2018 CVEs (page 41)
Page 41 of 162 — CVEs published in 2018, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2018-8892 | Medium | 6.5 | 2018-12-20 | A cross-site request forgery (CSRF) vulnerability in the Management Console of BlackBerry UEM versions earlier than 12.9.1 could allow an attacker to make modi… |
CVE-2018-8891 | Medium | 4.8 | 2018-12-20 | Multiple stored cross-site scripting (XSS) vulnerabilities in the Management Console of BlackBerry UEM versions earlier than 12.9.1 could allow an attacker to… |
CVE-2018-8888 | Medium | 4.8 | 2018-12-20 | A stored cross-site scripting (XSS) vulnerability in the Management Console of BlackBerry UEM versions earlier than 12.10.0 could allow an attacker to store sc… |
CVE-2018-15331 | High | 7.8 | 2018-12-20 | On BIG-IP AAM 13.0.0 or 12.1.0-12.1.3.7, the dcdb_convert utility used by BIG-IP AAM fails to drop group permissions when executing helper scripts, which could… |
CVE-2018-15330 | High | 7.5 | 2018-12-20 | On BIG-IP 14.0.0-14.0.0.2, 13.0.0-13.1.1.1, or 12.1.0-12.1.3.7, when a virtual server using the inflate functionality to process a gzip bomb as a payload, the… |
CVE-2018-15329 | High | 7.2 | 2018-12-20 | On BIG-IP 14.0.0-14.0.0.2, 13.0.0-13.1.1.1, or 12.1.0-12.1.3.7, or Enterprise Manager 3.1.1, when authenticated administrative users run commands in the Traffi… |
CVE-2018-19234 | High | 8.8 | 2018-12-20 | The Miss Marple Updater Service in COMPAREX Miss Marple Enterprise Edition before 2.0 allows remote attackers to execute arbitrary code with SYSTEM privileges… |
CVE-2018-19233 | High | 7.8 | 2018-12-20 | COMPAREX Miss Marple Enterprise Edition before 2.0 allows local users to execute arbitrary code by reading the user name and encrypted password hard-coded in a… |
CVE-2018-1000882 | High | 7.5 | 2018-12-20 | WeBid version up to current version 1.2.2 contains a Directory Traversal vulnerability in getthumb.php that can result in Arbitrary Image File Read. This attac… |
CVE-2018-1000881 | Critical | 9.8 | 2018-12-20 | Traccar Traccar Server version 4.0 and earlier contains a CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability in ComputedAttributes… |
CVE-2018-1000880 | Medium | 6.5 | 2018-12-20 | libarchive version commit 9693801580c0cf7c70e862d305270a16b52826a7 onwards (release v3.2.0 onwards) contains a CWE-20: Improper Input Validation vulnerability… |
CVE-2018-1000879 | Medium | 6.5 | 2018-12-20 | libarchive version commit 379867ecb330b3a952fb7bfa7bffb7bbd5547205 onwards (release v3.3.0 onwards) contains a CWE-476: NULL Pointer Dereference vulnerability… |
CVE-2018-1000878 | High | 8.8 | 2018-12-20 | libarchive version commit 416694915449219d505531b1096384f3237dd6cc onwards (release v3.1.0 onwards) contains a CWE-416: Use After Free vulnerability in RAR dec… |
CVE-2018-1000877 | High | 8.8 | 2018-12-20 | libarchive version commit 416694915449219d505531b1096384f3237dd6cc onwards (release v3.1.0 onwards) contains a CWE-415: Double Free vulnerability in RAR decode… |
CVE-2018-1000876 | High | 7.8 | 2018-12-20 | binutils version 2.32 and earlier contains a Integer Overflow vulnerability in objdump, bfd_get_dynamic_reloc_upper_bound,bfd_canonicalize_dynamic_reloc that c… |
CVE-2018-1000875 | Critical | 9.8 | 2018-12-20 | Berkeley Open Infrastructure for Network Computing BOINC Server and Website Code version 0.9-1.0.2 contains a CWE-302: Authentication Bypass by Assumed-Immutab… |
CVE-2018-1000874 | Medium | 6.1 | 2018-12-20 | PHP cebe markdown parser version 1.2.0 and earlier contains a Cross Site Scripting (XSS) vulnerability in all distributed parsers allowing a malicious crafted… |
CVE-2018-1000873 | Medium | 6.5 | 2018-12-20 | Fasterxml Jackson version Before 2.9.8 contains a CWE-20: Improper Input Validation vulnerability in Jackson-Modules-Java8 that can result in Causes a denial-o… |
CVE-2018-1000872 | Medium | 6.5 | 2018-12-20 | OpenKMIP PyKMIP version All versions before 0.8.0 contains a CWE 399: Resource Management Errors (similar issue to CVE-2015-5262) vulnerability in PyKMIP serve… |
CVE-2018-1000871 | Critical | 9.8 | 2018-12-20 | HotelDruid HotelDruid 2.3.0 version 2.3.0 and earlier contains a SQL Injection vulnerability in "id_utente_mod" parameter in gestione_utenti.php file that can… |
CVE-2018-1000870 | Medium | 5.4 | 2018-12-20 | PHPipam version 1.3.2 and earlier contains a CWE-79 vulnerability in /app/admin/users/print-user.php that can result in Execute code in the victims browser. Th… |
CVE-2018-1000869 | Critical | 9.8 | 2018-12-20 | phpIPAM version 1.3.2 contains a CWE-89 vulnerability in /app/admin/nat/item-add-submit.php that can result in SQL Injection.. This attack appear to be exploit… |
CVE-2018-1000868 | Medium | 6.1 | 2018-12-20 | WeBid version up to current version 1.2.2 contains a Cross Site Scripting (XSS) vulnerability in user_login.php, register.php that can result in Javascript exe… |
CVE-2018-1000867 | High | 8.8 | 2018-12-20 | WeBid version up to current version 1.2.2 contains a SQL Injection vulnerability in All five yourauctions*.php scripts that can result in Database Read via Bli… |
CVE-2018-1000860 | Medium | 4.7 | 2018-12-20 | phpipam version 1.3.2 and earlier contains a Cross Site Scripting (XSS) vulnerability in The value of the phpipamredirect cookie is copied into an HTML tag on… |
CVE-2018-1000858 | High | 8.8 | 2018-12-20 | GnuPG version 2.1.12 - 2.2.11 contains a Cross ite Request Forgery (CSRF) vulnerability in dirmngr that can result in Attacker controlled CSRF, Information Dis… |
CVE-2018-1000857 | High | 8.8 | 2018-12-20 | log-user-session version 0.7 and earlier contains a Directory Traversal vulnerability in Main SUID-binary /usr/local/bin/log-user-session that can result in Us… |
CVE-2018-1000856 | Medium | 4.8 | 2018-12-20 | DomainMOD version 4.09.03 and above. Also verified in the latest version 4.11.01 contains a Cross Site Scripting (XSS) vulnerability in Segment Name field in t… |
CVE-2018-1000855 | Medium | 6.1 | 2018-12-20 | easymon version 1.4 and earlier contains a Cross Site Scripting (XSS) vulnerability in Endpoint where monitoring is mounted that can result in Reflected XSS th… |
CVE-2018-1000854 | Critical | 9.8 | 2018-12-20 | esigate.org esigate version 5.2 and earlier contains a CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection… |
CVE-2018-11988 | High | 7.8 | 2018-12-20 | In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, Un-trusted pointer de-reference issue by accessing a… |
CVE-2018-11987 | High | 7.8 | 2018-12-20 | In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, if there is an unlikely memory alloc failure for the… |
CVE-2018-11986 | High | 7.8 | 2018-12-20 | In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, Possible buffer overflow in TX and RX FIFOs of micro… |
CVE-2018-11985 | High | 7.8 | 2018-12-20 | In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, When allocating heap using user supplied size, Possi… |
CVE-2018-11984 | High | 7.8 | 2018-12-20 | In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, A use after free condition and an out-of-bounds acce… |
CVE-2018-11983 | High | 7.8 | 2018-12-20 | In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, Error in kernel observed while accessing freed mask… |
CVE-2018-11965 | High | 7.8 | 2018-12-20 | In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, Anyone can execute proptrigger.sh which will lead to… |
CVE-2018-11964 | High | 7.8 | 2018-12-20 | In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, Exposing the hashed content in /etc/passwd may lead… |
CVE-2018-11963 | High | 7.8 | 2018-12-20 | In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, Buffer overread may occur due to non-null terminated… |
CVE-2018-11961 | High | 7.8 | 2018-12-20 | In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, Possibility of accessing out of bound vector index W… |
CVE-2018-11960 | High | 7.8 | 2018-12-20 | In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, A use after free condition can occur in the SPS driv… |
CVE-2018-1000852 | Medium | 6.5 | 2018-12-20 | FreeRDP FreeRDP 2.0.0-rc3 released version before commit 205c612820dac644d665b5bb1cdf437dc5ca01e3 contains a Other/Unknown vulnerability in channels/drdynvc/cl… |
CVE-2018-1000851 | Critical | 9.8 | 2018-12-20 | Copay Bitcoin Wallet version 5.01 to 5.1.0 included. contains a Other/Unknown vulnerability in wallet private key storage that can result in Users' private key… |
CVE-2018-1000850 | High | 7.5 | 2018-12-20 | Square Retrofit version versions from (including) 2.0 and 2.5.0 (excluding) contains a Directory Traversal vulnerability in RequestBuilder class, method addPat… |
CVE-2018-1000849 | High | 8.8 | 2018-12-20 | Alpine Linux version Versions prior to 2.6.10, 2.7.6, and 2.10.1 contains a Other/Unknown vulnerability in apk-tools (Alpine Linux' package manager) that can r… |
CVE-2018-1000848 | Medium | 6.1 | 2018-12-20 | Wampserver version prior to version 3.1.5 contains a Cross Site Scripting (XSS) vulnerability in index.php localhost page that can result in very low. This att… |
CVE-2018-1000847 | Medium | 5.4 | 2018-12-20 | FreshDNS version 1.0.3 and prior contains a Cross Site Scripting (XSS) vulnerability in Account data form; Zone editor that can result in Execution of attacker… |
CVE-2018-1000846 | High | 8.8 | 2018-12-20 | FreshDNS version 1.0.3 and earlier contains a Cross ite Request Forgery (CSRF) vulnerability in All (authenticated) API calls in index.php / class.manager.php… |
CVE-2018-1000844 | Critical | 9.1 | 2018-12-20 | Square Open Source Retrofit version Prior to commit 4a693c5aeeef2be6c7ecf80e7b5ec79f6ab59437 contains a XML External Entity (XXE) vulnerability in JAXB that ca… |
CVE-2018-1000843 | High | 8.8 | 2018-12-20 | Luigi version prior to version 2.8.0; after commit 53b52e12745075a8acc016d33945d9d6a7a6aaeb; after GitHub PR spotify/luigi/pull/1870 contains a Cross ite Reque… |
CVE-2018-1000842 | Medium | 6.1 | 2018-12-20 | FatFreeCRM version <=0.14.1, >=0.15.0 <=0.15.1, >=0.16.0 <=0.16.3, >=0.17.0 <=0.17.2, ==0.18.0 contains a Cross Site Scripting (XSS) vulnerability in commit 6d… |
CVE-2018-1000841 | Medium | 6.1 | 2018-12-20 | Zend.To version Prior to 5.15-1 contains a Cross Site Scripting (XSS) vulnerability in The verify.php page that can result in An attacker could execute arbitra… |
CVE-2018-1000840 | Medium | 6.5 | 2018-12-20 | Processing Foundation Processing version 3.4 and earlier contains a XML External Entity (XXE) vulnerability in loadXML() function that can result in An attacke… |
CVE-2018-1000839 | High | 8.8 | 2018-12-20 | LH-EHR version REL-2_0_0 contains a Arbitrary File Upload vulnerability in Profile picture upload that can result in Remote Code Execution. This attack appear… |
CVE-2018-1000838 | Critical | 10.0 | 2018-12-20 | autopsy version <= 4.9.0 contains a XML External Entity (XXE) vulnerability in CaseMetadata XML Parser that can result in Disclosure of confidential data, deni… |
CVE-2018-1000837 | Critical | 10.0 | 2018-12-20 | UML Designer version <= 8.0.0 contains a XML External Entity (XXE) vulnerability in XML parser for plugins that can result in Disclosure of confidential data… |
CVE-2018-1000836 | Critical | 9.0 | 2018-12-20 | bw-calendar-engine version <= bw-calendar-engine-3.12.0 contains a XML External Entity (XXE) vulnerability in IscheduleClient XML Parser that can result in Dis… |
CVE-2018-1000835 | Critical | 10.0 | 2018-12-20 | KeePassDX version <= 2.5.0.0beta17 contains a XML External Entity (XXE) vulnerability in kdbx file parser that can result in Disclosure of confidential data, d… |
CVE-2018-1000834 | Critical | 9.0 | 2018-12-20 | runelite version <= runelite-parent-1.4.23 contains a XML External Entity (XXE) vulnerability in Man in the middle runscape services call that can result in Di… |
CVE-2018-1000833 | Critical | 9.8 | 2018-12-20 | ZoneMinder version <= 1.32.2 contains a Other/Unknown vulnerability in User-controlled parameter that can result in Disclosure of confidential data, denial of… |
CVE-2018-1000832 | Critical | 9.8 | 2018-12-20 | ZoneMinder version <= 1.32.2 contains a Other/Unknown vulnerability in User-controlled parameter that can result in Disclosure of confidential data, denial of… |
CVE-2018-1000831 | Critical | 10.0 | 2018-12-20 | K9Mail version <= v5.600 contains a XML External Entity (XXE) vulnerability in WebDAV response parser that can result in Disclosure of confidential data, denia… |
CVE-2018-1000830 | Critical | 10.0 | 2018-12-20 | XR3Player version <= V3.124 contains a XML External Entity (XXE) vulnerability in Playlist parser that can result in Disclosure of confidential data, denial of… |
CVE-2018-1000829 | Critical | 9.0 | 2018-12-20 | Anyplace version before commit 80359b4 contains a XML External Entity (XXE) vulnerability in Man in the middle on map API call that can result in Disclosure of… |
CVE-2018-1000828 | Critical | 9.0 | 2018-12-20 | FrostWire version <= frostwire-desktop-6.7.4-build-272 contains a XML External Entity (XXE) vulnerability in Man in the middle on update that can result in Dis… |
CVE-2018-1000827 | Critical | 9.8 | 2018-12-20 | Ubilling version <= 0.9.2 contains a Other/Unknown vulnerability in user-controlled parameter that can result in Disclosure of confidential data, denial of ser… |
CVE-2018-1000826 | Medium | 6.1 | 2018-12-20 | Microweber version <= 1.0.7 contains a Cross Site Scripting (XSS) vulnerability in Admin login form template that can result in Execution of JavaScript code. |
CVE-2018-1000825 | Critical | 10.0 | 2018-12-20 | FreeCol version <= nightly-2018-08-22 contains a XML External Entity (XXE) vulnerability in FreeColXMLReader parser that can result in Disclosure of confidenti… |
CVE-2018-1000824 | Critical | 9.8 | 2018-12-20 | MegaMek version < v0.45.1 contains a Other/Unknown vulnerability in Object Stream Connection that can result in Disclosure of confidential data, denial of serv… |
CVE-2018-1000823 | Critical | 10.0 | 2018-12-20 | exist version <= 5.0.0-RC4 contains a XML External Entity (XXE) vulnerability in XML Parser for REST Server that can result in Disclosure of confidential data… |
CVE-2018-1000822 | Critical | 10.0 | 2018-12-20 | codelibs fess version before commit faa265b contains a XML External Entity (XXE) vulnerability in GSA XML file parser that can result in Disclosure of confiden… |
CVE-2018-1000821 | Critical | 10.0 | 2018-12-20 | MicroMathematics version before commit 5c05ac8 contains a XML External Entity (XXE) vulnerability in SMathStudio files that can result in Disclosure of confide… |
CVE-2018-1000820 | Critical | 10.0 | 2018-12-20 | neo4j-contrib neo4j-apoc-procedures version before commit 45bc09c contains a XML External Entity (XXE) vulnerability in XML Parser that can result in Disclosur… |
CVE-2018-1000817 | High | 7.5 | 2018-12-20 | Asset Pipeline Grails Plugin Asset-pipeline plugin version Prior to 2.14.1.1, 2.15.1 and 3.0.6 contains a Incorrect Access Control vulnerability in Application… |
CVE-2018-1000816 | Medium | 5.4 | 2018-12-20 | Grafana version confirmed for 5.2.4 and 5.3.0 contains a Cross Site Scripting (XSS) vulnerability in Influxdb and Graphite query editor that can result in Runn… |
CVE-2018-1000815 | Medium | 4.3 | 2018-12-20 | Brave Software Inc. Brave version version 0.22.810 to 0.24.0 contains a Other/Unknown vulnerability in function ContentSettingsObserver::AllowScript() in conte… |
CVE-2018-1000814 | Medium | 6.5 | 2018-12-20 | aio-libs aiohttp-session version 2.6.0 and earlier contains a Other/Unknown vulnerability in EncryptedCookieStorage and NaClCookieStorage that can result in No… |
CVE-2018-1000813 | Medium | 4.8 | 2018-12-20 | Backdrop CMS version 1.11.0 and earlier contains a Cross Site Scripting (XSS) vulnerability in Sanitization of custom class names used on blocks and layouts. t… |
CVE-2018-1000812 | High | 8.1 | 2018-12-20 | Artica Integria IMS version 5.0 MR56 Package 58, likely earlier versions contains a CWE-640: Weak Password Recovery Mechanism for Forgotten Password vulnerabil… |
CVE-2018-1000811 | High | 8.8 | 2018-12-20 | bludit version 3.0.0 contains a Unrestricted Upload of File with Dangerous Type vulnerability in Content Upload in Pages Editor that can result in Remote Comma… |
CVE-2018-7365 | Medium | 5.1 | 2018-12-20 | All versions up to ZXCLOUD iRAI V5.01.05 of the ZTE uSmartView product are impacted by untrusted search path vulnerability, which may allow an unauthorized use… |
CVE-2018-5200 | High | 7.8 | 2018-12-20 | KMPlayer 4.2.2.15 and earlier have a Heap Based Buffer Overflow Vulnerability. It could be exploited with a crafted FLV format file. The problem is that more f… |
CVE-2018-5199 | High | 8.8 | 2018-12-20 | In Veraport G3 ALL on MacOS, due to insufficient domain validation, It is possible to overwrite installation file to malicious file. A remote unauthenticated a… |
CVE-2018-5198 | High | 8.1 | 2018-12-20 | In Veraport G3 ALL on MacOS, a race condition when calling the Veraport API allow remote attacker to cause arbitrary file download and execution. This results… |
CVE-2018-1973 | High | 7.2 | 2018-12-20 | IBM API Connect 5.0.0.0 through 5.0.8.4 allows a user with limited 'API Administrator level access to give themselves full 'Administrator' level access through… |
CVE-2018-1784 | High | 7.1 | 2018-12-20 | IBM API Connect 5.0.0.0 and 5.0.8.4 is affected by a NoSQL Injection in MongoDB connector for the LoopBack framework. IBM X-Force ID: 148807. |
CVE-2018-1778 | High | 7.7 | 2018-12-20 | IBM LoopBack (IBM API Connect 2018.1, 2018.4.1, 5.0.8.0, and 5.0.8.4) could allow an attacker to bypass authentication if the AccessToken Model is exposed over… |
CVE-2018-1771 | High | 8.4 | 2018-12-20 | IBM Domino 9.0 and 9.0.1 could allow an attacker to execute commands on the system by triggering a buffer overflow in the parsing of command line arguments pas… |
CVE-2018-1677 | Medium | 5.1 | 2018-12-20 | IBM DataPower Gateways 7.1, 7.2, 7.5, 7.5.1, 7.5.2, 7.6, and 7.7 and IBM MQ Appliance are vulnerable to a denial of service, caused by the improper handling of… |
CVE-2018-1661 | Medium | 6.5 | 2018-12-20 | IBM DataPower Gateways 7.5, 7.5.1, 7.5.2, and 7.6 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthoriz… |
CVE-2018-8653 | High | 7.5 | 2018-12-20 | A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "Scripting Engine Memory… |
CVE-2018-6669 | Medium | 6.3 | 2018-12-20 | A whitelist bypass vulnerability in McAfee Application Control / Change Control 7.0.1 and before allows a remote or local user to execute blacklisted files thr… |
CVE-2018-20307 | Medium | 4.3 | 2018-12-20 | Pulse Secure Virtual Traffic Manager 9.9 versions prior to 9.9r2 and 10.4r1 allow a remote authenticated user to obtain sensitive historical activity informati… |
CVE-2018-20306 | Medium | 5.4 | 2018-12-20 | A stored cross-site scripting (XSS) vulnerability in the web administration user interface of Pulse Secure Virtual Traffic Manager may allow a remote authentic… |
CVE-2018-20301 | Medium | 6.5 | 2018-12-20 | An issue was discovered in Steve Pallen Coherence before 0.5.2 that is similar to a Mass Assignment vulnerability. In particular, "registration" endpoints (e.g… |
CVE-2018-20305 | Critical | 9.8 | 2018-12-20 | D-Link DIR-816 A2 1.10 B05 devices allow arbitrary remote code execution without authentication via the newpass parameter. In the /goform/form2userconfig.cgi h… |
CVE-2018-20304 | Medium | 6.5 | 2018-12-20 | wbook_addworksheet in workbook.c in libexcel.a in libexcel 0.01 allows attackers to cause a denial of service (SEGV) via a long second argument. NOTE: this is… |
CVE-2018-20303 | High | 7.5 | 2018-12-20 | In pkg/tool/path.go in Gogs before 0.11.82.1218, a directory traversal in the file-upload functionality can allow an attacker to create a file under data/sessi… |
CVE-2018-20302 | Medium | 6.1 | 2018-12-20 | An XSS issue was discovered in Steve Pallen Xain before 0.6.2 via the order parameter. |
CVE-2018-20300 | Critical | 9.8 | 2018-12-20 | Empire CMS 7.5 allows remote attackers to execute arbitrary PHP code via the ftemp parameter in an enews=EditMemberForm action because this code is injected in… |