2018 CVEs (page 67)
Page 67 of 162 — CVEs published in 2018, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2018-18240 | Critical | 9.8 | 2018-10-11 | Pippo through 1.11.0 allows remote code execution via a command to java.lang.ProcessBuilder because the XstreamEngine component does not use XStream's availabl… |
CVE-2018-18062 | Medium | 6.1 | 2018-10-10 | An issue was discovered in dialog.php in tecrail Responsive FileManager 9.8.1. A reflected XSS vulnerability allows remote attackers to inject arbitrary web sc… |
CVE-2018-18061 | High | 7.5 | 2018-10-10 | An issue was discovered in dialog.php in tecrail Responsive FileManager 9.8.1. Attackers can access the file manager interface that provides them with the abil… |
CVE-2018-17784 | Medium | 6.1 | 2018-10-10 | Multiple vulnerabilities in YUI and FlashCanvas embedded in SugarCRM Community Edition 6.5.26 could allow an unauthenticated, remote attacker to conduct a cros… |
CVE-2018-17337 | Medium | 6.1 | 2018-10-10 | Intelbras NPLUG 1.0.0.14 devices have XSS via a crafted SSID that is received via a network broadcast. |
CVE-2018-16758 | Medium | 5.9 | 2018-10-10 | Missing message authentication in the meta-protocol in Tinc VPN version 1.0.34 and earlier allows a man-in-the-middle attack to disable the encryption of VPN p… |
CVE-2018-16738 | Low | 3.7 | 2018-10-10 | tinc 1.0.30 through 1.0.34 has a broken authentication protocol, although there is a partial mitigation. This is fixed in 1.1. |
CVE-2018-16737 | Medium | 5.3 | 2018-10-10 | tinc before 1.0.30 has a broken authentication protocol, without even a partial mitigation. |
CVE-2018-13789 | High | 7.5 | 2018-10-10 | An issue was discovered in Descor Infocad FM before 3.1.0.0. An unauthenticated web service allows the retrieval of files on the web server and on reachable SM… |
CVE-2018-12596 | Critical | 9.8 | 2018-10-10 | Episerver Ektron CMS before 9.0 SP3 Site CU 31, 9.1 before SP3 Site CU 45, or 9.2 before SP2 Site CU 22 allows remote attackers to call aspx pages via the "act… |
CVE-2018-12456 | High | 8.8 | 2018-10-10 | Intelbras NPLUG 1.0.0.14 wireless repeater devices have no CSRF token protection in the web interface, allowing attackers to perform actions such as changing t… |
CVE-2018-12455 | High | 8.1 | 2018-10-10 | Intelbras NPLUG 1.0.0.14 wireless repeater devices have a critical vulnerability that allows an attacker to authenticate in the web interface just by using "ad… |
CVE-2018-12544 | Critical | 9.8 | 2018-10-10 | In version from 3.5.Beta1 to 3.5.3 of Eclipse Vert.x, the OpenAPI XML type validator creates XML parsers without taking appropriate defense against XML attacks… |
CVE-2018-12542 | Critical | 9.8 | 2018-10-10 | In version from 3.0.0 to 3.5.3 of Eclipse Vert.x, the StaticHandler uses external input to construct a pathname that should be within a restricted directory, b… |
CVE-2018-12541 | Medium | 6.5 | 2018-10-10 | In version from 3.0.0 to 3.5.3 of Eclipse Vert.x, the WebSocket HTTP upgrade implementation buffers the full http request before doing the handshake, holding t… |
CVE-2018-12410 | Critical | 9.8 | 2018-10-10 | The web server component of TIBCO Software Inc's Spotfire Statistics Services contains multiple vulnerabilities that may allow the remote execution of code. Wi… |
CVE-2018-12193 | Medium | 5.5 | 2018-10-10 | Insufficient access control in driver stack for Intel QuickAssist Technology for Linux before version 4.2 may allow an unprivileged user to potentially disclos… |
CVE-2018-12173 | High | 7.6 | 2018-10-10 | Insufficient access protection in firmware in Intel Server Board, Intel Server System and Intel Compute Module before firmware version 00.01.0014 may allow an… |
CVE-2018-12172 | Medium | 5.5 | 2018-10-10 | Improper password hashing in firmware in Intel Server Board (S7200AP,S7200APR) and Intel Compute Module (HNS7200AP, HNS7200AP) may allow a privileged user to p… |
CVE-2018-12161 | Medium | 6.5 | 2018-10-10 | Insufficient session validation in the webserver component of the Intel Rapid Web Server 3 may allow an unauthenticated user to potentially disclose informatio… |
CVE-2018-12158 | Medium | 6.0 | 2018-10-10 | Insufficient input validation in BIOS update utility in Intel NUC FW kits downloaded before May 24, 2018 may allow a privileged user to potentially trigger a d… |
CVE-2018-12153 | Medium | 6.5 | 2018-10-10 | Denial of Service in Unified Shader Compiler in Intel Graphics Drivers before 10.18.x.5056 (aka 15.33.x.5056), 10.18.x.5057 (aka 15.36.x.5057) and 20.19.x.5058… |
CVE-2018-12152 | High | 7.8 | 2018-10-10 | Pointer corruption in Unified Shader Compiler in Intel Graphics Drivers before 10.18.x.5056 (aka 15.33.x.5056), 10.18.x.5057 (aka 15.36.x.5057) and 20.19.x.505… |
CVE-2018-0063 | Medium | 6.5 | 2018-10-10 | A vulnerability in the IP next-hop index database in Junos OS 17.3R3 may allow a flood of ARP requests, sent to the management interface, to exhaust the privat… |
CVE-2018-0062 | Medium | 5.3 | 2018-10-10 | A Denial of Service vulnerability in J-Web service may allow a remote unauthenticated user to cause Denial of Service which may prevent other users to authenti… |
CVE-2018-0061 | Medium | 5.3 | 2018-10-10 | A denial of service vulnerability in the telnetd service on Junos OS allows remote unauthenticated users to cause high CPU usage which may affect system perfor… |
CVE-2018-0060 | Medium | 5.3 | 2018-10-10 | An improper input validation weakness in the device control daemon process (dcd) of Juniper Networks Junos OS allows an attacker to cause a Denial of Service t… |
CVE-2018-0059 | Medium | 5.4 | 2018-10-10 | A persistent cross-site scripting vulnerability in the graphical user interface of ScreenOS may allow a remote authenticated user to inject web script or HTML… |
CVE-2018-0058 | Medium | 5.9 | 2018-10-10 | Receipt of a specially crafted IPv6 exception packet may be able to trigger a kernel crash (vmcore), causing the device to reboot. The issue is specific to the… |
CVE-2018-0057 | Medium | 6.1 | 2018-10-10 | On MX Series and M120/M320 platforms configured in a Broadband Edge (BBE) environment, subscribers logging in with DHCP Option 50 to request a specific IP addr… |
CVE-2018-0056 | Medium | 6.5 | 2018-10-10 | If a duplicate MAC address is learned by two different interfaces on an MX Series device, the MAC address learning function correctly flaps between the interfa… |
CVE-2018-0055 | Medium | 6.5 | 2018-10-10 | Receipt of a specially crafted DHCPv6 message destined to a Junos OS device configured as a DHCP server in a Broadband Edge (BBE) environment may result in a j… |
CVE-2018-0054 | Medium | 6.5 | 2018-10-10 | On QFX5000 Series and EX4600 switches, a high rate of Ethernet pause frames or an ARP packet storm received on the management interface (fxp0) can cause egress… |
CVE-2018-0053 | Medium | 6.8 | 2018-10-10 | An authentication bypass vulnerability in the initial boot sequence of Juniper Networks Junos OS on vSRX Series may allow an attacker to gain full control of t… |
CVE-2018-0052 | High | 7.2 | 2018-10-10 | If RSH service is enabled on Junos OS and if the PAM authentication is disabled, a remote unauthenticated attacker can obtain root access to the device. RSH se… |
CVE-2018-0051 | High | 7.5 | 2018-10-10 | A Denial of Service vulnerability in the SIP application layer gateway (ALG) component of Junos OS based platforms allows an attacker to crash MS-PIC, MS-MIC… |
CVE-2018-0050 | High | 7.5 | 2018-10-10 | An error handling vulnerability in Routing Protocols Daemon (RPD) of Juniper Networks Junos OS allows an attacker to cause RPD to crash. Continued receipt of t… |
CVE-2018-0049 | High | 7.5 | 2018-10-10 | A NULL Pointer Dereference vulnerability in Juniper Networks Junos OS allows an attacker to cause the Junos OS kernel to crash. Continued receipt of this speci… |
CVE-2018-0048 | High | 7.5 | 2018-10-10 | A vulnerability in the Routing Protocols Daemon (RPD) with Juniper Extension Toolkit (JET) support can allow a network based unauthenticated attacker to cause… |
CVE-2018-0047 | High | 8.0 | 2018-10-10 | A persistent cross-site scripting vulnerability in the UI framework used by Junos Space Security Director may allow authenticated users to inject persistent an… |
CVE-2018-0046 | High | 8.8 | 2018-10-10 | A reflected cross-site scripting vulnerability in OpenNMS included with Juniper Networks Junos Space may allow the stealing of sensitive information or session… |
CVE-2018-0045 | High | 8.8 | 2018-10-10 | Receipt of a specific Draft-Rosen MVPN control packet may cause the routing protocol daemon (RPD) process to crash and restart or may lead to remote code execu… |
CVE-2018-0044 | Critical | 9.8 | 2018-10-10 | An insecure SSHD configuration in Juniper Device Manager (JDM) and host OS on Juniper NFX Series devices may allow remote unauthenticated access if any of the… |
CVE-2018-0043 | High | 8.8 | 2018-10-10 | Receipt of a specific MPLS packet may cause the routing protocol daemon (RPD) process to crash and restart or may lead to remote code execution. By continuousl… |
CVE-2018-17925 | Medium | 4.8 | 2018-10-10 | Multiple instances of this vulnerability (Unsafe ActiveX Control Marked Safe For Scripting) have been identified in the third-party ActiveX object provided to… |
CVE-2018-13805 | High | 7.5 | 2018-10-10 | A vulnerability has been identified in SIMATIC ET 200SP Open Controller (All versions >= V2.0 and < V2.1.6), SIMATIC S7-1500 Software Controller (All versions… |
CVE-2018-13802 | High | 7.2 | 2018-10-10 | A vulnerability has been identified in ROX II (All versions < V2.12.1). An authenticated attacker with a high-privileged user account access via SSH could circ… |
CVE-2018-13801 | High | 8.8 | 2018-10-10 | A vulnerability has been identified in ROX II (All versions < V2.12.1). An attacker with network access to port 22/tcp and valid low-privileged user credential… |
CVE-2018-13800 | High | 7.3 | 2018-10-10 | A vulnerability has been identified in SIMATIC S7-1200 CPU family version 4 (All versions < V4.2.3). The web interface could allow a Cross-Site Request Forgery… |
CVE-2018-18211 | High | 8.1 | 2018-10-10 | PbootCMS 1.2.1 has SQL injection via the HTTP POST data to the api.php/cms/addform?fcode=1 URI. |
CVE-2018-18210 | Medium | 6.1 | 2018-10-10 | XSS exists in DiliCMS 2.4.0 via the admin/index.php/setting/site?tab=site_attachment attachment_url parameter. |
CVE-2018-18209 | Medium | 6.1 | 2018-10-10 | XSS exists in DiliCMS 2.4.0 via the admin/index.php/setting/site?tab=site_attachment attachment_type parameter. |
CVE-2018-18208 | Medium | 6.1 | 2018-10-10 | Virtualmin 6.03 allows XSS via the query string, as demonstrated by the webmin_search.cgi URI. |
CVE-2018-18207 | Medium | 6.1 | 2018-10-10 | Virtualmin 6.03 allows Frame Injection via the settings-editor_read.cgi file parameter. |
CVE-2018-17919 | Medium | 6.5 | 2018-10-10 | All versions of Hangzhou Xiongmai Technology Co., Ltd XMeye P2P Cloud Server may allow an attacker to use an undocumented user account "default" with its defau… |
CVE-2018-17917 | Medium | 5.3 | 2018-10-10 | All versions of Hangzhou Xiongmai Technology Co., Ltd XMeye P2P Cloud Server may allow an attacker to use MAC addresses to enumerate potential Cloud IDs. Using… |
CVE-2018-17915 | Critical | 9.8 | 2018-10-10 | All versions of Hangzhou Xiongmai Technology Co., Ltd XMeye P2P Cloud Server do not encrypt all device communication. This includes the XMeye service and firmw… |
CVE-2018-8006 | Medium | 6.1 | 2018-10-10 | An instance of a cross-site scripting vulnerability was identified to be present in the web based administration console on the queue.jsp page of Apache Active… |
CVE-2018-15311 | Medium | 5.9 | 2018-10-10 | When F5 BIG-IP 13.0.0-13.1.0.5, 12.1.0-12.1.3.5, 11.6.0-11.6.3.2, or 11.5.1-11.5.6 is processing specially crafted TCP traffic with the Large Receive Offload (… |
CVE-2018-12131 | High | 7.8 | 2018-10-10 | Permissions in the driver pack installers for Intel NVMe before version 4.0.0.1007 and Intel RSTe before version 4.7.0.2083 may allow an authenticated user to… |
CVE-2018-8533 | Medium | 5.5 | 2018-10-10 | An information disclosure vulnerability exists in Microsoft SQL Server Management Studio (SSMS) when parsing malicious XML content containing a reference to an… |
CVE-2018-8532 | Medium | 5.5 | 2018-10-10 | An information disclosure vulnerability exists in Microsoft SQL Server Management Studio (SSMS) when parsing a malicious XMLA file containing a reference to an… |
CVE-2018-8531 | High | 8.8 | 2018-10-10 | A remote code execution vulnerability exists in the way that Azure IoT Hub Device Client SDK using MQTT protocol accesses objects in memory, aka "Azure IoT Dev… |
CVE-2018-8530 | Medium | 4.3 | 2018-10-10 | A security feature bypass vulnerability exists when Microsoft Edge improperly handles requests of different origins, aka "Microsoft Edge Security Feature Bypas… |
CVE-2018-8527 | Medium | 5.5 | 2018-10-10 | An information disclosure vulnerability exists in Microsoft SQL Server Management Studio (SSMS) when parsing a malicious XEL file containing a reference to an… |
CVE-2018-8518 | Medium | 5.4 | 2018-10-10 | An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected Share… |
CVE-2018-8513 | High | 7.5 | 2018-10-10 | A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Eng… |
CVE-2018-8512 | Medium | 5.4 | 2018-10-10 | A security feature bypass vulnerability exists in Microsoft Edge when the Edge Content Security Policy (CSP) fails to properly validate certain specially craft… |
CVE-2018-8511 | High | 7.5 | 2018-10-10 | A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Eng… |
CVE-2018-8510 | High | 7.5 | 2018-10-10 | A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Eng… |
CVE-2018-8509 | High | 7.5 | 2018-10-10 | A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka "Microsoft Edge Memory Corruption Vulnerability." T… |
CVE-2018-8506 | Medium | 5.5 | 2018-10-10 | An Information Disclosure vulnerability exists in the way that Microsoft Windows Codecs Library handles objects in memory, aka "Microsoft Windows Codecs Librar… |
CVE-2018-8505 | High | 7.5 | 2018-10-10 | A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Eng… |
CVE-2018-8504 | High | 8.8 | 2018-10-10 | A remote code execution vulnerability exists in Microsoft Word software when the software fails to properly handle objects in Protected View, aka "Microsoft Wo… |
CVE-2018-8503 | High | 7.5 | 2018-10-10 | A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Eng… |
CVE-2018-8502 | High | 8.8 | 2018-10-10 | A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in Protected View, aka "Microsoft E… |
CVE-2018-8501 | High | 8.8 | 2018-10-10 | A remote code execution vulnerability exists in Microsoft PowerPoint software when the software fails to properly handle objects in Protected View, aka "Micros… |
CVE-2018-8500 | Critical | 9.8 | 2018-10-10 | A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption… |
CVE-2018-8498 | Medium | 5.4 | 2018-10-10 | An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected Share… |
CVE-2018-8497 | High | 7.8 | 2018-10-10 | An elevation of privilege vulnerability exists in the way that the Windows Kernel handles objects in memory, aka "Windows Kernel Elevation of Privilege Vulnera… |
CVE-2018-8495 | High | 7.5 | 2018-10-10 | A remote code execution vulnerability exists when Windows Shell improperly handles URIs, aka "Windows Shell Remote Code Execution Vulnerability." This affects… |
CVE-2018-8494 | High | 8.8 | 2018-10-10 | A remote code execution vulnerability exists when the Microsoft XML Core Services MSXML parser processes user input, aka "MS XML Remote Code Execution Vulnerab… |
CVE-2018-8493 | High | 7.5 | 2018-10-10 | An information disclosure vulnerability exists when the Windows TCP/IP stack improperly handles fragmented IP packets, aka "Windows TCP/IP Information Disclosu… |
CVE-2018-8492 | Medium | 5.3 | 2018-10-10 | A security feature bypass vulnerability exists in Device Guard that could allow an attacker to inject malicious code into a Windows PowerShell session, aka "De… |
CVE-2018-8491 | High | 7.5 | 2018-10-10 | A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, aka "Internet Explorer Memory Corruption Vulnerabili… |
CVE-2018-8490 | High | 8.4 | 2018-10-10 | A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate input from an authenticated user on a guest opera… |
CVE-2018-8489 | High | 8.4 | 2018-10-10 | A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate input from an authenticated user on a guest opera… |
CVE-2018-8488 | Medium | 5.4 | 2018-10-10 | An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected Share… |
CVE-2018-8486 | Medium | 5.5 | 2018-10-10 | An information disclosure vulnerability exists when DirectX improperly handles objects in memory, aka "DirectX Information Disclosure Vulnerability." This affe… |
CVE-2018-8484 | High | 7.8 | 2018-10-10 | An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory, aka "DirectX Graphics Ke… |
CVE-2018-8482 | Low | 3.1 | 2018-10-10 | An information disclosure vulnerability exists when Windows Media Player improperly discloses file information, aka "Windows Media Player Information Disclosur… |
CVE-2018-8481 | Low | 3.1 | 2018-10-10 | An information disclosure vulnerability exists when Windows Media Player improperly discloses file information, aka "Windows Media Player Information Disclosur… |
CVE-2018-8480 | Medium | 5.4 | 2018-10-10 | An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected Share… |
CVE-2018-8473 | High | 7.5 | 2018-10-10 | A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka "Microsoft Edge Memory Corruption Vulnerability." T… |
CVE-2018-8472 | Medium | 5.5 | 2018-10-10 | An information disclosure vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in memory, allowing an attacker to r… |
CVE-2018-8460 | High | 7.5 | 2018-10-10 | A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, aka "Internet Explorer Memory Corruption Vulnerabili… |
CVE-2018-8453 | High | 7.8 | 2018-10-10 | An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka "Win32k Elevation of Privil… |
CVE-2018-8448 | Medium | 5.4 | 2018-10-10 | An elevation of privilege vulnerability exists when Microsoft Exchange Outlook Web Access (OWA) fails to properly handle web requests, aka "Microsoft Exchange… |
CVE-2018-8432 | High | 7.8 | 2018-10-10 | A remote code execution vulnerability exists in the way that Microsoft Graphics Components handle objects in memory, aka "Microsoft Graphics Components Remote… |
CVE-2018-8427 | Medium | 5.5 | 2018-10-10 | An information disclosure vulnerability exists in the way that Microsoft Graphics Components handle objects in memory, aka "Microsoft Graphics Components Infor… |