2018 CVEs (page 47)
Page 47 of 162 — CVEs published in 2018, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2018-19881 | Medium | 5.5 | 2018-12-06 | In Artifex MuPDF 1.14.0, svg/svg-run.c allows remote attackers to cause a denial of service (recursive calls followed by a fitz/xml.c fz_xml_att crash from exc… |
CVE-2018-19754 | High | 8.8 | 2018-12-05 | Tarantella Enterprise before 3.11 allows bypassing Access Control. |
CVE-2018-19753 | High | 7.5 | 2018-12-05 | Tarantella Enterprise before 3.11 allows Directory Traversal. |
CVE-2018-19650 | High | 7.8 | 2018-12-05 | Local attackers can trigger a stack-based buffer overflow on vulnerable installations of Antiy-AVL ATool security management v1.0.0.22. An attacker must first… |
CVE-2018-19608 | Medium | 4.7 | 2018-12-05 | Arm Mbed TLS before 2.14.1, before 2.7.8, and before 2.1.17 allows a local unprivileged attacker to recover the plaintext of RSA decryption, which is used in R… |
CVE-2018-18312 | Critical | 9.8 | 2018-12-05 | Perl before 5.26.3 and 5.28.0 before 5.28.1 has a buffer overflow via a crafted regular expression that triggers invalid write operations. |
CVE-2018-16792 | Critical | 9.1 | 2018-12-05 | SolarWinds SFTP/SCP server through 2018-09-10 is vulnerable to XXE via a world readable and writable configuration file that allows an attacker to exfiltrate d… |
CVE-2018-16791 | Critical | 9.8 | 2018-12-05 | In SolarWinds SFTP/SCP Server through 2018-09-10, the configuration file is world readable and writable, and stores user passwords in an insecure manner, allow… |
CVE-2018-19877 | Medium | 6.1 | 2018-12-05 | login.php in Adiscon LogAnalyzer before 4.1.7 has XSS via the Login Button Referer field. |
CVE-2018-12155 | Medium | 5.5 | 2018-12-05 | Data leakage in cryptographic libraries for Intel IPP before 2019 update1 release may allow an authenticated user to potentially enable information disclosure… |
CVE-2018-1002105 | Critical | 9.8 | 2018-12-05 | In all Kubernetes versions prior to v1.10.11, v1.11.5, and v1.12.3, incorrect handling of error responses to proxied upgrade requests in the kube-apiserver all… |
CVE-2018-1002103 | High | 8.1 | 2018-12-05 | In Minikube versions 0.3.0-0.29.0, minikube exposes the Kubernetes Dashboard listening on the VM IP at port 30000. In VM environments where the IP is easy to p… |
CVE-2018-1002101 | Medium | 5.9 | 2018-12-05 | In Kubernetes versions 1.9.0-1.9.9, 1.10.0-1.10.5, and 1.11.0-1.11.1, user input was handled insecurely while setting up volume mounts on Windows nodes, which… |
CVE-2018-19876 | Medium | 6.5 | 2018-12-05 | cairo 1.16.0, in cairo_ft_apply_variations() in cairo-ft-font.c, would free memory using a free function incompatible with WebKit's fastMalloc, leading to an a… |
CVE-2018-15797 | High | 8.4 | 2018-12-05 | Cloud Foundry NFS volume release, 1.2.x prior to 1.2.5, 1.5.x prior to 1.5.4, 1.7.x prior to 1.7.3, logs the cf admin username and password when running the nf… |
CVE-2018-15773 | Medium | 4.3 | 2018-12-05 | Dell Encryption (formerly Dell Data Protection | Encryption) v10.1.0 and earlier contain an information disclosure vulnerability. A malicious user with physica… |
CVE-2018-1941 | High | 8.4 | 2018-12-05 | IBM Campaign 9.1.0 and 9.1.2 could allow a local user to obtain admini privileges due to the application not validating access permissions. IBM X-Force ID: 153… |
CVE-2018-1732 | Medium | 5.3 | 2018-12-05 | IBM QRadar Advisor with Watson 1.14.0 discloses sensitive information to unauthorized users. The information can be used to mount further attacks on the system… |
CVE-2018-1730 | High | 7.1 | 2018-12-05 | IBM QRadar SIEM 7.2 and 7.3 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulner… |
CVE-2018-1728 | Medium | 5.4 | 2018-12-05 | IBM QRadar SIEM 7.2 and 7.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus alteri… |
CVE-2018-1697 | Medium | 4.3 | 2018-12-05 | IBM Maximo Asset Management 7.6 could allow an authenticated user to enumerate usernames using a specially crafted HTTP request. IBM X-Force ID: 145966. |
CVE-2018-1650 | Medium | 5.9 | 2018-12-05 | IBM QRadar SIEM 7.2 and 7.3 uses hard-coded credentials which could allow an attacker to bypass the authentication configured by the administrator. IBM X-Force… |
CVE-2018-1648 | High | 7.5 | 2018-12-05 | IBM QRadar SIEM 7.2 and 7.3 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Forc… |
CVE-2018-1568 | Medium | 4.0 | 2018-12-05 | IBM QRadar SIEM 7.2 and 7.3 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 143118. |
CVE-2018-19865 | High | 7.5 | 2018-12-05 | A keystroke logging issue was discovered in Virtual Keyboard in Qt 5.7.x, 5.8.x, 5.9.x, 5.10.x, and 5.11.x before 5.11.3. |
CVE-2018-19864 | Critical | 9.8 | 2018-12-05 | NUUO NVRmini2 Network Video Recorder firmware through 3.9.1 allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow), r… |
CVE-2018-19859 | Medium | 6.5 | 2018-12-05 | OpenRefine before 3.2 beta allows directory traversal via a relative pathname in a ZIP archive. |
CVE-2018-19857 | Critical | 9.1 | 2018-12-05 | The CAF demuxer in modules/demux/caf.c in VideoLAN VLC media player 3.0.4 may read memory from an uninitialized pointer when processing magic cookies in CAF fi… |
CVE-2018-19786 | High | 8.1 | 2018-12-05 | HashiCorp Vault before 1.0.0 writes the master key to the server log in certain unusual or misconfigured scenarios in which incorrect data comes from the autos… |
CVE-2018-18843 | Critical | 10.0 | 2018-12-04 | The Kubernetes integration in GitLab Enterprise Edition 11.x before 11.2.8, 11.3.x before 11.3.9, and 11.4.x before 11.4.4 has SSRF. |
CVE-2018-18648 | High | 7.5 | 2018-12-04 | An issue was discovered in GitLab Community and Enterprise Edition before 11.2.7, 11.3.x before 11.3.8, and 11.4.x before 11.4.3. It has Information Exposure T… |
CVE-2018-18647 | Medium | 6.5 | 2018-12-04 | An issue was discovered in GitLab Community and Enterprise Edition before 11.2.7, 11.3.x before 11.3.8, and 11.4.x before 11.4.3. It has Missing Authorization. |
CVE-2018-18646 | High | 8.8 | 2018-12-04 | An issue was discovered in GitLab Community and Enterprise Edition before 11.2.7, 11.3.x before 11.3.8, and 11.4.x before 11.4.3. It allows SSRF. |
CVE-2018-18645 | Medium | 4.3 | 2018-12-04 | An issue was discovered in GitLab Community and Enterprise Edition before 11.2.7, 11.3.x before 11.3.8, and 11.4.x before 11.4.3. It allows for Information Exp… |
CVE-2018-18644 | Medium | 6.5 | 2018-12-04 | An issue was discovered in GitLab Community and Enterprise Edition 11.x before 11.2.7, 11.3.x before 11.3.8, and 11.4.x before 11.4.3. It allows Information Ex… |
CVE-2018-18642 | Medium | 6.1 | 2018-12-04 | An issue was discovered in GitLab Community and Enterprise Edition before 11.2.7, 11.3.x before 11.3.8, and 11.4.x before 11.4.3. It has XSS. |
CVE-2018-18641 | Critical | 9.8 | 2018-12-04 | An issue was discovered in GitLab Community and Enterprise Edition before 11.2.7, 11.3.x before 11.3.8, and 11.4.x before 11.4.3. It has Cleartext Storage of S… |
CVE-2018-18640 | Medium | 6.5 | 2018-12-04 | An issue was discovered in GitLab Community and Enterprise Edition before 11.2.7, 11.3.x before 11.3.8, and 11.4.x before 11.4.3. It has Information Exposure T… |
CVE-2018-17976 | Medium | 6.5 | 2018-12-04 | An issue was discovered in GitLab Community Edition 11.x before 11.1.8, 11.2.x before 11.2.5, and 11.3.x before 11.3.2. There is Information Exposure via Epic… |
CVE-2018-17975 | Medium | 5.3 | 2018-12-04 | An issue was discovered in GitLab Community Edition 11.x before 11.1.8, 11.2.x before 11.2.5, and 11.3.x before 11.3.2. There is Information Exposure via the G… |
CVE-2018-17939 | High | 7.5 | 2018-12-04 | An issue was discovered in GitLab Community and Enterprise Edition 11.1.x before 11.1.8, 11.2.x before 11.2.5, and 11.3.x before 11.3.2. There is Information E… |
CVE-2018-18993 | High | 7.8 | 2018-12-04 | Two stack-based buffer overflow vulnerabilities have been discovered in CX-One Versions 4.42 and prior (CX-Programmer Versions 9.66 and prior and CX-Server Ver… |
CVE-2018-18989 | High | 7.8 | 2018-12-04 | In CX-One Versions 4.42 and prior (CX-Programmer Versions 9.66 and prior and CX-Server Versions 5.0.23 and prior), when processing project files, the applicati… |
CVE-2018-18991 | Medium | 6.1 | 2018-12-04 | Reflected cross-site scripting (non-persistent) in SCADA WebServer (Versions prior to 2.03.0001) could allow an attacker to send a crafted URL that contains Ja… |
CVE-2018-17160 | Critical | 10.0 | 2018-12-04 | In FreeBSD before 11.2-STABLE(r341486) and 11.2-RELEASE-p6, insufficient bounds checking in one of the device models provided by bhyve can permit a guest opera… |
CVE-2018-5496 | Medium | 4.4 | 2018-12-04 | Data ONTAP operating in 7-Mode versions prior to 8.2.5P2 are susceptible to a vulnerability which discloses sensitive information to an unauthorized user. |
CVE-2018-7987 | Medium | 5.9 | 2018-12-04 | There is an out-of-bounds write vulnerability on Huawei P20 smartphones with versions before 8.1.0.171(C00). The software does not handle the response message… |
CVE-2018-7956 | Medium | 5.3 | 2018-12-04 | Huawei VIP App is a mobile app for Malaysia customers that purchased P20 Series, Nova 3/3i and Mate 20. There is a vulnerability in versions before 4.0.5 that… |
CVE-2018-0468 | High | 7.8 | 2018-12-04 | A vulnerability in the configuration of a local database installed as part of the Cisco Energy Management Suite (CEMS) could allow an authenticated, local atta… |
CVE-2018-6152 | Critical | 9.6 | 2018-12-04 | The implementation of the Page.downloadBehavior backend unconditionally marked downloaded files as safe, regardless of file type in Google Chrome prior to 66.0… |
CVE-2018-6116 | Medium | 6.5 | 2018-12-04 | A nullptr dereference in WebAssembly in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to potentially perform out of bounds memory access via a… |
CVE-2018-6115 | Medium | 6.5 | 2018-12-04 | Inappropriate setting of the SEE_MASK_FLAG_NO_UI flag in file downloads in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to potentially bypass… |
CVE-2018-6108 | Medium | 6.5 | 2018-12-04 | Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to perform domain spoofing via I… |
CVE-2018-6107 | Medium | 6.5 | 2018-12-04 | Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to perform domain spoofing via I… |
CVE-2018-6105 | Medium | 6.5 | 2018-12-04 | Incorrect handling of confusable characters in Omnibox in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to perform domain spoofing via IDN hom… |
CVE-2018-6104 | Medium | 6.5 | 2018-12-04 | Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to perform domain spoofing via I… |
CVE-2018-6103 | Medium | 6.5 | 2018-12-04 | A stagnant permission prompt in Prompts in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to bypass permission policy via a crafted HTML page. |
CVE-2018-6102 | Medium | 4.3 | 2018-12-04 | Missing confusable characters in Internationalization in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to spoof the contents of the Omnibox (U… |
CVE-2018-6101 | High | 7.5 | 2018-12-04 | A lack of host validation in DevTools in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to execute arbitrary code via a crafted HTML page, if t… |
CVE-2018-6099 | Medium | 6.5 | 2018-12-04 | A lack of CORS checks in Blink in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to leak limited cross-origin data via a crafted HTML page. |
CVE-2018-6098 | Medium | 6.5 | 2018-12-04 | Incorrect handling of confusable characters in URL Formatter in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to perform domain spoofing via I… |
CVE-2018-6095 | Medium | 6.5 | 2018-12-04 | Inappropriate dismissal of file picker on keyboard events in Blink in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to read local files via a… |
CVE-2018-6094 | High | 8.8 | 2018-12-04 | Inline metadata in GarbageCollection in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to potentially exploit heap corruption via a crafted HTM… |
CVE-2018-6092 | High | 8.8 | 2018-12-04 | An integer overflow on 32-bit systems in WebAssembly in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to execute arbitrary code inside a sandb… |
CVE-2018-6090 | High | 8.8 | 2018-12-04 | An integer overflow that lead to a heap buffer-overflow in Skia in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to execute arbitrary code ins… |
CVE-2018-6089 | Medium | 6.5 | 2018-12-04 | A lack of CORS checks, after a Service Worker redirected to a cross-origin PDF, in Service Worker in Google Chrome prior to 66.0.3359.117 allowed a remote atta… |
CVE-2018-6088 | High | 8.8 | 2018-12-04 | An iterator-invalidation bug in PDFium in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to execute arbitrary code inside a sandbox via a craft… |
CVE-2018-6087 | High | 8.8 | 2018-12-04 | A use-after-free in WebAssembly in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML… |
CVE-2018-6086 | High | 8.8 | 2018-12-04 | A double-eviction in the Incognito mode cache that lead to a user-after-free in Networking Disk Cache in Google Chrome prior to 66.0.3359.117 allowed a remote… |
CVE-2018-6085 | High | 8.8 | 2018-12-04 | Re-entry of a destructor in Networking Disk Cache in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to execute arbitrary code via a crafted HTM… |
CVE-2018-12319 | High | 7.5 | 2018-12-04 | Denial-of-service in the login page of ASUSTOR ADM 3.1.1 allows attackers to prevent users from signing in by placing malformed text in the title. |
CVE-2018-12318 | High | 8.8 | 2018-12-04 | Information disclosure in the SNMP settings page in ASUSTOR ADM version 3.1.1 allows attackers to obtain the SNMP password in cleartext. |
CVE-2018-12317 | High | 8.8 | 2018-12-04 | OS command injection in group.cgi in ASUSTOR ADM version 3.1.1 allows attackers to execute system commands as root by modifying the "name" POST parameter. |
CVE-2018-12316 | High | 8.8 | 2018-12-04 | OS Command Injection in upload.cgi in ASUSTOR ADM version 3.1.1 allows attackers to execute system commands by modifying the filename POST parameter. |
CVE-2018-12315 | Medium | 6.5 | 2018-12-04 | Missing verification of a password in ASUSTOR ADM version 3.1.1 allows attackers to change account passwords without entering the current password. |
CVE-2018-12314 | High | 7.5 | 2018-12-04 | Directory Traversal in downloadwallpaper.cgi in ASUSTOR ADM version 3.1.1 allows attackers to download arbitrary files by manipulating the "file" and "folder"… |
CVE-2018-12313 | Critical | 9.8 | 2018-12-04 | OS command injection in snmp.cgi in ASUSTOR ADM version 3.1.1 allows attackers to execute system commands without authentication via the "rocommunity" URL para… |
CVE-2018-12312 | High | 8.8 | 2018-12-04 | OS command injection in user.cgi in ASUSTOR ADM version 3.1.1 allows attackers to execute system commands as root via the "secret_key" URL parameter. |
CVE-2018-12311 | Medium | 5.4 | 2018-12-04 | Cross-site scripting vulnerability in File Explorer in ASUSTOR ADM version 3.1.1 allows attackers to execute arbitrary JavaScript when a file is moved via a ma… |
CVE-2018-12310 | Medium | 5.4 | 2018-12-04 | Cross-site scripting in the Login page in ASUSTOR ADM version 3.1.1 allows attackers to execute JavaScript via the System Announcement feature. |
CVE-2018-12309 | High | 7.5 | 2018-12-04 | Directory Traversal in upload.cgi in ASUSTOR ADM version 3.1.1 allows attackers to upload files to arbitrary locations by modifying the "path" URL parameter… |
CVE-2018-12308 | Medium | 6.5 | 2018-12-04 | Encryption key disclosure in share.cgi in ASUSTOR ADM version 3.1.1 allows attackers to obtain the encryption key via the "encrypt_key" URL parameter. |
CVE-2018-12307 | High | 8.8 | 2018-12-04 | OS command injection in user.cgi in ASUSTOR ADM version 3.1.1 allows attackers to execute system commands as root via the "name" POST parameter. |
CVE-2018-12306 | High | 7.5 | 2018-12-04 | Directory Traversal in File Explorer in ASUSTOR ADM version 3.1.1 allows attackers to view arbitrary files by modifying the "file1" URL parameter, a similar is… |
CVE-2018-12305 | Medium | 6.1 | 2018-12-04 | Cross-site scripting in File Explorer in ASUSTOR ADM version 3.1.1 allows attackers to execute JavaScript by uploading SVG images with embedded JavaScript. |
CVE-2018-11348 | Medium | 5.4 | 2018-12-04 | Two XSS vulnerabilities are located in the profile edition page of the user panel of the YunoHost 2.7.2 through 2.7.14 web application. By injecting a JavaScri… |
CVE-2018-11347 | High | 8.8 | 2018-12-04 | The YunoHost 2.7.2 through 2.7.14 web application is affected by one HTTP Response Header Injection. This flaw allows an attacker to inject, into the response… |
CVE-2018-19854 | Medium | 4.7 | 2018-12-04 | An issue was discovered in the Linux kernel before 4.19.3. crypto_report_one() and related functions in crypto/crypto_user.c (the crypto user configuration API… |
CVE-2018-19591 | High | 7.5 | 2018-12-04 | In the GNU C Library (aka glibc or libc6) through 2.28, attempting to resolve a crafted hostname via getaddrinfo() leads to the allocation of a socket descript… |
CVE-2018-16634 | High | 8.8 | 2018-12-04 | Pluck v4.7.7 allows CSRF via admin.php?action=settings. |
CVE-2018-16633 | Medium | 5.4 | 2018-12-04 | Pluck v4.7.7 allows XSS via the admin.php?action=editpage&page= page title. |
CVE-2018-16631 | Medium | 5.4 | 2018-12-04 | Subrion CMS v4.2.1 allows XSS via the panel/configuration/general/ SITE TITLE parameter. |
CVE-2018-16629 | Medium | 4.8 | 2018-12-04 | panel/uploads/#elf_l1_XA in Subrion CMS v4.2.1 allows XSS via an SVG file with JavaScript in a SCRIPT element. |
CVE-2018-16628 | Medium | 5.4 | 2018-12-04 | panel/login in Kirby v2.5.12 allows XSS via a blog name. |
CVE-2018-17159 | High | 7.5 | 2018-12-04 | In FreeBSD before 11.2-STABLE(r340854) and 11.2-RELEASE-p5, the NFS server lacks a bounds check in the READDIRPLUS NFS request. Unprivileged remote users with… |
CVE-2018-17158 | High | 7.5 | 2018-12-04 | In FreeBSD before 11.2-STABLE(r340854) and 11.2-RELEASE-p5, an integer overflow error can occur when handling the client address length field in an NFSv4 reque… |
CVE-2018-17157 | Critical | 9.8 | 2018-12-04 | In FreeBSD before 11.2-STABLE(r340854) and 11.2-RELEASE-p5, an integer overflow error when handling opcodes can cause memory corruption by sending a specially… |
CVE-2018-6982 | Medium | 6.5 | 2018-12-04 | VMware ESXi 6.7 without ESXi670-201811401-BG and VMware ESXi 6.5 without ESXi650-201811301-BG contain uninitialized stack memory usage in the vmxnet3 virtual n… |
CVE-2018-6981 | High | 8.8 | 2018-12-04 | VMware ESXi 6.7 without ESXi670-201811401-BG and VMware ESXi 6.5 without ESXi650-201811301-BG, VMware ESXi 6.0 without ESXi600-201811401-BG, VMware Workstation… |
CVE-2018-16478 | Medium | 5.3 | 2018-12-04 | A Path Traversal in simplehttpserver versions <=0.2.1 allows to list any file in another folder of web root. |