2018 CVEs (page 62)
Page 62 of 162 — CVEs published in 2018, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2018-11079 | Medium | 5.5 | 2018-10-18 | Dell EMC Secure Remote Services, versions prior to 3.32.00.08, contains a Plaintext Password Storage vulnerability. Database credentials are stored in plaintex… |
CVE-2018-18488 | Critical | 9.8 | 2018-10-18 | In \lib\admin\action\dataaction.class.php in Gxlcms v2.0, SQL Injection exists via the ids[] parameter. |
CVE-2018-18487 | High | 7.5 | 2018-10-18 | In \lib\admin\action\dataaction.class.php in Gxlcms v2.0, the database backup filename generation uses mt_rand() unsafely, resulting in predictable database ba… |
CVE-2018-18486 | Critical | 9.8 | 2018-10-18 | An issue was discovered in PHPSHE 1.7. SQL injection exists via the admin.php?mod=user&act=del user_id[] parameter. |
CVE-2018-18485 | High | 7.5 | 2018-10-18 | An issue was discovered in PHPSHE 1.7. admin.php?mod=db&act=del allows remote attackers to delete arbitrary files via directory traversal sequences in the dbna… |
CVE-2018-18484 | Medium | 5.5 | 2018-10-18 | An issue was discovered in cp-demangle.c in GNU libiberty, as distributed in GNU Binutils 2.31. Stack Exhaustion occurs in the C++ demangling functions provide… |
CVE-2018-18483 | High | 7.8 | 2018-10-18 | The get_count function in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.31, allows remote attackers to cause a denial of service (malloc calle… |
CVE-2018-14807 | Critical | 9.8 | 2018-10-18 | A stack-based buffer overflow vulnerability in Opto 22 PAC Control Basic and PAC Control Professional versions R10.0a and prior may allow remote code execution. |
CVE-2018-18482 | Medium | 6.5 | 2018-10-18 | An issue was discovered in libpg_query 10-1.0.2. There is a memory leak in pg_query_raw_parse in pg_query_parse.c, which might lead to a denial of service. |
CVE-2018-18481 | Medium | 6.5 | 2018-10-18 | A heap-based buffer over-read exists in libopencad 0.2.0 in the ReadCHAR function in lib/dwg/io.cpp, resulting in an application crash. |
CVE-2018-18480 | Medium | 6.5 | 2018-10-18 | A heap-based buffer over-read exists in libopencad 0.2.0 in the ReadMCHAR function in lib/dwg/io.cpp, resulting in an application crash. |
CVE-2018-18478 | Medium | 6.1 | 2018-10-18 | Persistent Cross-Site Scripting (XSS) issues in LibreNMS before 1.44 allow remote attackers to inject arbitrary web script or HTML via the dashboard_name param… |
CVE-2018-1822 | Critical | 9.8 | 2018-10-18 | IBM FlashSystem 900 product GUI allows a specially crafted attack to bypass the authentication requirements of the system, resulting in the ability to remotely… |
CVE-2018-1518 | Medium | 6.2 | 2018-10-18 | IBM InfoSphere Information Server 11.7 is affected by a weak password encryption vulnerability that could allow a local user to obtain highly sensitive informa… |
CVE-2018-5188 | Critical | 9.8 | 2018-10-18 | Memory safety bugs present in Firefox 60, Firefox ESR 60, and Firefox ESR 52.8. Some of these bugs showed evidence of memory corruption and we presume that wit… |
CVE-2018-5187 | Critical | 9.8 | 2018-10-18 | Memory safety bugs present in Firefox 60 and Firefox ESR 60. Some of these bugs showed evidence of memory corruption and we presume that with enough effort tha… |
CVE-2018-5186 | Critical | 9.8 | 2018-10-18 | Memory safety bugs present in Firefox 60. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these cou… |
CVE-2018-5156 | Critical | 9.8 | 2018-10-18 | A vulnerability can occur when capturing a media stream when the media source type is changed as the capture is occurring. This can result in stream data being… |
CVE-2018-12387 | Critical | 9.1 | 2018-10-18 | A vulnerability where the JavaScript JIT compiler inlines Array.prototype.push with multiple arguments that results in the stack pointer being off by 8 bytes a… |
CVE-2018-12386 | High | 8.1 | 2018-10-18 | A vulnerability in register allocation in JavaScript can lead to type confusion, allowing for an arbitrary read and write. This leads to remote code execution… |
CVE-2018-12385 | High | 7.0 | 2018-10-18 | A potentially exploitable crash in TransportSecurityInfo used for SSL can be triggered by data stored in the local cache in the user profile directory. This is… |
CVE-2018-12383 | Medium | 5.5 | 2018-10-18 | If a user saved passwords before Firefox 58 and then later set a master password, an unencrypted copy of these passwords is still accessible. This is because t… |
CVE-2018-12382 | Medium | 5.3 | 2018-10-18 | The displayed addressbar URL can be spoofed on Firefox for Android using a javascript: URI in concert with JavaScript to insert text before the loaded domain n… |
CVE-2018-12381 | Medium | 5.3 | 2018-10-18 | Manually dragging and dropping an Outlook email message into the browser will trigger a page navigation when the message's mail columns are incorrectly interpr… |
CVE-2018-12379 | High | 7.8 | 2018-10-18 | When the Mozilla Updater opens a MAR format file which contains a very long item filename, an out-of-bounds write can be triggered, leading to a potentially ex… |
CVE-2018-12378 | Critical | 9.8 | 2018-10-18 | A use-after-free vulnerability can occur when an IndexedDB index is deleted while still in use by JavaScript code that is providing payload values to be stored… |
CVE-2018-12377 | Critical | 9.8 | 2018-10-18 | A use-after-free vulnerability can occur when refresh driver timers are refreshed in some circumstances during shutdown when the timer is deleted while still i… |
CVE-2018-12376 | Critical | 9.8 | 2018-10-18 | Memory safety bugs present in Firefox 61 and Firefox ESR 60.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort t… |
CVE-2018-12375 | High | 8.8 | 2018-10-18 | Memory safety bugs present in Firefox 61. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these cou… |
CVE-2018-12374 | Medium | 4.3 | 2018-10-18 | Plaintext of decrypted emails can leak through by user submitting an embedded form by pressing enter key within a text input field. This vulnerability affects… |
CVE-2018-12373 | Medium | 6.5 | 2018-10-18 | dDecrypted S/MIME parts hidden with CSS or the plaintext HTML tag can leak plaintext when included in a HTML reply/forward. This vulnerability affects Thunderb… |
CVE-2018-12372 | Medium | 6.5 | 2018-10-18 | Decrypted S/MIME parts, when included in HTML crafted for an attack, can leak plaintext when included in a a HTML reply/forward. This vulnerability affects Thu… |
CVE-2018-12370 | High | 8.8 | 2018-10-18 | In Reader View SameSite cookie protections are not checked on exiting. This allows for a payload to be triggered when Reader View is exited if loaded by a mali… |
CVE-2018-12369 | Critical | 9.8 | 2018-10-18 | WebExtensions bundled with embedded experiments were not correctly checked for proper authorization. This allowed a malicious WebExtension to gain full browser… |
CVE-2018-12368 | High | 8.1 | 2018-10-18 | Windows 10 does not warn users before opening executable files with the SettingContent-ms extension even when they have been downloaded from the internet and h… |
CVE-2018-12367 | Medium | 4.3 | 2018-10-18 | In the previous mitigations for Spectre, the resolution or precision of various methods was reduced to counteract the ability to measure precise time intervals… |
CVE-2018-12366 | Medium | 6.5 | 2018-10-18 | An invalid grid size during QCMS (color profile) transformations can result in the out-of-bounds read interpreted as a float value. This could leak private dat… |
CVE-2018-12365 | Medium | 6.5 | 2018-10-18 | A compromised IPC child process can escape the content sandbox and list the names of arbitrary files on the file system without user consent or interaction. Th… |
CVE-2018-12364 | High | 8.8 | 2018-10-18 | NPAPI plugins, such as Adobe Flash, can send non-simple cross-origin requests, bypassing CORS by making a same-origin POST that does a 307 redirect to the targ… |
CVE-2018-12363 | High | 8.8 | 2018-10-18 | A use-after-free vulnerability can occur when script uses mutation events to move DOM nodes between documents, resulting in the old document that held the node… |
CVE-2018-12362 | High | 8.8 | 2018-10-18 | An integer overflow can occur during graphics operations done by the Supplemental Streaming SIMD Extensions 3 (SSSE3) scaler, resulting in a potentially exploi… |
CVE-2018-12361 | High | 8.8 | 2018-10-18 | An integer overflow can occur in the SwizzleData code while calculating buffer sizes. The overflowed value is used for subsequent graphics computations when th… |
CVE-2018-12360 | High | 8.8 | 2018-10-18 | A use-after-free vulnerability can occur when deleting an input element during a mutation event handler triggered by focusing that element. This results in a p… |
CVE-2018-12359 | High | 8.8 | 2018-10-18 | A buffer overflow can occur when rendering canvas content while adjusting the height and width of the canvas element dynamically, causing data to be written ou… |
CVE-2018-12358 | Medium | 4.3 | 2018-10-18 | Service workers can use redirection to avoid the tainting of cross-origin resources in some instances, allowing a malicious site to read responses which are su… |
CVE-2018-18461 | Critical | 9.8 | 2018-10-18 | The Arigato Autoresponder and Newsletter (aka bft-autoresponder) v2.5.1.7 plugin for WordPress allows remote attackers to execute arbitrary code via PHP code i… |
CVE-2018-18460 | Medium | 6.1 | 2018-10-18 | XSS exists in the wp-live-chat-support v8.0.15 plugin for WordPress via the modules/gdpr.php term parameter in a wp-admin/admin.php wplivechat-menu-gdpr-page r… |
CVE-2018-18459 | Medium | 5.5 | 2018-10-18 | The function DCTStream::getBlock in Stream.cc in Xpdf 4.00 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted pdf fi… |
CVE-2018-18458 | Medium | 5.5 | 2018-10-18 | The function DCTStream::decodeImage in Stream.cc in Xpdf 4.00 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted pdf… |
CVE-2018-18457 | Medium | 5.5 | 2018-10-18 | The function DCTStream::readScan in Stream.cc in Xpdf 4.00 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted pdf fi… |
CVE-2018-18456 | Medium | 5.5 | 2018-10-18 | The function Object::isName() in Object.h (called from Gfx::opSetFillColorN) in Xpdf 4.00 allows remote attackers to cause a denial of service (stack-based buf… |
CVE-2018-18455 | Medium | 5.5 | 2018-10-18 | The GfxImageColorMap class in GfxState.cc in Xpdf 4.00 allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted pdf fil… |
CVE-2018-18454 | Medium | 5.5 | 2018-10-18 | CCITTFaxStream::readRow() in Stream.cc in Xpdf 4.00 allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted pdf file… |
CVE-2018-18450 | Critical | 9.8 | 2018-10-17 | apps\admin\controller\content\SingleController.php in PbootCMS before V1.3.0 build 2018-11-12 has SQL Injection, as demonstrated by the POST data to the admin… |
CVE-2018-15438 | Medium | 6.5 | 2018-10-17 | A vulnerability in the web-based management interface of Cisco Prime Collaboration Assurance could allow an unauthenticated, remote attacker to conduct a cross… |
CVE-2018-0443 | High | 7.5 | 2018-10-17 | A vulnerability in the Control and Provisioning of Wireless Access Points (CAPWAP) protocol component of Cisco Wireless LAN Controller (WLC) Software could all… |
CVE-2018-0442 | High | 7.5 | 2018-10-17 | A vulnerability in the Control and Provisioning of Wireless Access Points (CAPWAP) protocol component of Cisco Wireless LAN Controller (WLC) Software could all… |
CVE-2018-0441 | High | 7.4 | 2018-10-17 | A vulnerability in the 802.11r Fast Transition feature set of Cisco IOS Access Points (APs) Software could allow an unauthenticated, adjacent attacker to cause… |
CVE-2018-0420 | Medium | 6.5 | 2018-10-17 | A vulnerability in the web-based interface of Cisco Wireless LAN Controller Software could allow an authenticated, remote attacker to view sensitive informatio… |
CVE-2018-0417 | High | 7.8 | 2018-10-17 | A vulnerability in TACACS authentication with Cisco Wireless LAN Controller (WLC) Software could allow an authenticated, local attacker to perform certain oper… |
CVE-2018-0381 | Medium | 6.8 | 2018-10-17 | A vulnerability in the Cisco Aironet Series Access Points (APs) software could allow an authenticated, adjacent attacker to cause an affected device to reload… |
CVE-2018-15435 | Medium | 6.1 | 2018-10-17 | A vulnerability in the web-based management interface of Cisco SocialMiner could allow an unauthenticated, remote attacker to conduct a stored cross-site scrip… |
CVE-2018-14597 | Medium | 5.3 | 2018-10-17 | CA Technologies Identity Governance 12.6, 14.0, 14.1, and 14.2 and CA Identity Suite Virtual Appliance 14.0, 14.1, and 14.2 provide telling error messages that… |
CVE-2018-0378 | High | 8.6 | 2018-10-17 | A vulnerability in the Precision Time Protocol (PTP) feature of Cisco Nexus 5500, 5600, and 6000 Series Switches running Cisco NX-OS Software could allow an un… |
CVE-2018-18386 | Low | 3.3 | 2018-10-17 | drivers/tty/n_tty.c in the Linux kernel before 4.14.11 allows local attackers (who are able to access pseudo terminals) to hang/block further usage of any pseu… |
CVE-2018-15402 | Medium | 5.4 | 2018-10-17 | A vulnerability in Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an unauthenticated, remote attacker to conduct cross-site request forgery (… |
CVE-2018-15395 | Medium | 5.4 | 2018-10-17 | A vulnerability in the authentication and authorization checking mechanisms of Cisco Wireless LAN Controller (WLC) Software could allow an authenticated, adjac… |
CVE-2018-0456 | High | 7.7 | 2018-10-17 | A vulnerability in the Simple Network Management Protocol (SNMP) input packet processor of Cisco NX-OS Software could allow an authenticated, remote attacker t… |
CVE-2018-18445 | High | 7.8 | 2018-10-17 | In the Linux kernel 4.14.x, 4.15.x, 4.16.x, 4.17.x, and 4.18.x before 4.18.13, faulty computation of numeric bounds in the BPF verifier permits out-of-bounds m… |
CVE-2018-18444 | High | 8.8 | 2018-10-17 | makeMultiView.cpp in exrmultiview in OpenEXR 2.3.0 has an out-of-bounds write, leading to an assertion failure or possibly unspecified other impact. |
CVE-2018-18443 | Medium | 4.3 | 2018-10-17 | OpenEXR 2.3.0 has a memory leak in ThreadPool in IlmBase/IlmThread/IlmThreadPool.cpp, as demonstrated by exrmultiview. |
CVE-2018-0416 | Medium | 5.3 | 2018-10-17 | A vulnerability in the web-based interface of Cisco Wireless LAN Controller (WLC) Software could allow an unauthenticated, remote attacker to view system infor… |
CVE-2018-0395 | High | 8.8 | 2018-10-17 | A vulnerability in the Link Layer Discovery Protocol (LLDP) implementation for Cisco FXOS Software and Cisco NX-OS Software could allow an unauthenticated, adj… |
CVE-2018-0388 | Medium | 4.8 | 2018-10-17 | A vulnerability in the web-based interface of Cisco Wireless LAN Controller (WLC) Software could allow an authenticated, remote attacker to conduct a cross-sit… |
CVE-2018-15976 | High | 7.8 | 2018-10-17 | Adobe Technical Communications Suite versions 1.0.5.1 and below have an insecure library loading (dll hijacking) vulnerability. Successful exploitation could l… |
CVE-2018-15974 | High | 7.8 | 2018-10-17 | Adobe Framemaker versions 1.0.5.1 and below have an insecure library loading (dll hijacking) vulnerability. Successful exploitation could lead to privilege esc… |
CVE-2018-15973 | Medium | 6.1 | 2018-10-17 | Adobe Experience Manager versions 6.4, 6.3, 6.2, 6.1, and 6.0 have a stored cross-site scripting vulnerability. Successful exploitation could lead to sensitive… |
CVE-2018-15972 | Medium | 6.1 | 2018-10-17 | Adobe Experience Manager versions 6.4, 6.3, 6.2, 6.1, and 6.0 have a stored cross-site scripting vulnerability. Successful exploitation could lead to sensitive… |
CVE-2018-15971 | Medium | 6.1 | 2018-10-17 | Adobe Experience Manager versions 6.4, 6.3, 6.2, 6.1, and 6.0 have a reflected cross-site scripting vulnerability. Successful exploitation could lead to sensit… |
CVE-2018-15970 | Medium | 6.1 | 2018-10-17 | Adobe Experience Manager versions 6.4, 6.3, 6.2, 6.1, and 6.0 have a reflected cross-site scripting vulnerability. Successful exploitation could lead to sensit… |
CVE-2018-15969 | Medium | 6.1 | 2018-10-17 | Adobe Experience Manager versions 6.4, 6.3, 6.2, 6.1, and 6.0 have a stored cross-site scripting vulnerability. Successful exploitation could lead to sensitive… |
CVE-2018-15616 | Critical | 9.0 | 2018-10-17 | A vulnerability in the Web UI component of Avaya Aura System Platform could allow a remote, unauthenticated user to perform a targeted deserialization attack t… |
CVE-2018-12823 | Critical | 9.8 | 2018-10-17 | Adobe Digital Editions versions 4.5.8 and below have a heap overflow vulnerability. Successful exploitation could lead to arbitrary code execution. |
CVE-2018-12822 | Critical | 9.8 | 2018-10-17 | Adobe Digital Editions versions 4.5.8 and below have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution. |
CVE-2018-12821 | High | 7.5 | 2018-10-17 | Adobe Digital Editions versions 4.5.8 and below have an out of bounds read vulnerability. Successful exploitation could lead to information disclosure. |
CVE-2018-12820 | High | 7.5 | 2018-10-17 | Adobe Digital Editions versions 4.5.8 and below have an out of bounds read vulnerability. Successful exploitation could lead to information disclosure. |
CVE-2018-12819 | High | 7.5 | 2018-10-17 | Adobe Digital Editions versions 4.5.8 and below have an out of bounds read vulnerability. Successful exploitation could lead to information disclosure. |
CVE-2018-12818 | High | 7.5 | 2018-10-17 | Adobe Digital Editions versions 4.5.8 and below have an out of bounds read vulnerability. Successful exploitation could lead to information disclosure. |
CVE-2018-12816 | High | 7.5 | 2018-10-17 | Adobe Digital Editions versions 4.5.8 and below have an out of bounds read vulnerability. Successful exploitation could lead to information disclosure. |
CVE-2018-12814 | Critical | 9.8 | 2018-10-17 | Adobe Digital Editions versions 4.5.8 and below have a heap overflow vulnerability. Successful exploitation could lead to arbitrary code execution. |
CVE-2018-12813 | Critical | 9.8 | 2018-10-17 | Adobe Digital Editions versions 4.5.8 and below have a heap overflow vulnerability. Successful exploitation could lead to arbitrary code execution. |
CVE-2018-7989 | Medium | 4.6 | 2018-10-17 | Huawei Mate 10 pro smartphones with the versions before BLA-AL00B 8.1.0.326(C00) have an improper authentication vulnerability. App Lock is a function to preve… |
CVE-2018-7924 | Low | 2.4 | 2018-10-17 | Anne-AL00 Huawei phones with versions earlier than 8.0.0.151(C00) have an information leak vulnerability. Due to improper permission settings for specific comm… |
CVE-2018-18373 | Medium | 5.4 | 2018-10-17 | In the Schiocco "Support Board - Chat And Help Desk" plugin 1.2.3 for WordPress, a Stored XSS vulnerability has been discovered in file upload areas in the Cha… |
CVE-2018-18372 | Medium | 6.1 | 2018-10-17 | A Stored XSS vulnerability has been discovered in KAASoft Library CMS - Powerful Book Management System 2.1.1 via the /admin/book/create/ title parameter. |
CVE-2018-18262 | Medium | 6.1 | 2018-10-17 | Zoho ManageEngine OpManager 12.3 before build 123214 has XSS. |
CVE-2018-17964 | Medium | 6.1 | 2018-10-17 | Aryanic HighPortal 12.5 has XSS via an Add Tags action. |
CVE-2018-16232 | High | 8.8 | 2018-10-17 | An authenticated command injection vulnerability exists in IPFire Firewall before 2.21 Core Update 124 in backup.cgi. This allows an authenticated user with pr… |
CVE-2018-15493 | Medium | 6.1 | 2018-10-17 | vBulletin 5.4.3 has an Open Redirect. |
CVE-2018-10824 | Critical | 9.8 | 2018-10-17 | An issue was discovered on D-Link DWR-116 through 1.06, DIR-140L through 1.02, DIR-640L through 1.02, DWR-512 through 2.02, DWR-712 through 2.02, DWR-912 throu… |