2018 CVEs (page 54)
Page 54 of 162 — CVEs published in 2018, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2018-6061 | High | 7.5 | 2018-11-14 | A race in the handling of SharedArrayBuffers in WebAssembly in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to potentially exploit heap corru… |
CVE-2018-6060 | High | 8.8 | 2018-11-14 | Use after free in WebAudio in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2018-6057 | High | 8.8 | 2018-11-14 | Lack of special casing of Android ashmem in Google Chrome prior to 65.0.3325.146 allowed a remote attacker who had compromised the renderer process to bypass i… |
CVE-2018-17477 | Medium | 4.3 | 2018-11-14 | Incorrect dialog placement in Extensions in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to spoof the contents of extension popups via a craft… |
CVE-2018-17476 | Medium | 4.3 | 2018-11-14 | Incorrect dialog placement in Cast UI in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to obscure the full screen warning via a crafted HTML pa… |
CVE-2018-17475 | Medium | 4.3 | 2018-11-14 | Incorrect handling of history on iOS in Navigation in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to spoof the contents of the Omnibox (URL b… |
CVE-2018-17474 | High | 8.8 | 2018-11-14 | Use after free in HTMLImportsController in Blink in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to potentially exploit heap corruption via a… |
CVE-2018-17473 | Medium | 4.3 | 2018-11-14 | Incorrect handling of confusable characters in Omnibox in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to spoof the contents of the Omnibox (U… |
CVE-2018-17472 | Critical | 9.6 | 2018-11-14 | Incorrect handling of googlechrome:// URL scheme on iOS in Intents in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to escape the <iframe> sand… |
CVE-2018-17471 | Medium | 4.3 | 2018-11-14 | Incorrect dialog placement in WebContents in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to obscure the full screen warning via a crafted HTM… |
CVE-2018-17469 | High | 8.8 | 2018-11-14 | Incorrect handling of PDF filter chains in PDFium in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to perform an out of bounds memory read via… |
CVE-2018-17468 | Medium | 6.5 | 2018-11-14 | Incorrect handling of timer information during navigation in Blink in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to obtain cross origin URLs… |
CVE-2018-17467 | Medium | 4.3 | 2018-11-14 | Insufficiently quick clearing of stale rendered content in Navigation in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to spoof the contents of… |
CVE-2018-17466 | High | 8.8 | 2018-11-14 | Incorrect texture handling in Angle in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML… |
CVE-2018-17465 | High | 8.8 | 2018-11-14 | Incorrect implementation of object trimming in V8 in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to potentially exploit object corruption via… |
CVE-2018-17464 | Medium | 4.3 | 2018-11-14 | Incorrect handling of history on iOS in Navigation in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to spoof the contents of the Omnibox (URL b… |
CVE-2018-17463 | High | 8.8 | 2018-11-14 | Incorrect side effect annotation in V8 in Google Chrome prior to 70.0.3538.64 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafte… |
CVE-2018-17462 | Critical | 9.6 | 2018-11-14 | Incorrect refcounting in AppCache in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to perform a sandbox escape via a crafted HTML page. |
CVE-2018-3699 | Medium | 6.1 | 2018-11-14 | Cross-site scripting in the Intel RAID Web Console v3 for Windows may allow an unauthenticated user to elevate privilege via remote access. |
CVE-2018-3698 | High | 7.8 | 2018-11-14 | Improper file permissions in the installer for the Intel Ready Mode Technology may allow an unprivileged user to potentially gain privileged access via local a… |
CVE-2018-3697 | High | 7.8 | 2018-11-14 | Improper directory permissions in the installer for the Intel Media Server Studio may allow unprivileged users to potentially enable an escalation of privilege… |
CVE-2018-3696 | Medium | 5.5 | 2018-11-14 | Authentication bypass in the Intel RAID Web Console 3 for Windows before 4.186 may allow an unprivileged user to potentially gain administrative privileges via… |
CVE-2018-3635 | High | 7.8 | 2018-11-14 | Insufficient input validation in installer in Intel Rapid Store Technology (RST) before version 16.7 may allow an unprivileged user to potentially elevate priv… |
CVE-2018-3621 | Medium | 6.5 | 2018-11-14 | Insufficient input validation in the Intel Driver & Support Assistant before 3.6.0.4 may allow an unauthenticated user to potentially enable information disclo… |
CVE-2018-12174 | High | 7.8 | 2018-11-14 | Heap overflow in Intel Trace Analyzer 2018 in Intel Parallel Studio XE 2018 Update 3 may allow an authenticated user to potentially escalate privileges via loc… |
CVE-2018-19277 | High | 8.8 | 2018-11-14 | securityScan() in PHPOffice PhpSpreadsheet through 1.5.0 allows a bypass of protection mechanisms for XXE via UTF-7 encoding in a .xlsx file |
CVE-2018-19271 | High | 8.8 | 2018-11-14 | Centreon 3.4.x (fixed in Centreon 18.10.0 and Centreon web 2.8.28) allows SQL Injection via the main.php searchH parameter. |
CVE-2018-19190 | Medium | 6.1 | 2018-11-14 | The Amazon PAYFORT payfort-php-SDK payment gateway SDK through 2018-04-26 has XSS via the error.php error_msg parameter. |
CVE-2018-19189 | Medium | 6.1 | 2018-11-14 | The Amazon PAYFORT payfort-php-SDK payment gateway SDK through 2018-04-26 has XSS via an arbitrary parameter name or value that is mishandled in an error.php e… |
CVE-2018-19188 | Medium | 6.1 | 2018-11-14 | The Amazon PAYFORT payfort-php-SDK payment gateway SDK through 2018-04-26 has XSS via the success.php fort_id parameter. |
CVE-2018-19187 | Medium | 6.1 | 2018-11-14 | The Amazon PAYFORT payfort-php-SDK payment gateway SDK through 2018-04-26 has XSS via an arbitrary parameter name or value that is mishandled in a success.php… |
CVE-2018-19186 | Medium | 6.1 | 2018-11-14 | The Amazon PAYFORT payfort-php-SDK payment gateway SDK through 2018-04-26 has XSS via the route.php paymentMethod parameter. |
CVE-2018-8609 | High | 8.8 | 2018-11-14 | A remote code execution vulnerability exists in Microsoft Dynamics 365 (on-premises) version 8 when the server fails to properly sanitize web requests to an af… |
CVE-2018-8608 | Medium | 5.4 | 2018-11-14 | A cross site scripting vulnerability exists when Microsoft Dynamics 365 (on-premises) version 8 does not properly sanitize a specially crafted web request to a… |
CVE-2018-8607 | Medium | 5.4 | 2018-11-14 | A cross site scripting vulnerability exists when Microsoft Dynamics 365 (on-premises) version 8 does not properly sanitize a specially crafted web request to a… |
CVE-2018-8606 | Medium | 5.4 | 2018-11-14 | A cross site scripting vulnerability exists when Microsoft Dynamics 365 (on-premises) version 8 does not properly sanitize a specially crafted web request to a… |
CVE-2018-8605 | Medium | 5.4 | 2018-11-14 | A cross site scripting vulnerability exists when Microsoft Dynamics 365 (on-premises) version 8 does not properly sanitize a specially crafted web request to a… |
CVE-2018-8602 | Medium | 5.4 | 2018-11-14 | A Cross-site Scripting (XSS) vulnerability exists when Team Foundation Server does not properly sanitize user provided input, aka "Team Foundation Server Cross… |
CVE-2018-8600 | Medium | 6.1 | 2018-11-14 | A Cross-site Scripting (XSS) vulnerability exists when Azure App Services on Azure Stack does not properly sanitize user provided input, aka "Azure App Service… |
CVE-2018-8592 | Medium | 6.4 | 2018-11-14 | An elevation of privilege vulnerability exists in Windows 10 version 1809 when installed from physical media (USB, DVD, etc, aka "Windows Elevation Of Privileg… |
CVE-2018-8589 | High | 7.8 | 2018-11-14 | An elevation of privilege vulnerability exists when Windows improperly handles calls to Win32k.sys, aka "Windows Win32k Elevation of Privilege Vulnerability."… |
CVE-2018-8588 | High | 7.5 | 2018-11-14 | A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Eng… |
CVE-2018-8584 | High | 7.8 | 2018-11-14 | An elevation of privilege vulnerability exists when Windows improperly handles calls to Advanced Local Procedure Call (ALPC), aka "Windows ALPC Elevation of Pr… |
CVE-2018-8582 | High | 8.8 | 2018-11-14 | A remote code execution vulnerability exists in the way that Microsoft Outlook parses specially modified rule export files, aka "Microsoft Outlook Remote Code… |
CVE-2018-8581 | High | 7.4 | 2018-11-14 | An elevation of privilege vulnerability exists in Microsoft Exchange Server, aka "Microsoft Exchange Server Elevation of Privilege Vulnerability." This affects… |
CVE-2018-8579 | Medium | 6.5 | 2018-11-14 | An information disclosure vulnerability exists when attaching files to Outlook messages, aka "Microsoft Outlook Information Disclosure Vulnerability." This aff… |
CVE-2018-8578 | Medium | 4.3 | 2018-11-14 | An information disclosure vulnerability exists when Microsoft SharePoint Server improperly discloses its folder structure when rendering specific web pages, ak… |
CVE-2018-8577 | High | 7.8 | 2018-11-14 | A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka "Microsoft Excel Rem… |
CVE-2018-8576 | High | 7.8 | 2018-11-14 | A remote code execution vulnerability exists in Microsoft Outlook software when it fails to properly handle objects in memory, aka "Microsoft Outlook Remote Co… |
CVE-2018-8575 | High | 7.8 | 2018-11-14 | A remote code execution vulnerability exists in Microsoft Project software when it fails to properly handle objects in memory, aka "Microsoft Project Remote Co… |
CVE-2018-8574 | High | 7.8 | 2018-11-14 | A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka "Microsoft Excel Rem… |
CVE-2018-8573 | High | 7.8 | 2018-11-14 | A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory, aka "Microsoft Word Remote Code Exe… |
CVE-2018-8572 | Medium | 5.4 | 2018-11-14 | An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected Share… |
CVE-2018-8570 | High | 7.5 | 2018-11-14 | A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, aka "Internet Explorer Memory Corruption Vulnerabili… |
CVE-2018-8568 | Medium | 5.4 | 2018-11-14 | An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected Share… |
CVE-2018-8567 | Medium | 5.4 | 2018-11-14 | An elevation of privilege vulnerability exists when Microsoft Edge does not properly enforce cross-domain policies, which could allow an attacker to access inf… |
CVE-2018-8566 | Medium | 4.6 | 2018-11-14 | A security feature bypass vulnerability exists when Windows improperly suspends BitLocker Device Encryption, aka "BitLocker Security Feature Bypass Vulnerabili… |
CVE-2018-8565 | Medium | 5.5 | 2018-11-14 | An information disclosure vulnerability exists when the win32k component improperly provides kernel information, aka "Win32k Information Disclosure Vulnerabili… |
CVE-2018-8564 | Medium | 4.3 | 2018-11-14 | A spoofing vulnerability exists when Microsoft Edge improperly handles specific HTML content, aka "Microsoft Edge Spoofing Vulnerability." This affects Microso… |
CVE-2018-8563 | Medium | 5.5 | 2018-11-14 | An information disclosure vulnerability exists when DirectX improperly handles objects in memory, aka "DirectX Information Disclosure Vulnerability." This affe… |
CVE-2018-8562 | High | 7.8 | 2018-11-14 | An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka "Win32k Elevation of Privil… |
CVE-2018-8561 | High | 7.8 | 2018-11-14 | An elevation of privilege vulnerability exists when DirectX improperly handles objects in memory, aka "DirectX Elevation of Privilege Vulnerability." This affe… |
CVE-2018-8558 | Medium | 6.5 | 2018-11-14 | An information disclosure vulnerability exists when Microsoft Outlook fails to respect "Default link type" settings configured via the SharePoint Online Admin… |
CVE-2018-8557 | High | 7.5 | 2018-11-14 | A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Eng… |
CVE-2018-8556 | High | 7.5 | 2018-11-14 | A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Eng… |
CVE-2018-8555 | High | 7.5 | 2018-11-14 | A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Eng… |
CVE-2018-8554 | High | 7.8 | 2018-11-14 | An elevation of privilege vulnerability exists when DirectX improperly handles objects in memory, aka "DirectX Elevation of Privilege Vulnerability." This affe… |
CVE-2018-8553 | High | 7.8 | 2018-11-14 | A remote code execution vulnerability exists in the way that Microsoft Graphics Components handle objects in memory, aka "Microsoft Graphics Components Remote… |
CVE-2018-8552 | High | 7.5 | 2018-11-14 | An information disclosure vulnerability exists when VBScript improperly discloses the contents of its memory, which could provide an attacker with information… |
CVE-2018-8551 | High | 7.5 | 2018-11-14 | A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Eng… |
CVE-2018-8550 | High | 7.8 | 2018-11-14 | An elevation of privilege exists in Windows COM Aggregate Marshaler, aka "Windows COM Elevation of Privilege Vulnerability." This affects Windows 7, Windows Se… |
CVE-2018-8549 | Medium | 5.5 | 2018-11-14 | A security feature bypass exists when Windows incorrectly validates kernel driver signatures, aka "Windows Security Feature Bypass Vulnerability." This affects… |
CVE-2018-8547 | Medium | 5.4 | 2018-11-14 | A cross-site-scripting (XSS) vulnerability exists when an open source customization for Microsoft Active Directory Federation Services (AD FS) does not properl… |
CVE-2018-8546 | Medium | 5.9 | 2018-11-14 | A denial of service vulnerability exists in Skype for Business, aka "Microsoft Skype for Business Denial of Service Vulnerability." This affects Office 365 Pro… |
CVE-2018-8545 | Medium | 4.3 | 2018-11-14 | An information disclosure vulnerability exists in the way that Microsoft Edge handles cross-origin requests, aka "Microsoft Edge Information Disclosure Vulnera… |
CVE-2018-8544 | High | 8.8 | 2018-11-14 | A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka "Windows VBScript Engine Remote Code Execution… |
CVE-2018-8543 | High | 7.5 | 2018-11-14 | A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Eng… |
CVE-2018-8542 | High | 7.5 | 2018-11-14 | A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Eng… |
CVE-2018-8541 | High | 7.5 | 2018-11-14 | A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Eng… |
CVE-2018-8539 | High | 7.8 | 2018-11-14 | A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory, aka "Microsoft Word Remote Code Exe… |
CVE-2018-8524 | High | 7.8 | 2018-11-14 | A remote code execution vulnerability exists in Microsoft Outlook software when it fails to properly handle objects in memory, aka "Microsoft Outlook Remote Co… |
CVE-2018-8522 | High | 7.8 | 2018-11-14 | A remote code execution vulnerability exists in Microsoft Outlook software when it fails to properly handle objects in memory, aka "Microsoft Outlook Remote Co… |
CVE-2018-8485 | High | 7.8 | 2018-11-14 | An elevation of privilege vulnerability exists when DirectX improperly handles objects in memory, aka "DirectX Elevation of Privilege Vulnerability." This affe… |
CVE-2018-8476 | Critical | 9.8 | 2018-11-14 | A remote code execution vulnerability exists in the way that Windows Deployment Services TFTP Server handles objects in memory, aka "Windows Deployment Service… |
CVE-2018-8471 | High | 7.8 | 2018-11-14 | An elevation of privilege vulnerability exists in the way that the Microsoft RemoteFX Virtual GPU miniport driver handles objects in memory, aka "Microsoft Rem… |
CVE-2018-8454 | Medium | 5.5 | 2018-11-14 | An information disclosure vulnerability exists when Windows Audio Service fails to properly handle objects in memory, aka "Windows Audio Service Information Di… |
CVE-2018-8450 | High | 8.8 | 2018-11-14 | A remote code execution vulnerability exists when Windows Search handles objects in memory, aka "Windows Search Remote Code Execution Vulnerability." This affe… |
CVE-2018-8417 | Medium | 5.3 | 2018-11-14 | A security feature bypass vulnerability exists in Microsoft JScript that could allow an attacker to bypass Device Guard, aka "Microsoft JScript Security Featur… |
CVE-2018-8416 | Medium | 6.5 | 2018-11-14 | A tampering vulnerability exists when .NET Core improperly handles specially crafted files, aka ".NET Core Tampering Vulnerability." This affects .NET Core 2.1. |
CVE-2018-8415 | High | 7.8 | 2018-11-14 | A tampering vulnerability exists in PowerShell that could allow an attacker to execute unlogged code, aka "Microsoft PowerShell Tampering Vulnerability." This… |
CVE-2018-8408 | Medium | 5.5 | 2018-11-14 | An information disclosure vulnerability exists when the Windows kernel improperly initializes objects in memory, aka "Windows Kernel Information Disclosure Vul… |
CVE-2018-8407 | Medium | 5.5 | 2018-11-14 | An information disclosure vulnerability exists when "Kernel Remote Procedure Call Provider" driver improperly initializes objects in memory, aka "MSRPC Informa… |
CVE-2018-8256 | High | 8.8 | 2018-11-14 | A remote code execution vulnerability exists when PowerShell improperly handles specially crafted files, aka "Microsoft PowerShell Remote Code Execution Vulner… |
CVE-2018-16471 | Medium | 6.1 | 2018-11-13 | There is a possible XSS vulnerability in Rack before 2.0.6 and 1.6.11. Carefully crafted requests can impact the data returned by the `scheme` method on `Rack… |
CVE-2018-16470 | High | 7.5 | 2018-11-13 | There is a possible DoS vulnerability in the multipart parser in Rack before 2.0.6. Specially crafted requests can cause the multipart parser to enter a pathol… |
CVE-2018-6980 | High | 7.2 | 2018-11-13 | VMware vRealize Log Insight (4.7.x before 4.7.1 and 4.6.x before 4.6.2) contains a vulnerability due to improper authorization in the user registration method… |
CVE-2018-8009 | High | 8.8 | 2018-11-13 | Apache Hadoop 3.1.0, 3.0.0-alpha to 3.0.2, 2.9.0 to 2.9.1, 2.8.0 to 2.8.4, 2.0.0-alpha to 2.7.6, 0.23.0 to 0.23.11 is exploitable via the zip slip vulnerabilit… |
CVE-2018-17614 | High | 8.8 | 2018-11-13 | This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Losant Arduino MQTT Client prior to V2.7. User interaction… |
CVE-2018-2491 | High | 7.8 | 2018-11-13 | When opening a deep link URL in SAP Fiori Client with log level set to "Debug", the client application logs the URL to the log file. If this URL contains malic… |
CVE-2018-2490 | High | 7.8 | 2018-11-13 | The broadcast messages received by SAP Fiori Client are not protected by permissions. SAP Fiori Client version 1.11.5 in Google Play store addresses these issu… |