2018 CVEs (page 69)
Page 69 of 162 — CVEs published in 2018, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2018-1753 | Medium | 4.3 | 2018-10-08 | IBM Tivoli Key Lifecycle Manager 2.6, 2.7, and 3.0 generates an error message that includes sensitive information about its environment, users, or associated d… |
CVE-2018-1750 | Medium | 4.2 | 2018-10-08 | IBM Security Key Lifecycle Manager 3.0 specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unin… |
CVE-2018-1749 | Medium | 4.3 | 2018-10-08 | IBM Tivoli Key Lifecycle Manager 2.6, 2.7, and 3.0 uses incomplete blacklisting for input validation which allows attackers to bypass application controls resu… |
CVE-2018-1743 | Medium | 5.3 | 2018-10-08 | IBM Tivoli Key Lifecycle Manager 2.6, 2.7, and 3.0 discloses sensitive information to unauthorized users. The information can be used to mount further attacks… |
CVE-2018-1742 | Medium | 5.9 | 2018-10-08 | IBM Tivoli Key Lifecycle Manager 2.6, 2.7, and 3.0 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound… |
CVE-2018-1741 | Medium | 6.5 | 2018-10-08 | IBM Tivoli Key Lifecycle Manager 2.6, 2.7, and 3.0 does not properly limit the number or frequency of interaction which could be used to cause a denial of serv… |
CVE-2018-1000810 | Critical | 9.8 | 2018-10-08 | The Rust Programming Language Standard Library version 1.29.0, 1.28.0, 1.27.2, 1.27.1, 127.0, 126.2, 126.1, 126.0 contains a CWE-680: Integer Overflow to Buffe… |
CVE-2018-1000809 | High | 7.5 | 2018-10-08 | privacyIDEA version 2.23.1 and earlier contains a Improper Input Validation vulnerability in token validation api that can result in Denial-of-Service. This at… |
CVE-2018-1000808 | Medium | 5.9 | 2018-10-08 | Python Cryptographic Authority pyopenssl version Before 17.5.0 contains a CWE - 401 : Failure to Release Memory Before Removing Last Reference vulnerability in… |
CVE-2018-1000807 | High | 8.1 | 2018-10-08 | Python Cryptographic Authority pyopenssl version prior to version 17.5.0 contains a CWE-416: Use After Free vulnerability in X509 object handling that can resu… |
CVE-2018-1000805 | High | 8.8 | 2018-10-08 | Paramiko version 2.4.1, 2.3.2, 2.2.3, 2.1.5, 2.0.8, 1.18.5, 1.17.6 contains a Incorrect Access Control vulnerability in SSH server that can result in RCE. This… |
CVE-2018-1000804 | Critical | 9.8 | 2018-10-08 | contiki-ng version 4 contains a Buffer Overflow vulnerability in AQL (Antelope Query Language) database engine that can result in Attacker can perform Remote C… |
CVE-2018-1000803 | Medium | 5.3 | 2018-10-08 | Gitea version prior to version 1.5.1 contains a CWE-200 vulnerability that can result in Exposure of users private email addresses. This attack appear to be ex… |
CVE-2018-17889 | Medium | 5.3 | 2018-10-08 | In WECON Technology Co., Ltd. PI Studio HMI versions 4.1.9 and prior and PI Studio versions 4.2.34 and prior when parsing project files, the XMLParser that shi… |
CVE-2018-14818 | Critical | 9.8 | 2018-10-08 | WECON Technology Co., Ltd. PI Studio HMI versions 4.1.9 and prior and PI Studio versions 4.2.34 and prior have a stack-based buffer overflow vulnerability whic… |
CVE-2018-14810 | High | 8.8 | 2018-10-08 | WECON Technology Co., Ltd. PI Studio HMI versions 4.1.9 and prior and PI Studio versions 4.2.34 and prior parse files and pass invalidated user data to an unsa… |
CVE-2018-18025 | Medium | 6.5 | 2018-10-07 | In ImageMagick 7.0.8-13 Q16, there is a heap-based buffer over-read in the EncodeImage function of coders/pict.c, which allows attackers to cause a denial of s… |
CVE-2018-18024 | Medium | 6.5 | 2018-10-07 | In ImageMagick 7.0.8-13 Q16, there is an infinite loop in the ReadBMPImage function of the coders/bmp.c file. Remote attackers could leverage this vulnerabilit… |
CVE-2018-18023 | Medium | 6.5 | 2018-10-07 | In ImageMagick 7.0.8-13 Q16, there is a heap-based buffer over-read in the SVGStripString function of coders/svg.c, which allows attackers to cause a denial of… |
CVE-2018-18021 | High | 7.1 | 2018-10-07 | arch/arm64/kvm/guest.c in KVM in the Linux kernel before 4.18.12 on the arm64 platform mishandles the KVM_SET_ON_REG ioctl. This is exploitable by attackers wh… |
CVE-2018-18020 | Low | 3.3 | 2018-10-06 | In QPDF 8.2.1, in libqpdf/QPDFWriter.cc, QPDFWriter::unparseObject and QPDFWriter::unparseChild have recursive calls for a long time, which allows remote attac… |
CVE-2018-17456 | Critical | 9.8 | 2018-10-06 | Git before 2.14.5, 2.15.x before 2.15.3, 2.16.x before 2.16.5, 2.17.x before 2.17.2, 2.18.x before 2.18.1, and 2.19.x before 2.19.1 allows remote code executio… |
CVE-2018-15763 | Critical | 9.0 | 2018-10-05 | Pivotal Container Service, versions prior to 1.2.0, contains an information disclosure vulnerability which exposes IaaS credentials to application logs. A mali… |
CVE-2018-13042 | Medium | 5.9 | 2018-10-05 | The 1Password application 6.8 for Android is affected by a Denial Of Service vulnerability. By starting the activity com.agilebits.onepassword.filling.openyolo… |
CVE-2018-1264 | Critical | 9.1 | 2018-10-05 | Cloud Foundry Log Cache, versions prior to 1.1.1, logs its UAA client secret on startup as part of its envstruct report. A remote attacker who has gained acces… |
CVE-2018-11083 | High | 8.1 | 2018-10-05 | Cloud Foundry BOSH, versions v264 prior to v264.14.0 and v265 prior to v265.7.0 and v266 prior to v266.8.0 and v267 prior to v267.2.0, allows refresh tokens to… |
CVE-2018-11082 | Medium | 6.6 | 2018-10-05 | Cloud Foundry UAA, all versions prior to 4.20.0 and Cloud Foundry UAA Release, all versions prior to 61.0, allows brute forcing of MFA codes. A remote unauthen… |
CVE-2018-11081 | High | 7.9 | 2018-10-05 | Pivotal Operations Manager, versions 2.2.x prior to 2.2.1, 2.1.x prior to 2.1.11, 2.0.x prior to 2.0.16, and 1.11.x prior to 2, fails to write the Operations M… |
CVE-2018-11064 | High | 7.8 | 2018-10-05 | Dell EMC Unity OE versions 4.3.0.x and 4.3.1.x and UnityVSA OE versions 4.3.0.x and 4.3.1.x contains an Incorrect File Permissions vulnerability. A locally aut… |
CVE-2018-11797 | Medium | 5.5 | 2018-10-05 | In Apache PDFBox 1.8.0 to 1.8.15 and 2.0.0RC1 to 2.0.11, a carefully crafted PDF file can trigger an extremely long running computation when parsing the page t… |
CVE-2018-11778 | High | 8.8 | 2018-10-05 | UnixAuthenticationService in Apache Ranger 1.2.0 was updated to correctly handle user input to avoid Stack-based buffer overflow. Versions prior to 1.2.0 shoul… |
CVE-2018-18016 | Medium | 6.5 | 2018-10-05 | ImageMagick 7.0.7-28 has a memory leak vulnerability in WritePCXImage in coders/pcx.c. |
CVE-2018-0405 | High | 7.5 | 2018-10-05 | A vulnerability in the web framework code for Cisco RV180W Wireless-N Multifunction VPN Router and Small Business RV Series RV220W Wireless Network Security Fi… |
CVE-2018-0464 | High | 8.1 | 2018-10-05 | A vulnerability in Cisco Data Center Network Manager software could allow an authenticated, remote attacker to conduct directory traversal attacks and gain acc… |
CVE-2018-0404 | High | 7.5 | 2018-10-05 | A vulnerability in the web framework code for Cisco RV180W Wireless-N Multifunction VPN Router and Small Business RV Series RV220W Wireless Network Security Fi… |
CVE-2018-15436 | Medium | 6.1 | 2018-10-05 | A vulnerability in the web-based management interface of Cisco Webex Events Center, Cisco Webex Meeting Center, Cisco Webex Support Center, and Cisco Webex Tra… |
CVE-2018-15434 | Medium | 6.1 | 2018-10-05 | A vulnerability in the web-based management interface of Cisco Unified IP Phone 7900 Series could allow an unauthenticated, remote attacker to conduct a cross-… |
CVE-2018-15433 | Medium | 4.3 | 2018-10-05 | A vulnerability in the server backup function of Cisco Prime Infrastructure could allow an authenticated, remote attacker to view sensitive information. The vu… |
CVE-2018-15432 | Medium | 4.3 | 2018-10-05 | A vulnerability in the server backup function of Cisco Prime Infrastructure could allow an authenticated, remote attacker to view sensitive information. The vu… |
CVE-2018-15431 | High | 7.3 | 2018-10-05 | A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could allow an attacker to e… |
CVE-2018-15430 | High | 7.2 | 2018-10-05 | A vulnerability in the administrative web interface of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an authentic… |
CVE-2018-15429 | Medium | 5.3 | 2018-10-05 | A vulnerability in the web-based UI of Cisco HyperFlex HX Data Platform Software could allow an unauthenticated, remote attacker to access sensitive informatio… |
CVE-2018-15428 | Medium | 6.8 | 2018-10-05 | A vulnerability in the implementation of Border Gateway Protocol (BGP) functionality in Cisco IOS XR Software could allow an unauthenticated, remote attacker t… |
CVE-2018-15427 | Critical | 9.8 | 2018-10-05 | A vulnerability in Cisco Video Surveillance Manager (VSM) Software running on certain Cisco Connected Safety and Security Unified Computing System (UCS) platfo… |
CVE-2018-15426 | Medium | 4.8 | 2018-10-05 | A vulnerability in the web-based interface of Cisco Unity Connection could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XS… |
CVE-2018-15425 | Medium | 4.7 | 2018-10-05 | A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to execute arbitrar… |
CVE-2018-15424 | Medium | 4.7 | 2018-10-05 | A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to execute arbitrar… |
CVE-2018-15423 | Medium | 4.7 | 2018-10-05 | A vulnerability in the web UI of Cisco HyperFlex Software could allow an unauthenticated, remote attacker to affect the integrity of a device via a clickjackin… |
CVE-2018-15422 | High | 7.8 | 2018-10-05 | A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could allow an attacker to e… |
CVE-2018-15421 | High | 7.8 | 2018-10-05 | A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could allow an attacker to e… |
CVE-2018-15420 | High | 7.8 | 2018-10-05 | A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could allow an attacker to e… |
CVE-2018-15419 | High | 7.8 | 2018-10-05 | A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could allow an attacker to e… |
CVE-2018-15418 | High | 7.8 | 2018-10-05 | A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could allow an attacker to e… |
CVE-2018-15417 | High | 7.8 | 2018-10-05 | A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could allow an attacker to e… |
CVE-2018-15416 | High | 7.8 | 2018-10-05 | A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could allow an attacker to e… |
CVE-2018-15415 | High | 7.8 | 2018-10-05 | A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could allow an attacker to e… |
CVE-2018-15414 | High | 7.8 | 2018-10-05 | A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could allow an attacker to e… |
CVE-2018-15413 | High | 7.8 | 2018-10-05 | A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could allow an attacker to e… |
CVE-2018-15412 | High | 7.8 | 2018-10-05 | A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could allow an attacker to e… |
CVE-2018-15411 | High | 7.8 | 2018-10-05 | A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could allow an attacker to e… |
CVE-2018-15410 | High | 7.8 | 2018-10-05 | A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could allow an attacker to e… |
CVE-2018-15409 | High | 7.8 | 2018-10-05 | A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could allow an attacker to e… |
CVE-2018-15408 | High | 7.8 | 2018-10-05 | A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could allow an attacker to e… |
CVE-2018-15407 | Medium | 5.5 | 2018-10-05 | A vulnerability in the installation process of Cisco HyperFlex Software could allow an authenticated, local attacker to read sensitive information. The vulnera… |
CVE-2018-15406 | Medium | 6.1 | 2018-10-05 | A vulnerability in the web-based management interface of Cisco UCS Director could allow an unauthenticated, remote attacker to conduct a stored cross-site scri… |
CVE-2018-15405 | Medium | 6.5 | 2018-10-05 | A vulnerability in the web interface for specific feature sets of Cisco Integrated Management Controller (IMC) Supervisor and Cisco UCS Director could allow an… |
CVE-2018-15404 | Medium | 6.5 | 2018-10-05 | A vulnerability in the web interface of Cisco Integrated Management Controller (IMC) Supervisor and Cisco UCS Director could allow an authenticated, remote att… |
CVE-2018-15403 | Medium | 5.4 | 2018-10-05 | A vulnerability in the web interface of Cisco Emergency Responder, Cisco Unified Communications Manager, Cisco Unified Communications Manager IM & Presence Ser… |
CVE-2018-15401 | Medium | 6.5 | 2018-10-05 | A vulnerability in the web-based management interface of Cisco Hosted Collaboration Mediation Fulfillment could allow an unauthenticated, remote attacker to co… |
CVE-2018-15400 | Medium | 6.1 | 2018-10-05 | A vulnerability in the web-based management interface of Cisco Cloud Services Platform 2100 could allow an unauthenticated, remote attacker to conduct a cross-… |
CVE-2018-15399 | Medium | 6.8 | 2018-10-05 | A vulnerability in the TCP syslog module of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an u… |
CVE-2018-15398 | Medium | 4.0 | 2018-10-05 | A vulnerability in the per-user-override feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could al… |
CVE-2018-15397 | Medium | 6.8 | 2018-10-05 | A vulnerability in the implementation of Traffic Flow Confidentiality (TFC) over IPsec functionality in Cisco Adaptive Security Appliance (ASA) Software and Ci… |
CVE-2018-15396 | Medium | 6.8 | 2018-10-05 | A vulnerability in the Bulk Administration Tool (BAT) for Cisco Unity Connection could allow an authenticated, remote attacker to cause high disk utilization… |
CVE-2018-15392 | Medium | 4.3 | 2018-10-05 | A vulnerability in the DHCP service of Cisco Industrial Network Director could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) c… |
CVE-2018-15391 | High | 7.5 | 2018-10-05 | A vulnerability in certain IPv4 fragment-processing functions of Cisco Remote PHY Software could allow an unauthenticated, remote attacker to impact traffic pa… |
CVE-2018-15390 | Medium | 6.8 | 2018-10-05 | A vulnerability in the FTP inspection engine of Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause an affec… |
CVE-2018-15389 | Critical | 9.8 | 2018-10-05 | A vulnerability in the install function of Cisco Prime Collaboration Provisioning (PCP) could allow an unauthenticated, remote attacker to access the administr… |
CVE-2018-15387 | Critical | 9.8 | 2018-10-05 | A vulnerability in the Cisco SD-WAN Solution could allow an unauthenticated, remote attacker to bypass certificate validation on an affected device. The vulner… |
CVE-2018-15386 | Critical | 9.8 | 2018-10-05 | A vulnerability in Cisco Digital Network Architecture (DNA) Center could allow an unauthenticated, remote attacker to bypass authentication and have direct una… |
CVE-2018-15383 | High | 7.5 | 2018-10-05 | A vulnerability in the cryptographic hardware accelerator driver of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) S… |
CVE-2018-15382 | High | 8.6 | 2018-10-05 | A vulnerability in Cisco HyperFlex Software could allow an unauthenticated, remote attacker to generate valid, signed session tokens. The vulnerability is due… |
CVE-2018-15379 | Critical | 9.8 | 2018-10-05 | A vulnerability in which the HTTP web server for Cisco Prime Infrastructure (PI) has unrestricted directory permissions could allow an unauthenticated, remote… |
CVE-2018-15377 | High | 8.6 | 2018-10-05 | A vulnerability in the Cisco Network Plug and Play agent, also referred to as the Cisco Open Plug-n-Play agent, of Cisco IOS Software and Cisco IOS XE Software… |
CVE-2018-15376 | Medium | 6.7 | 2018-10-05 | A vulnerability in the embedded test subsystem of Cisco IOS Software for Cisco 800 Series Industrial Integrated Services Routers could allow an authenticated… |
CVE-2018-15375 | Medium | 6.7 | 2018-10-05 | A vulnerability in the embedded test subsystem of Cisco IOS Software for Cisco 800 Series Industrial Integrated Services Routers could allow an authenticated… |
CVE-2018-15374 | Medium | 6.7 | 2018-10-05 | A vulnerability in the Image Verification feature of Cisco IOS XE Software could allow an authenticated, local attacker to install a malicious software image o… |
CVE-2018-15373 | High | 7.4 | 2018-10-05 | A vulnerability in the implementation of Cisco Discovery Protocol functionality in Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated… |
CVE-2018-15372 | High | 8.1 | 2018-10-05 | A vulnerability in the MACsec Key Agreement (MKA) using Extensible Authentication Protocol-Transport Layer Security (EAP-TLS) functionality of Cisco IOS XE Sof… |
CVE-2018-15371 | Medium | 6.7 | 2018-10-05 | A vulnerability in the shell access request mechanism of Cisco IOS XE Software could allow an authenticated, local attacker to bypass authentication and gain u… |
CVE-2018-15370 | Medium | 6.8 | 2018-10-05 | A vulnerability in Cisco IOS ROM Monitor (ROMMON) Software for Cisco Catalyst 6800 Series Switches could allow an unauthenticated, local attacker to bypass Cis… |
CVE-2018-15369 | Medium | 6.8 | 2018-10-05 | A vulnerability in the TACACS+ client subsystem of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an aff… |
CVE-2018-15368 | Medium | 6.7 | 2018-10-05 | A vulnerability in the CLI parser of Cisco IOS XE Software could allow an authenticated, local attacker to gain access to the underlying Linux shell of an affe… |
CVE-2018-0485 | High | 8.6 | 2018-10-05 | A vulnerability in the SM-1T3/E3 firmware on Cisco Second Generation Integrated Services Routers (ISR G2) and the Cisco 4451-X Integrated Services Router (ISR4… |
CVE-2018-0481 | Medium | 6.7 | 2018-10-05 | A vulnerability in the CLI parser of Cisco IOS XE Software could allow an authenticated, local attacker to execute commands on the underlying Linux shell of an… |
CVE-2018-0480 | Medium | 6.1 | 2018-10-05 | A vulnerability in the errdisable per VLAN feature of Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to cause the device to crash, lea… |
CVE-2018-0477 | Medium | 6.7 | 2018-10-05 | A vulnerability in the CLI parser of Cisco IOS XE Software could allow an authenticated, local attacker to execute commands on the underlying Linux shell of an… |
CVE-2018-0476 | Medium | 5.9 | 2018-10-05 | A vulnerability in the Network Address Translation (NAT) Session Initiation Protocol (SIP) Application Layer Gateway (ALG) of Cisco IOS XE Software could allow… |
CVE-2018-0475 | High | 7.4 | 2018-10-05 | A vulnerability in the implementation of the cluster feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, adjacent attacker… |
CVE-2018-0473 | High | 8.6 | 2018-10-05 | A vulnerability in the Precision Time Protocol (PTP) subsystem of Cisco IOS Software could allow an unauthenticated, remote attacker to cause a denial of servi… |