2018 CVEs (page 6)
Page 6 of 179 — CVEs published in 2018, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2018-25074 | Low | 3.5 | 2023-01-11 | A vulnerability was found in Prestaul skeemas and classified as problematic. This issue affects some unknown processing of the file validators/base.js. The man… |
CVE-2018-25073 | Low | 3.5 | 2023-01-11 | A vulnerability has been found in Newcomer1989 TSN-Ranksystem up to 1.2.6 and classified as problematic. This vulnerability affects the function getlog of the… |
CVE-2018-25072 | Medium | 6.3 | 2023-01-08 | A vulnerability classified as critical has been found in lojban jbovlaste. This affects an unknown part of the file dict/listing.html. The manipulation leads t… |
CVE-2018-25071 | Medium | 5.5 | 2023-01-07 | A vulnerability was found in roxlukas LMeve up to 0.1.58. It has been rated as critical. Affected by this issue is the function insert_log of the file wwwroot/… |
CVE-2018-25070 | Medium | 5.5 | 2023-01-07 | A vulnerability has been found in polterguy Phosphorus Five up to 8.2 and classified as critical. This vulnerability affects the function csv.Read of the file… |
CVE-2018-25069 | High | 7.3 | 2023-01-07 | A vulnerability classified as critical has been found in Netis Netcore Router. This affects an unknown part. The manipulation leads to use of hard-coded passwo… |
CVE-2018-25068 | Medium | 6.3 | 2023-01-06 | A vulnerability has been found in devent globalpom-utils up to 4.5.0 and classified as critical. This vulnerability affects the function createTmpDir of the fi… |
CVE-2018-25067 | Medium | 5.5 | 2023-01-06 | A vulnerability, which was classified as critical, was found in JoomGallery up to 3.3.3. This affects an unknown part of the file administrator/components/com_… |
CVE-2018-25066 | Medium | 5.5 | 2023-01-06 | A vulnerability was found in PeterMu nodebatis up to 2.1.x. It has been classified as critical. Affected is an unknown function. The manipulation leads to sql… |
CVE-2018-25065 | Low | 3.5 | 2023-01-05 | A vulnerability was found in Wikimedia mediawiki-extensions-I18nTags and classified as problematic. This issue affects some unknown processing of the file I18n… |
CVE-2018-25064 | Low | 3.5 | 2023-01-05 | A vulnerability was found in OSM Lab show-me-the-way. It has been rated as problematic. This issue affects some unknown processing of the file js/site.js. The… |
CVE-2018-25063 | Low | 3.5 | 2023-01-01 | A vulnerability classified as problematic was found in Zenoss Dashboard up to 1.3.4. Affected by this vulnerability is an unknown functionality of the file Zen… |
CVE-2018-25062 | Low | 3.5 | 2023-01-01 | A vulnerability classified as problematic has been found in flar2 ElementalX up to 6.x on Nexus 9. Affected is the function xfrm_dump_policy_done of the file n… |
CVE-2018-25061 | Medium | 4.3 | 2022-12-31 | A vulnerability was found in rgb2hex up to 0.1.5. It has been rated as problematic. This issue affects some unknown processing. The manipulation leads to ineff… |
CVE-2018-25060 | Low | 3.7 | 2022-12-30 | A vulnerability was found in Macaron csrf and classified as problematic. Affected by this issue is some unknown functionality of the file csrf.go. The manipula… |
CVE-2018-25059 | Low | 3.5 | 2022-12-30 | A vulnerability was found in pastebinit up to 0.2.2 and classified as problematic. Affected by this issue is the function pasteHandler of the file server.go. T… |
CVE-2018-25058 | Medium | 4.2 | 2022-12-29 | A vulnerability classified as problematic has been found in Twitter-Post-Fetcher up to 17.x. This affects an unknown part of the file js/twitterFetcher.js of t… |
CVE-2018-25057 | Medium | 5.5 | 2022-12-28 | A vulnerability was found in simple_php_link_shortener. It has been classified as critical. Affected is an unknown function of the file index.php. The manipula… |
CVE-2018-25056 | Low | 3.5 | 2022-12-28 | A vulnerability, which was classified as problematic, was found in yolapi. Affected is the function render_description of the file yolapi/pypi/metadata.py. The… |
CVE-2018-25055 | Low | 3.5 | 2022-12-28 | A vulnerability was found in FarCry Solr Pro Plugin up to 1.5.x. It has been declared as problematic. Affected by this vulnerability is an unknown functionalit… |
CVE-2018-25054 | Low | 3.5 | 2022-12-28 | A vulnerability was found in shred cilla. It has been classified as problematic. Affected is an unknown function of the file cilla-xample/src/main/webapp/WEB-I… |
CVE-2018-25053 | Medium | 4.3 | 2022-12-28 | A vulnerability was found in moappi Json2html up to 1.1.x and classified as problematic. This issue affects some unknown processing of the file json2html.js. T… |
CVE-2018-25052 | Low | 3.5 | 2022-12-28 | A vulnerability has been found in Catalyst-Plugin-Session up to 0.40 and classified as problematic. This vulnerability affects the function _load_sessionid of… |
CVE-2018-25051 | Low | 2.4 | 2022-12-28 | A vulnerability, which was classified as problematic, was found in JmPotato Pomash. This affects an unknown part of the file Pomash/theme/clean/templates/edito… |
CVE-2018-25050 | Low | 3.5 | 2022-12-28 | A vulnerability, which was classified as problematic, has been found in Harvest Chosen up to 1.8.6. Affected by this issue is the function AbstractChosen of th… |
CVE-2018-25046 | Critical | 9.1 | 2022-12-27 | Due to improper path sanitization, archives containing relative file paths can cause files to be written (or overwritten) outside of the target directory. |
CVE-2018-25049 | Low | 3.0 | 2022-12-27 | A vulnerability was found in email-existence. It has been rated as problematic. Affected by this issue is some unknown functionality of the file index.js. The… |
CVE-2018-16135 | Medium | 6.5 | 2022-12-26 | The Opera Mini application 47.1.2249.129326 for Android allows remote attackers to spoof the Location Permission dialog via a crafted web site. |
CVE-2018-18447 | Critical | 9.8 | 2022-10-12 | dotPDN Paint.NET before 4.1.2 allows Deserialization of Untrusted Data (issue 2 of 2). |
CVE-2018-18446 | Critical | 9.8 | 2022-10-12 | dotPDN Paint.NET before 4.1.2 allows Deserialization of Untrusted Data (issue 1 of 2). |
CVE-2018-25047 | Medium | 5.4 | 2022-09-15 | In Smarty before 3.1.47 and 4.x before 4.2.1, libs/plugins/function.mailto.php allows XSS. A web page that uses smarty_function_mailto, and that could be param… |
CVE-2018-14520 | Medium | 5.4 | 2022-08-24 | An issue was discovered in Kirby 2.5.12. The application allows malicious HTTP requests to be sent in order to trick a user into adding web pages. |
CVE-2018-14519 | Medium | 4.3 | 2022-08-24 | An issue was discovered in Kirby 2.5.12. The delete page functionality suffers from a CSRF flaw. A remote attacker can craft a malicious CSRF page and force th… |
CVE-2018-25045 | Medium | 6.1 | 2022-07-23 | Django REST framework (aka django-rest-framework) before 3.9.1 allows XSS because the default DRF Browsable API view templates disable autoescaping. |
CVE-2018-25044 | Medium | 6.3 | 2022-06-17 | A vulnerability, which was classified as critical, has been found in uTorrent. This issue affects some unknown processing of the component Guest Account. The m… |
CVE-2018-25043 | Medium | 5.0 | 2022-06-17 | A vulnerability classified as critical was found in uTorrent. This vulnerability affects unknown code of the component PRNG. The manipulation leads to weak aut… |
CVE-2018-25042 | Medium | 5.0 | 2022-06-17 | A vulnerability classified as critical has been found in uTorrent. This affects an unknown part. The manipulation leads to memory corruption. It is possible to… |
CVE-2018-25041 | Medium | 6.3 | 2022-06-17 | A vulnerability was found in uTorrent. It has been rated as critical. Affected by this issue is some unknown functionality of the component JSON RPC Server. Th… |
CVE-2018-25040 | Medium | 6.3 | 2022-06-17 | A vulnerability was found in uTorrent Web. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the component HTTP R… |
CVE-2018-18907 | High | 7.5 | 2022-06-16 | An issue was discovered on D-Link DIR-850L 1.21WW devices. A partially completed WPA handshake is sufficient for obtaining full access to the wireless network… |
CVE-2018-25039 | Low | 3.5 | 2022-06-12 | A vulnerability was found in Thomson TCW710 ST5D.10.05. It has been declared as problematic. This vulnerability affects unknown code of the file /goform/RgUrlB… |
CVE-2018-25038 | Low | 3.5 | 2022-06-12 | A vulnerability was found in Thomson TCW710 ST5D.10.05. It has been classified as problematic. This affects an unknown part of the file /goform/RgDhcp. The man… |
CVE-2018-25037 | Low | 3.5 | 2022-06-12 | A vulnerability was found in Thomson TCW710 ST5D.10.05 and classified as problematic. Affected by this issue is some unknown functionality of the file /goform/… |
CVE-2018-25036 | Low | 3.5 | 2022-06-12 | A vulnerability has been found in Thomson TCW710 ST5D.10.05 and classified as problematic. Affected by this vulnerability is an unknown functionality of the fi… |
CVE-2018-25035 | Low | 3.5 | 2022-06-12 | A vulnerability, which was classified as problematic, was found in Thomson TCW710 ST5D.10.05. Affected is an unknown function of the file /goform/RGFirewallEL… |
CVE-2018-25034 | Low | 3.5 | 2022-06-12 | A vulnerability, which was classified as problematic, has been found in Thomson TCW710 ST5D.10.05. This issue affects some unknown processing of the file /gofo… |
CVE-2018-17240 | High | 7.5 | 2022-06-10 | There is a memory dump vulnerability on Netwave IP camera devices at //proc/kcore that allows an unauthenticated attacker to exfiltrate sensitive information f… |
CVE-2018-25033 | High | 8.1 | 2022-05-08 | ADMesh through 0.98.4 has a heap-based buffer over-read in stl_update_connects_remove_1 (called from stl_remove_degenerate) in connect.c in libadmesh.a. |
CVE-2018-25030 | Low | 3.3 | 2022-03-28 | A vulnerability classified as problematic has been found in Mirmay Secure Private Browser and File Manager up to 2.5. Affected is the Auto Lock. A race conditi… |
CVE-2018-25032 | High | 7.5 | 2022-03-25 | zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches. |
CVE-2018-25031 | Medium | 4.3 | 2022-03-11 | Swagger UI 4.1.2 and earlier could allow a remote attacker to conduct spoofing attacks. By persuading a victim to open a crafted URL, an attacker could exploit… |
CVE-2018-25029 | High | 8.1 | 2022-02-04 | The Z-Wave specification requires that S2 security can be downgraded to S0 or other less secure protocols, allowing an attacker within radio range during pairi… |
CVE-2018-17875 | High | 8.8 | 2021-12-28 | A remote code execution issue in the ping command on Poly Trio 8800 5.7.1.4145 devices allows remote authenticated users to execute commands via unspecified ve… |
CVE-2018-25028 | High | 7.5 | 2021-12-27 | An issue was discovered in the libpulse-binding crate before 1.2.1 for Rust. get_context can cause a use-after-free. |
CVE-2018-25027 | High | 7.5 | 2021-12-27 | An issue was discovered in the libpulse-binding crate before 1.2.1 for Rust. get_format_info can cause a use-after-free. |
CVE-2018-25026 | Critical | 9.8 | 2021-12-27 | An issue was discovered in the actix-web crate before 0.7.15 for Rust. It can add the Send marker trait to an object that cannot be sent between threads safely… |
CVE-2018-25025 | Critical | 9.8 | 2021-12-27 | An issue was discovered in the actix-web crate before 0.7.15 for Rust. It can unsoundly extend the lifetime of a string, leading to memory corruption. |
CVE-2018-25024 | Critical | 9.8 | 2021-12-27 | An issue was discovered in the actix-web crate before 0.7.15 for Rust. It can unsoundly coerce an immutable reference into a mutable reference, leading to memo… |
CVE-2018-25023 | High | 7.5 | 2021-12-27 | An issue was discovered in the smallvec crate before 0.6.13 for Rust. It can create an uninitialized value of any type, including a reference type. |
CVE-2018-4478 | Medium | 6.8 | 2021-12-23 | A validation issue was addressed with improved logic. This issue is fixed in macOS High Sierra 10.13.5, Security Update 2018-003 Sierra, Security Update 2018-0… |
CVE-2018-4302 | High | 7.8 | 2021-12-23 | A null pointer dereference was addressed with improved validation. This issue is fixed in macOS High Sierra 10.13, iCloud for Windows 7.0, watchOS 4, iOS 11, i… |
CVE-2018-10228 | Medium | 6.1 | 2021-12-14 | Cross-site scripting (XSS) vulnerability in /application/controller/admin/theme.php in LimeSurvey 3.6.2+180406 allows remote attackers to inject arbitrary web… |
CVE-2018-25022 | Low | 3.1 | 2021-12-13 | The Onion module in toxcore before 0.2.2 doesn't restrict which packets can be onion-routed, which allows a remote attacker to discover a target user's IP addr… |
CVE-2018-25021 | High | 7.5 | 2021-12-13 | The TCP Server module in toxcore before 0.2.8 doesn't free the TCP priority queue under certain conditions, which allows a remote attacker to exhaust the syste… |
CVE-2018-25020 | High | 7.8 | 2021-12-08 | The BPF subsystem in the Linux kernel before 4.17 mishandles situations with a long jump over an instruction sequence where inner instructions require substant… |
CVE-2018-6125 | Medium | 6.5 | 2021-11-02 | Insufficient policy enforcement in USB in Google Chrome on Windows prior to 67.0.3396.62 allowed a remote attacker to obtain potentially sensitive information… |
CVE-2018-6122 | High | 8.8 | 2021-11-02 | Type confusion in WebAssembly in Google Chrome prior to 66.0.3359.139 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2018-25019 | High | 7.5 | 2021-11-01 | The LearnDash LMS WordPress plugin before 2.5.4 does not have any authorisation and validation of the file to be uploaded in the learndash_assignment_process_i… |
CVE-2018-16061 | Medium | 6.1 | 2021-10-15 | Mitsubishi Electric Europe B.V. SmartRTU devices allow XSS via the username parameter or PATH_INFO to login.php. |
CVE-2018-16060 | High | 7.5 | 2021-10-15 | Mitsubishi Electric Europe B.V. SmartRTU devices allow remote attackers to obtain sensitive information (directory listing and source code) via a direct reques… |
CVE-2018-19957 | Medium | 6.1 | 2021-09-10 | A vulnerability involving insufficient HTTP security headers has been reported to affect QNAP NAS running QTS, QuTS hero, and QuTScloud. This vulnerability all… |
CVE-2018-10790 | High | 7.5 | 2021-08-25 | The AP4_CttsAtom class in Core/Ap4CttsAtom.cpp in Bento4 1.5.1.0 allows remote attackers to cause a denial of service (application crash), related to a memory… |
CVE-2018-17865 | Medium | 6.1 | 2021-08-09 | A cross-site scripting (XSS) vulnerability in SAP J2EE Engine 7.01 allows remote attackers to inject arbitrary web script via the wsdlPath parameter to /ctcpro… |
CVE-2018-17862 | Medium | 6.1 | 2021-08-09 | A cross-site scripting (XSS) vulnerability in SAP J2EE Engine/7.01/Fiori allows remote attackers to inject arbitrary web script via the sys_jdbc parameter to /… |
CVE-2018-17861 | Medium | 6.1 | 2021-08-09 | A cross-site scripting (XSS) vulnerability in SAP J2EE Engine/7.01/Portal/EPP allows remote attackers to inject arbitrary web script via the wsdlLib parameter… |
CVE-2018-25018 | High | 7.8 | 2021-07-01 | UnRAR 5.6.1.7 through 5.7.4 and 6.0.3 has an out-of-bounds write during a memcpy in QuickOpen::ReadRaw when called from QuickOpen::ReadNext. |
CVE-2018-25017 | Critical | 9.8 | 2021-07-01 | RawSpeed (aka librawspeed) 3.1 has a heap-based buffer overflow in TableLookUp::setTable. |
CVE-2018-25016 | Critical | 9.8 | 2021-06-21 | Greenbone Security Assistant (GSA) before 7.0.3 and Greenbone OS (GOS) before 5.0.0 allow Host Header Injection. |
CVE-2018-25015 | High | 7.8 | 2021-06-07 | An issue was discovered in the Linux kernel before 4.14.16. There is a use-after-free in net/sctp/socket.c for a held lock after a peel off, aka CID-a0ff660058… |
CVE-2018-10195 | High | 7.1 | 2021-06-02 | lrzsz before version 0.12.21~rc can leak information to the receiving side due to an incorrect length check in the function zsdata that causes a size_t to wrap… |
CVE-2018-16499 | Medium | 5.9 | 2021-05-26 | In VOS compromised, an attacker at network endpoints can possibly view communications between an unsuspecting user and the service using man-in-the-middle atta… |
CVE-2018-16498 | Medium | 5.5 | 2021-05-26 | In Versa Director, the unencrypted backup files stored on the Versa deployment contain credentials stored within configuration files. These credentials are for… |
CVE-2018-16497 | High | 7.8 | 2021-05-26 | In Versa Analytics, the cron jobs are used for scheduling tasks by executing commands at specific dates and times on the server. If the job is run as the user… |
CVE-2018-16496 | Medium | 5.3 | 2021-05-26 | In Versa Director, the un-authentication request found. |
CVE-2018-16495 | High | 8.8 | 2021-05-26 | In VOS user session identifier (authentication token) is issued to the browser prior to authentication but is not changed after the user successfully logs into… |
CVE-2018-16494 | High | 8.8 | 2021-05-26 | In VOS and overly permissive "umask" may allow for authorized users of the server to gain unauthorized access through insecure file permissions that can result… |
CVE-2018-10868 | High | 7.5 | 2021-05-26 | redhat-certification 7 does not properly restrict the number of recursive definitions of entities in XML documents, allowing an unauthenticated user to run a "… |
CVE-2018-10867 | Critical | 9.1 | 2021-05-26 | Files are accessible without restrictions from the /update/results page of redhat-certification 7 package, allowing an attacker to remove any file accessible b… |
CVE-2018-10866 | Critical | 9.1 | 2021-05-26 | It was discovered that the /configuration view of redhat-certification 7 does not perform an authorization check and it allows an unauthenticated user to remov… |
CVE-2018-10865 | High | 7.5 | 2021-05-26 | It was discovered that the /configuration view of redhat-certification 7 does not perform an authorization check and it allows an unauthenticated user to call… |
CVE-2018-10863 | High | 7.5 | 2021-05-26 | It was discovered that redhat-certification 7 is not properly configured and it lists all files and directories in the /var/www/rhcert/store/transfer directory… |
CVE-2018-25014 | Critical | 9.8 | 2021-05-21 | A use of uninitialized value was found in libwebp in versions before 1.0.1 in ReadSymbol(). |
CVE-2018-25013 | Critical | 9.1 | 2021-05-21 | A heap-based buffer overflow was found in libwebp in versions before 1.0.1 in ShiftBytes(). |
CVE-2018-25012 | Critical | 9.1 | 2021-05-21 | A heap-based buffer overflow was found in libwebp in versions before 1.0.1 in GetLE24(). |
CVE-2018-25011 | Critical | 9.8 | 2021-05-21 | A heap-based buffer overflow was found in libwebp in versions before 1.0.1 in PutLE16(). |
CVE-2018-25010 | Critical | 9.1 | 2021-05-21 | A heap-based buffer overflow was found in libwebp in versions before 1.0.1 in ApplyFilter(). |
CVE-2018-25009 | Critical | 9.1 | 2021-05-21 | A heap-based buffer overflow was found in libwebp in versions before 1.0.1 in GetLE16(). |
CVE-2018-25007 | Low | 2.6 | 2021-04-23 | Missing check in UIDL request handler in com.vaadin:flow-server versions 1.0.0 through 1.0.5 (Vaadin 10.0.0 through 10.0.7, and 11.0.0 through 11.0.2) allows a… |
CVE-2018-19942 | Medium | 6.1 | 2021-04-16 | A cross-site scripting (XSS) vulnerability has been reported to affect earlier versions of File Station. If exploited, this vulnerability allows remote attacke… |
CVE-2018-25008 | Medium | 5.9 | 2021-04-14 | In the standard library in Rust before 1.29.0, there is weak synchronization in the Arc::get_mut method. This synchronization issue can be lead to memory safet… |