated, remote attacker to view digest cred… |
CVE-2018-0461 | Medium | 6.5 | 2019-01-10 | A vulnerability in the Cisco IP Phone 8800 Series Software could allow an unauthenticated, remote attacker to conduct an arbitrary script injection attack on a… |
CVE-2018-0449 | Medium | 4.2 | 2019-01-10 | A vulnerability in the Cisco Jabber Client Framework (JCF) software, installed as part of the Cisco Jabber for Mac client, could allow an authenticated, local… |
CVE-2018-4047 | Medium | 5.5 | 2019-01-10 | An exploitable privilege escalation vulnerability exists in the helper service of Clean My Mac X, version 4.04, due to improper input validation. An attacker w… |
CVE-2018-4046 | Medium | 5.5 | 2019-01-10 | An exploitable denial-of-service vulnerability exists in the helper service of Clean My Mac X, version 4.04, due to improper input validation. A user with loca… |
CVE-2018-4045 | Medium | 5.5 | 2019-01-10 | An exploitable privilege escalation vulnerability exists in the helper service of Clean My Mac X, version 4.04, due to improper input validation. An attacker w… |
CVE-2018-4044 | Medium | 5.5 | 2019-01-10 | An exploitable privilege escalation vulnerability exists in the helper service of Clean My Mac X, version 4.04, due to improper input validation. An attacker w… |
CVE-2018-4043 | Medium | 5.5 | 2019-01-10 | An exploitable privilege escalation vulnerability exists in the Clean My Mac X, version 4.04, helper service due to improper input validation. A user with loca… |
CVE-2018-4042 | Medium | 5.5 | 2019-01-10 | An exploitable privilege escalation vulnerability exists in the helper service of Clean My Mac X, version 4.04, due to improper input validation. An attacker w… |
CVE-2018-4041 | Medium | 5.5 | 2019-01-10 | An exploitable privilege escalation vulnerability exists in the helper service of Clean My Mac X, version 4.04, due to improper input validation. An attacker w… |
CVE-2018-4037 | Medium | 5.5 | 2019-01-10 | The CleanMyMac X software contains an exploitable privilege escalation vulnerability due to improper input validation. An attacker with local access can use th… |
CVE-2018-4036 | Medium | 5.5 | 2019-01-10 | The CleanMyMac X software contains an exploitable privilege escalation vulnerability due to improper input validation. An attacker with local access could use… |
CVE-2018-4035 | Medium | 5.5 | 2019-01-10 | The CleanMyMac X software contains an exploitable privilege escalation vulnerability that exists due to improper input validation. An attacker with local acces… |
CVE-2018-4034 | Medium | 5.5 | 2019-01-10 | The CleanMyMac X software contains an exploitable privilege escalation vulnerability that exists due to improper input validation. An attacker with local acces… |
CVE-2018-4033 | Medium | 5.5 | 2019-01-10 | The CleanMyMac X software contains an exploitable privilege escalation vulnerability due to improper input validation. An attacker with local access could use… |
CVE-2018-4032 | Medium | 5.5 | 2019-01-10 | An exploitable privilege escalation vulnerability exists in the way the CleanMyMac X software improperly validates inputs. An attacker with local access could… |
CVE-2018-20683 | High | 8.1 | 2019-01-10 | commands/rsync in Gitolite before 3.6.11, if .gitolite.rc enables rsync, mishandles the rsync command line, which allows attackers to have a "bad" impact by tr… |
CVE-2018-0282 | Medium | 6.8 | 2019-01-10 | A vulnerability in the TCP socket code of Cisco IOS and IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload… |
CVE-2018-0181 | High | 7.3 | 2019-01-10 | A vulnerability in the Redis implementation used by the Cisco Policy Suite for Mobile and Cisco Policy Suite Diameter Routing Agent software could allow an una… |
CVE-2018-20682 | Medium | 5.4 | 2019-01-09 | Fork CMS 5.0.6 allows stored XSS via the private/en/settings facebook_admin_ids parameter (aka "Admin ids" input in the Facebook section). |
CVE-2018-20681 | Medium | 6.1 | 2019-01-09 | mate-screensaver before 1.20.2 in MATE Desktop Environment allows physically proximate attackers to view screen content and possibly control applications. By u… |
CVE-2018-16205 | Medium | 5.4 | 2019-01-09 | Cross-site scripting vulnerability in GROWI v3.2.3 and earlier allows remote attackers to inject arbitrary web script or HTML via New Page modal. |
CVE-2018-16204 | Medium | 4.8 | 2019-01-09 | Cross-site scripting vulnerability in Google XML Sitemaps Version 4.0.9 and earlier allows remote authenticated attackers to inject arbitrary web script or HTM… |
CVE-2018-16203 | Critical | 9.8 | 2019-01-09 | PgpoolAdmin 4.0 and earlier allows remote attackers to bypass the login authentication and obtain the administrative privilege of the PostgreSQL database via u… |
CVE-2018-16202 | High | 8.6 | 2019-01-09 | Directory traversal vulnerability in cordova-plugin-ionic-webview versions prior to 2.2.0 (not including 2.0.0-beta.0, 2.0.0-beta.1, 2.0.0-beta.2, and 2.1.0-0)… |
CVE-2018-16201 | High | 8.8 | 2019-01-09 | Toshiba Home gateway HEM-GW16A 1.2.9 and earlier, Toshiba Home gateway HEM-GW26A 1.2.9 and earlier uses hard-coded credentials, which may allow an attacker on… |
CVE-2018-16200 | High | 8.8 | 2019-01-09 | Toshiba Home gateway HEM-GW16A 1.2.9 and earlier, Toshiba Home gateway HEM-GW26A 1.2.9 and earlier allows an attacker on the same network segment to execute ar… |
CVE-2018-16199 | Medium | 6.1 | 2019-01-09 | Cross-site scripting vulnerability in Toshiba Home gateway HEM-GW16A 1.2.9 and earlier, Toshiba Home gateway HEM-GW26A 1.2.9 and earlier allows an remote attac… |
CVE-2018-16198 | High | 8.8 | 2019-01-09 | Toshiba Home gateway HEM-GW16A 1.2.9 and earlier, Toshiba Home gateway HEM-GW26A 1.2.9 and earlier may allow an attacker on the same network segment to access… |
CVE-2018-16197 | Medium | 6.5 | 2019-01-09 | Toshiba Home gateway HEM-GW16A 1.2.9 and earlier, Toshiba Home gateway HEM-GW26A 1.2.9 and earlier allows an attacker on the same network segment to bypass acc… |
CVE-2018-16196 | High | 7.5 | 2019-01-09 | Multiple Yokogawa products that contain Vnet/IP Open Communication Driver (CENTUM CS 3000(R3.05.00 - R3.09.50), CENTUM CS 3000 Entry Class(R3.05.00 - R3.09.50)… |
CVE-2018-16195 | High | 8.8 | 2019-01-09 | Aterm WF1200CR and Aterm WG1200CR (Aterm WF1200CR firmware Ver1.1.1 and earlier, Aterm WG1200CR firmware Ver1.0.1 and earlier) allows an attacker on the same n… |
CVE-2018-16194 | High | 7.2 | 2019-01-09 | Aterm WF1200CR and Aterm WG1200CR (Aterm WF1200CR firmware Ver1.1.1 and earlier, Aterm WG1200CR firmware Ver1.0.1 and earlier) allows authenticated attackers t… |
CVE-2018-16193 | Medium | 5.4 | 2019-01-09 | Cross-site scripting vulnerability in Aterm WF1200CR and Aterm WG1200CR (Aterm WF1200CR firmware Ver1.1.1 and earlier, Aterm WG1200CR firmware Ver1.0.1 and ear… |
CVE-2018-16192 | Medium | 6.5 | 2019-01-09 | Aterm WF1200CR and Aterm WG1200CR (Aterm WF1200CR firmware Ver1.1.1 and earlier, Aterm WG1200CR firmware Ver1.0.1 and earlier) allow an attacker on the same ne… |
CVE-2018-16191 | Medium | 6.1 | 2019-01-09 | Open redirect vulnerability in EC-CUBE (EC-CUBE 3.0.0, EC-CUBE 3.0.1, EC-CUBE 3.0.2, EC-CUBE 3.0.3, EC-CUBE 3.0.4, EC-CUBE 3.0.5, EC-CUBE 3.0.6, EC-CUBE 3.0.7… |
CVE-2018-16188 | Critical | 9.8 | 2019-01-09 | SQL injection vulnerability in the RICOH Interactive Whiteboard D2200 V1.3 to V2.2, D5500 V1.3 to V2.2, D5510 V1.3 to V2.2, the display versions with RICOH Int… |
CVE-2018-16187 | Medium | 5.9 | 2019-01-09 | The RICOH Interactive Whiteboard D2200 V1.3 to V2.2, D5500 V1.3 to V2.2, D5510 V1.3 to V2.2, the display versions with RICOH Interactive Whiteboard Controller… |
CVE-2018-16186 | High | 8.8 | 2019-01-09 | RICOH Interactive Whiteboard D2200 V1.1 to V2.2, D5500 V1.1 to V2.2, D5510 V1.1 to V2.2, the display versions with RICOH Interactive Whiteboard Controller Type… |
CVE-2018-16185 | High | 7.8 | 2019-01-09 | RICOH Interactive Whiteboard D2200 V1.1 to V2.2, D5500 V1.1 to V2.2, D5510 V1.1 to V2.2, the display versions with RICOH Interactive Whiteboard Controller Type… |
CVE-2018-16184 | Critical | 9.8 | 2019-01-09 | RICOH Interactive Whiteboard D2200 V1.6 to V2.2, D5500 V1.6 to V2.2, D5510 V1.6 to V2.2, and the display versions with RICOH Interactive Whiteboard Controller… |
CVE-2018-16183 | High | 7.8 | 2019-01-09 | An unquoted search path vulnerability in some pre-installed applications on Panasonic PC run on Windows 7 (32bit), Windows 7 (64bit), Windows 8 (64bit), Window… |
CVE-2018-16182 | High | 7.8 | 2019-01-09 | Untrusted search path vulnerability in the installer of MARKET SPEED Ver.16.4 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an un… |
CVE-2018-16181 | Medium | 6.1 | 2019-01-09 | HTTP header injection vulnerability in i-FILTER Ver.9.50R05 and earlier may allow remote attackers to inject arbitrary HTTP headers and conduct HTTP response s… |
CVE-2018-16180 | Medium | 6.1 | 2019-01-09 | Cross-site scripting vulnerability in i-FILTER Ver.9.50R05 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. |
CVE-2018-16179 | Medium | 5.9 | 2019-01-09 | The Mizuho Direct App for Android version 3.13.0 and earlier does not verify server certificates, which allows man-in-the-middle attackers to spoof servers and… |
CVE-2018-16178 | High | 7.5 | 2019-01-09 | Cybozu Garoon 3.0.0 to 4.10.0 allows remote attackers to bypass access restriction to view information available only for a sign-on user via Single sign-on fun… |
CVE-2018-16177 | High | 7.8 | 2019-01-09 | Untrusted search path vulnerability in The installer of Windows 10 Fall Creators Update Modify module for Security Measures tool allows an attacker to gain pri… |
CVE-2018-16176 | High | 7.8 | 2019-01-09 | Untrusted search path vulnerability in Installer of Mapping Tool 2.0.1.6 and 2.0.1.7 allows remote attackers to gain privileges via a Trojan horse DLL in an un… |
CVE-2018-16175 | High | 7.2 | 2019-01-09 | SQL injection vulnerability in the LearnPress prior to version 3.1.0 allows attacker with administrator rights to execute arbitrary SQL commands via unspecifie… |
CVE-2018-16174 | Medium | 6.1 | 2019-01-09 | Open redirect vulnerability in LearnPress prior to version 3.1.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks… |
CVE-2018-16173 | Medium | 6.1 | 2019-01-09 | Cross-site scripting vulnerability in LearnPress prior to version 3.1.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. |