2018 CVEs (page 35)
Page 35 of 162 — CVEs published in 2018, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2018-16172 | Medium | 6.5 | 2019-01-09 | Improper countermeasure against clickjacking attack in client certificates management screen was discovered in Cybozu Remote Service 3.0.0 to 3.1.8, that allow… |
CVE-2018-16171 | High | 8.8 | 2019-01-09 | Directory traversal vulnerability in Cybozu Remote Service 3.0.0 to 3.1.8 allows remote attackers to execute Java code file on the server via unspecified vecto… |
CVE-2018-16170 | High | 8.1 | 2019-01-09 | Directory traversal vulnerability in Cybozu Remote Service 3.0.0 to 3.1.8 for Windows allows remote authenticated attackers to read arbitrary files via unspeci… |
CVE-2018-16169 | High | 8.8 | 2019-01-09 | Cybozu Remote Service 3.0.0 to 3.1.0 allows remote authenticated attackers to upload and execute Java code file on the server via unspecified vectors. |
CVE-2018-16168 | Critical | 9.8 | 2019-01-09 | LogonTracer 1.2.0 and earlier allows remote attackers to conduct Python code injection attacks via unspecified vectors. |
CVE-2018-16167 | Critical | 9.8 | 2019-01-09 | LogonTracer 1.2.0 and earlier allows remote attackers to execute arbitrary OS commands via unspecified vectors. |
CVE-2018-16166 | High | 8.8 | 2019-01-09 | LogonTracer 1.2.0 and earlier allows remote attackers to conduct XML External Entity (XXE) attacks via unspecified vectors. |
CVE-2018-16165 | Medium | 6.1 | 2019-01-09 | Cross-site scripting vulnerability in LogonTracer 1.2.0 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. |
CVE-2018-16164 | Medium | 5.4 | 2019-01-09 | Cross-site scripting vulnerability in Event Calendar WD version 1.1.21 and earlier allows remote authenticated attackers to inject arbitrary web script or HTML… |
CVE-2018-1000426 | Medium | 6.1 | 2019-01-09 | A cross-site scripting vulnerability exists in Jenkins Git Changelog Plugin 2.6 and earlier in GitChangelogSummaryDecorator/summary.jelly, GitChangelogLeftside… |
CVE-2018-1000425 | High | 7.8 | 2019-01-09 | An insufficiently protected credentials vulnerability exists in Jenkins SonarQube Scanner Plugin 2.8 and earlier in SonarInstallation.java that allows attacker… |
CVE-2018-1000424 | High | 7.8 | 2019-01-09 | An insufficiently protected credentials vulnerability exists in Jenkins Artifactory Plugin 2.16.1 and earlier in ArtifactoryBuilder.java, CredentialsConfig.jav… |
CVE-2018-1000423 | High | 7.8 | 2019-01-09 | An insufficiently protected credentials vulnerability exists in Jenkins Crowd 2 Integration Plugin 2.0.0 and earlier in CrowdSecurityRealm.java, CrowdConfigura… |
CVE-2018-1000422 | Medium | 6.5 | 2019-01-09 | An improper authorization vulnerability exists in Jenkins Crowd 2 Integration Plugin 2.0.0 and earlier in CrowdSecurityRealm.java that allows attackers to have… |
CVE-2018-1000421 | Medium | 6.5 | 2019-01-09 | An improper authorization vulnerability exists in Jenkins Mesos Plugin 0.17.1 and earlier in MesosCloud.java that allows attackers with Overall/Read access to… |
CVE-2018-1000420 | Medium | 6.5 | 2019-01-09 | An improper authorization vulnerability exists in Jenkins Mesos Plugin 0.17.1 and earlier in MesosCloud.java that allows attackers with Overall/Read access to… |
CVE-2018-1000419 | Medium | 6.5 | 2019-01-09 | An improper authorization vulnerability exists in Jenkins HipChat Plugin 2.2.0 and earlier in HipChatNotifier.java that allows attackers with Overall/Read acce… |
CVE-2018-1000418 | High | 8.8 | 2019-01-09 | An improper authorization vulnerability exists in Jenkins HipChat Plugin 2.2.0 and earlier in HipChatNotifier.java that allows attackers with Overall/Read acce… |
CVE-2018-1000417 | High | 8.1 | 2019-01-09 | A cross-site request forgery vulnerability exists in Jenkins Email Extension Template Plugin 1.0 and earlier in ExtEmailTemplateManagement.java that allows cre… |
CVE-2018-1000416 | Medium | 6.1 | 2019-01-09 | A reflected cross-site scripting vulnerability exists in Jenkins Job Config History Plugin 2.18 and earlier in all Jelly files that shows arbitrary attacker-sp… |
CVE-2018-1000415 | Medium | 5.4 | 2019-01-09 | A cross-site scripting vulnerability exists in Jenkins Rebuilder Plugin 1.28 and earlier in RebuildAction/BooleanParameterValue.jelly, RebuildAction/ExtendedCh… |
CVE-2018-1000414 | High | 8.1 | 2019-01-09 | A cross-site request forgery vulnerability exists in Jenkins Config File Provider Plugin 3.1 and earlier in ConfigFilesManagement.java, FolderConfigFileAction… |
CVE-2018-1000413 | Medium | 5.4 | 2019-01-09 | A cross-site scripting vulnerability exists in Jenkins Config File Provider Plugin 3.1 and earlier in configfiles.jelly, providerlist.jelly that allows users w… |
CVE-2018-1000412 | High | 8.8 | 2019-01-09 | An improper authorization vulnerability exists in Jenkins Jira Plugin 3.0.1 and earlier in JiraSite.java that allows attackers with Overall/Read access to have… |
CVE-2018-1000411 | Medium | 6.5 | 2019-01-09 | A cross-site request forgery vulnerability exists in Jenkins JUnit Plugin 1.25 and earlier in TestObject.java that allows setting the description of a test res… |
CVE-2018-1000410 | High | 7.8 | 2019-01-09 | An information exposure vulnerability exists in Jenkins 2.145 and earlier, LTS 2.138.1 and earlier, and the Stapler framework used by these releases, in core/s… |
CVE-2018-1000409 | Medium | 5.4 | 2019-01-09 | A session fixation vulnerability exists in Jenkins 2.145 and earlier, LTS 2.138.1 and earlier in core/src/main/java/hudson/security/HudsonPrivateSecurityRealm… |
CVE-2018-1000408 | Medium | 6.5 | 2019-01-09 | A denial of service vulnerability exists in Jenkins 2.145 and earlier, LTS 2.138.1 and earlier in core/src/main/java/hudson/security/HudsonPrivateSecurityRealm… |
CVE-2018-1000407 | Medium | 6.1 | 2019-01-09 | A cross-site scripting vulnerability exists in Jenkins 2.145 and earlier, LTS 2.138.1 and earlier in core/src/main/java/hudson/model/Api.java that allows attac… |
CVE-2018-1000406 | Medium | 6.5 | 2019-01-09 | A path traversal vulnerability exists in Jenkins 2.145 and earlier, LTS 2.138.1 and earlier in core/src/main/java/hudson/model/FileParameterValue.java that all… |
CVE-2018-0705 | Critical | 9.1 | 2019-01-09 | Directory traversal vulnerability in Cybozu Dezie 8.0.2 to 8.1.2 allows remote attackers to read arbitrary files via HTTP requests. |
CVE-2018-0704 | High | 7.5 | 2019-01-09 | Directory traversal vulnerability in Cybozu Office 10.0.0 to 10.8.1 allows remote attackers to delete arbitrary files via Keitai Screen. |
CVE-2018-0703 | High | 7.5 | 2019-01-09 | Directory traversal vulnerability in Cybozu Office 10.0.0 to 10.8.1 allows remote attackers to delete arbitrary files via HTTP requests. |
CVE-2018-0702 | High | 7.5 | 2019-01-09 | Directory traversal vulnerability in Cybozu Mailwise 5.0.0 to 5.4.5 allows remote attackers to delete arbitrary files via unspecified vectors. |
CVE-2018-0698 | Medium | 5.4 | 2019-01-09 | Cross-site scripting vulnerability in GROWI v3.2.3 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. |
CVE-2018-0689 | High | 8.8 | 2019-01-09 | HTTP header injection vulnerability in SEIKO EPSON printers and scanners (DS-570W firmware versions released prior to 2018 March 13, DS-780N firmware versions… |
CVE-2018-0688 | Medium | 6.1 | 2019-01-09 | Open redirect vulnerability in SEIKO EPSON printers and scanners (DS-570W firmware versions released prior to 2018 March 13, DS-780N firmware versions released… |
CVE-2018-0678 | Medium | 6.8 | 2019-01-09 | Buffer overflow in BN-SDWBP3 firmware version 1.0.9 and earlier allows an attacker on the same network segment to execute arbitrary code via unspecified vector… |
CVE-2018-0677 | Medium | 6.8 | 2019-01-09 | BN-SDWBP3 firmware version 1.0.9 and earlier allows attacker with administrator rights on the same network segment to execute arbitrary OS commands via unspeci… |
CVE-2018-0676 | High | 8.8 | 2019-01-09 | BN-SDWBP3 firmware version 1.0.9 and earlier allows an attacker on the same network segment to bypass authentication to access to the management screen and exe… |
CVE-2018-0671 | Medium | 6.7 | 2019-01-09 | Privilege escalation vulnerability in INplc-RT 3.08 and earlier allows an attacker with administrator rights to execute arbitrary code on the Windows system vi… |
CVE-2018-0670 | Critical | 9.8 | 2019-01-09 | INplc-RT 3.08 and earlier allows remote attackers to bypass authentication to execute an arbitrary command through the protocol-compliant traffic. This is a di… |
CVE-2018-0669 | Critical | 9.8 | 2019-01-09 | INplc-RT 3.08 and earlier allows remote attackers to bypass authentication to execute an arbitrary command through the protocol-compliant traffic. This is a di… |
CVE-2018-0668 | Critical | 9.8 | 2019-01-09 | Buffer overflow in INplc-RT 3.08 and earlier allows remote attackers to cause denial-of-service (DoS) condition that may result in executing arbtrary code via… |
CVE-2018-0667 | High | 7.8 | 2019-01-09 | Untrusted search path vulnerability in Installer of INplc SDK Express 3.08 and earlier and Installer of INplc SDK Pro+ 3.08 and earlier allows an attacker to g… |
CVE-2018-0666 | Medium | 6.8 | 2019-01-09 | Yamaha routers RT57i Rev.8.00.95 and earlier, RT58i Rev.9.01.51 and earlier, NVR500 Rev.11.00.36 and earlier, RTX810 Rev.11.01.31 and earlier, allow an adminis… |
CVE-2018-0665 | Medium | 6.8 | 2019-01-09 | Yamaha routers RT57i Rev.8.00.95 and earlier, RT58i Rev.9.01.51 and earlier, NVR500 Rev.11.00.36 and earlier, RTX810 Rev.11.01.31 and earlier, allow an adminis… |
CVE-2018-0651 | Critical | 9.8 | 2019-01-09 | Buffer overflow in the license management function of YOKOGAWA products (iDefine for ProSafe-RS R1.16.3 and earlier, STARDOM VDS R7.50 and earlier, STARDOM FCN… |
CVE-2018-0641 | High | 7.2 | 2019-01-09 | Buffer overflow in Aterm HC100RC Ver1.0.1 and earlier allows attacker with administrator rights to execute arbitrary code via tools_system.cgi date parameter… |
CVE-2018-0640 | High | 7.2 | 2019-01-09 | Buffer overflow in Aterm HC100RC Ver1.0.1 and earlier allows attacker with administrator rights to execute arbitrary code via netWizard.cgi date parameter, tim… |
CVE-2018-0639 | High | 7.2 | 2019-01-09 | Aterm HC100RC Ver1.0.1 and earlier allows attacker with administrator rights to execute arbitrary OS commands via tools_firmware.cgi date parameter, time param… |
CVE-2018-0638 | High | 7.2 | 2019-01-09 | Aterm HC100RC Ver1.0.1 and earlier allows attacker with administrator rights to execute arbitrary OS commands via import.cgi encKey parameter. |
CVE-2018-0637 | High | 7.2 | 2019-01-09 | Aterm HC100RC Ver1.0.1 and earlier allows attacker with administrator rights to execute arbitrary OS commands via export.cgi encKey parameter. |
CVE-2018-0636 | High | 7.2 | 2019-01-09 | Aterm HC100RC Ver1.0.1 and earlier allows attacker with administrator rights to execute arbitrary OS commands via FactoryPassword parameter of a certain URL, d… |
CVE-2018-0635 | High | 7.2 | 2019-01-09 | Aterm HC100RC Ver1.0.1 and earlier allows attacker with administrator rights to execute arbitrary OS commands via filename parameter. |
CVE-2018-0634 | High | 7.2 | 2019-01-09 | Aterm HC100RC Ver1.0.1 and earlier allows attacker with administrator rights to execute arbitrary OS commands via FactoryPassword parameter or bootmode paramet… |
CVE-2018-0633 | High | 7.2 | 2019-01-09 | Buffer overflow in Aterm W300P Ver1.0.13 and earlier allows attacker with administrator rights to execute arbitrary code via submit-url parameter. |
CVE-2018-0632 | High | 7.2 | 2019-01-09 | Buffer overflow in Aterm W300P Ver1.0.13 and earlier allows attacker with administrator rights to execute arbitrary code via HTTP request and response. |
CVE-2018-0631 | High | 7.2 | 2019-01-09 | Aterm W300P Ver1.0.13 and earlier allows attacker with administrator rights to execute arbitrary OS commands via targetAPSsid parameter. |
CVE-2018-0630 | High | 7.2 | 2019-01-09 | Aterm W300P Ver1.0.13 and earlier allows attacker with administrator rights to execute arbitrary OS commands via sysCmd parameter. |
CVE-2018-0629 | High | 7.2 | 2019-01-09 | Aterm W300P Ver1.0.13 and earlier allows attacker with administrator rights to execute arbitrary OS commands via HTTP request and response. |
CVE-2018-0628 | High | 7.2 | 2019-01-09 | Aterm WG1200HP firmware Ver1.0.31 and earlier allows attacker with administrator rights to execute arbitrary OS commands via HTTP request and response. |
CVE-2018-0627 | High | 7.2 | 2019-01-09 | Aterm WG1200HP firmware Ver1.0.31 and earlier allows attacker with administrator rights to execute arbitrary OS commands via targetAPSsid parameter. |
CVE-2018-0626 | High | 7.2 | 2019-01-09 | Aterm WG1200HP firmware Ver1.0.31 and earlier allows attacker with administrator rights to execute arbitrary OS commands via sysCmd in formWsc parameter. |
CVE-2018-0625 | High | 7.2 | 2019-01-09 | Aterm WG1200HP firmware Ver1.0.31 and earlier allows attacker with administrator rights to execute arbitrary OS commands via formSysCmd parameter. |
CVE-2018-6179 | Medium | 6.5 | 2019-01-09 | Insufficient enforcement of file access permission in the activeTab case in Extensions in Google Chrome prior to 68.0.3440.75 allowed an attacker who convinced… |
CVE-2018-6178 | Medium | 4.3 | 2019-01-09 | Eliding from the wrong side in an infobar in DevTools in Google Chrome prior to 68.0.3440.75 allowed an attacker who convinced a user to install a malicious ex… |
CVE-2018-6175 | Medium | 6.5 | 2019-01-09 | Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to perform domain spoofing via ID… |
CVE-2018-6174 | High | 8.8 | 2019-01-09 | Integer overflows in Swiftshader in Google Chrome prior to 68.0.3440.75 potentially allowed a remote attacker to execute arbitrary code via a crafted HTML page. |
CVE-2018-6173 | Medium | 6.5 | 2019-01-09 | Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to perform domain spoofing via ID… |
CVE-2018-6172 | Medium | 6.5 | 2019-01-09 | Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to perform domain spoofing via ID… |
CVE-2018-6170 | High | 8.8 | 2019-01-09 | A bad cast in PDFium in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file. |
CVE-2018-6169 | Medium | 6.5 | 2019-01-09 | Lack of timeout on extension install prompt in Extensions in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to trigger installation of an unwant… |
CVE-2018-6167 | Medium | 6.5 | 2019-01-09 | Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to perform domain spoofing via ID… |
CVE-2018-6166 | Medium | 6.5 | 2019-01-09 | Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to perform domain spoofing via ID… |
CVE-2018-6165 | Medium | 6.5 | 2019-01-09 | Incorrect handling of reloads in Navigation in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via… |
CVE-2018-6164 | Medium | 6.5 | 2019-01-09 | Insufficient origin checks for CSS content in Blink in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to leak cross-origin data via a crafted HT… |
CVE-2018-6163 | Medium | 6.5 | 2019-01-09 | Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to perform domain spoofing via ID… |
CVE-2018-6162 | High | 8.8 | 2019-01-09 | Improper deserialization in WebGL in Google Chrome on Mac prior to 68.0.3440.75 allowed a remote attacker to potentially exploit heap corruption via a crafted… |
CVE-2018-6160 | Medium | 6.5 | 2019-01-09 | JavaScript alert handling in Prompts in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a craf… |
CVE-2018-6158 | High | 7.5 | 2019-01-09 | A race condition in Oilpan in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2018-6153 | High | 8.8 | 2019-01-09 | A precision error in Skia in Google Chrome prior to 68.0.3440.75 allowed a remote attacker who had compromised the renderer process to perform an out of bounds… |
CVE-2018-6151 | High | 8.8 | 2019-01-09 | Bad cast in DevTools in Google Chrome on Win, Linux, Mac, Chrome OS prior to 66.0.3359.117 allowed an attacker who convinced a user to install a malicious exte… |
CVE-2018-6147 | Medium | 5.5 | 2019-01-09 | Lack of secure text entry mode in Browser UI in Google Chrome on Mac prior to 67.0.3396.62 allowed a local attacker to obtain potentially sensitive information… |
CVE-2018-6144 | High | 8.8 | 2019-01-09 | Off-by-one error in PDFium in Google Chrome prior to 67.0.3396.62 allowed a remote attacker to perform an out of bounds memory write via a crafted PDF file. |
CVE-2018-6143 | Medium | 6.5 | 2019-01-09 | Insufficient validation in V8 in Google Chrome prior to 67.0.3396.62 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. |
CVE-2018-6141 | High | 8.8 | 2019-01-09 | Insufficient validation of an image filter in Skia in Google Chrome prior to 67.0.3396.62 allowed a remote attacker who had compromised the renderer process to… |
CVE-2018-6140 | High | 8.8 | 2019-01-09 | Allowing the chrome.debugger API to attach to Web UI pages in DevTools in Google Chrome prior to 67.0.3396.62 allowed an attacker who convinced a user to insta… |
CVE-2018-6139 | High | 8.8 | 2019-01-09 | Insufficient target checks on the chrome.debugger API in DevTools in Google Chrome prior to 67.0.3396.62 allowed an attacker who convinced a user to install a… |
CVE-2018-6137 | Medium | 6.5 | 2019-01-09 | CSS Paint API in Blink in Google Chrome prior to 67.0.3396.62 allowed a remote attacker to leak cross-origin data via a crafted HTML page. |
CVE-2018-6135 | Medium | 6.5 | 2019-01-09 | Lack of clearing the previous site before loading alerts from a new one in Blink in Google Chrome prior to 67.0.3396.62 allowed a remote attacker to perform do… |
CVE-2018-6133 | Medium | 6.5 | 2019-01-09 | Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 67.0.3396.62 allowed a remote attacker to perform domain spoofing via ID… |
CVE-2018-6127 | Critical | 9.6 | 2019-01-09 | Early free of object in use in IndexDB in Google Chrome prior to 67.0.3396.62 allowed a remote attacker who had compromised the renderer process to potentially… |
CVE-2018-6126 | High | 8.8 | 2019-01-09 | A precision error in Skia in Google Chrome prior to 67.0.3396.62 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. |
CVE-2018-6124 | High | 8.8 | 2019-01-09 | Type confusion in ReadableStreams in Blink in Google Chrome prior to 67.0.3396.62 allowed a remote attacker to potentially exploit object corruption via a craf… |
CVE-2018-6123 | Medium | 6.5 | 2019-01-09 | A use after free in Blink in Google Chrome prior to 67.0.3396.62 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2018-6120 | High | 8.8 | 2019-01-09 | An integer overflow that could lead to an attacker-controlled heap out-of-bounds write in PDFium in Google Chrome prior to 66.0.3359.170 allowed a remote attac… |
CVE-2018-6117 | Medium | 6.5 | 2019-01-09 | Confusing settings in Autofill in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to obtain potentially sensitive information from process memor… |
CVE-2018-6114 | Medium | 6.5 | 2019-01-09 | Incorrect enforcement of CSP for <object> tags in Blink in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to bypass content security policy via… |
CVE-2018-6113 | Medium | 6.5 | 2019-01-09 | Improper handling of pending navigation entries in Navigation in Google Chrome on iOS prior to 66.0.3359.117 allowed a remote attacker to perform domain spoofi… |