2018 CVEs (page 7)
Page 7 of 162 — CVEs published in 2018, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2018-1110 | High | 7.5 | 2021-03-30 | A flaw was found in knot-resolver before version 2.3.0. Malformed DNS messages may cause denial of service. |
CVE-2018-1109 | Medium | 5.3 | 2021-03-30 | A vulnerability was found in Braces versions 2.2.0 and above, prior to 2.3.1. Affected versions of this package are vulnerable to Regular Expression Denial of… |
CVE-2018-1107 | Medium | 5.3 | 2021-03-30 | It was discovered that the is-my-json-valid JavaScript library used an inefficient regular expression to validate JSON fields defined to have email format. A s… |
CVE-2018-25004 | Medium | 4.9 | 2021-03-01 | A user authorized to performing a specific type of query may trigger a denial of service by issuing a generic explain command on a find query. This issue affec… |
CVE-2018-9333 | High | 7.8 | 2021-01-11 | K7Computing Pvt Ltd K7AntiVirus Premium 15.1.0.53 is affected by: Buffer Overflow. The impact is: execute arbitrary code (local). The component is: K7TSMngr.ex… |
CVE-2018-9332 | High | 7.8 | 2021-01-11 | K7Computing Pvt Ltd K7AntiVirus Premium 15.01.00.53 is affected by: Incorrect Access Control. The impact is: gain privileges (local). |
CVE-2018-8726 | High | 7.8 | 2021-01-11 | K7Computing Pvt Ltd K7Antivirus Premium 15.1.0.53 is affected by: Buffer Overflow. The impact is: execute arbitrary code (local). The component is: K7TSMngr.ex… |
CVE-2018-8725 | High | 7.8 | 2021-01-11 | K7Computing Pvt Ltd K7AntiVirus Premium 15.01.00.53 is affected by: Buffer Overflow. The impact is: execute arbitrary code (local). The component is: K7TSMngr… |
CVE-2018-8724 | High | 7.8 | 2021-01-11 | K7Computing Pvt Ltd K7AntiVirus Premium 15.1.0.53 is affected by: Incorrect Access Control. The impact is: gain privileges (local). The component is: K7TSMngr… |
CVE-2018-8044 | High | 7.8 | 2021-01-11 | K7Computing Pvt Ltd K7Antivirus Premium 15.1.0.53 is affected by: Incorrect Access Control. The impact is: Local Process Execution (local). The component is: K… |
CVE-2018-11246 | High | 7.5 | 2021-01-11 | K7TSMngr.exe in K7Computing K7AntiVirus Premium 15.1.0.53 has a Memory Leak. |
CVE-2018-11010 | High | 7.8 | 2021-01-11 | A Buffer Overflow issue was discovered in K7Computing K7AntiVirus Premium 15.01.00.53. |
CVE-2018-11009 | High | 7.8 | 2021-01-11 | A Buffer Overflow issue was discovered in K7Computing K7AntiVirus Premium 15.01.00.53. |
CVE-2018-11008 | Medium | 5.5 | 2021-01-11 | An Incorrect Access Control issue was discovered in K7Computing K7AntiVirus Premium 15.01.00.53. |
CVE-2018-11007 | Medium | 5.5 | 2021-01-11 | A Memory Leak issue was discovered in K7Computing K7AntiVirus Premium 15.01.00.53. |
CVE-2018-11006 | Medium | 5.5 | 2021-01-11 | An Incorrect Access Control issue was discovered in K7Computing K7AntiVirus Premium 15.01.00.53. |
CVE-2018-11005 | Medium | 5.5 | 2021-01-11 | A Memory Leak issue was discovered in K7Computing K7AntiVirus Premium 15.01.00.53. |
CVE-2018-20316 | High | 8.1 | 2021-01-07 | Foxit Reader before 9.5, and PhantomPDF before 8.3.10 and 9.x before 9.5, has a proxyDoAction race condition that can cause a stack-based buffer overflow or an… |
CVE-2018-20315 | High | 8.1 | 2021-01-07 | Foxit Reader before 9.5, and PhantomPDF before 8.3.10 and 9.x before 9.5, has a race condition that can cause a stack-based buffer overflow or an out-of-bounds… |
CVE-2018-20314 | High | 8.1 | 2021-01-07 | Foxit Reader before 9.5, and PhantomPDF before 8.3.10 and 9.x before 9.5, has a proxyCheckLicence race condition that can cause a stack-based buffer overflow o… |
CVE-2018-20313 | High | 8.1 | 2021-01-07 | Foxit Reader before 9.5, and PhantomPDF before 8.3.10 and 9.x before 9.5, has a proxyPreviewAction race condition that can cause a stack-based buffer overflow… |
CVE-2018-18689 | Medium | 5.3 | 2021-01-07 | The Portable Document Format (PDF) specification does not provide any information regarding the concrete procedure of how to validate signatures. Consequently… |
CVE-2018-18688 | Medium | 5.3 | 2021-01-07 | The Portable Document Format (PDF) specification does not provide any information regarding the concrete procedure of how to validate signatures. Consequently… |
CVE-2018-20312 | High | 8.1 | 2021-01-07 | Foxit Reader before 9.5, and PhantomPDF before 8.3.10 and 9.x before 9.5, has a proxyDoAction race condition that can cause a stack-based buffer overflow or an… |
CVE-2018-20311 | High | 8.1 | 2021-01-07 | Foxit Reader before 9.5, and PhantomPDF before 8.3.10 and 9.x before 9.5, has a proxyCPDFAction race condition that can cause a stack-based buffer overflow or… |
CVE-2018-20310 | High | 8.1 | 2021-01-07 | Foxit Reader before 9.5, and PhantomPDF before 8.3.10 and 9.x before 9.5, has a proxyDoAction race condition that can cause a stack-based buffer overflow or an… |
CVE-2018-20309 | High | 8.1 | 2021-01-07 | Foxit Reader before 9.5, and PhantomPDF before 8.3.10 and 9.x before 9.5, has a proxyGetAppEdition race condition that can cause a stack-based buffer overflow… |
CVE-2018-19418 | High | 7.8 | 2021-01-07 | Foxit PDF ActiveX before 5.5.1 allows remote code execution via command injection because of the lack of a security permission control. |
CVE-2018-25002 | High | 8.8 | 2021-01-01 | uploader.php in the KCFinder integration project through 2018-06-01 for Drupal mishandles validation, aka SA-CONTRIB-2018-024. NOTE: This project is not covere… |
CVE-2018-19945 | Critical | 9.1 | 2020-12-31 | A vulnerability has been reported to affect earlier QNAP devices running QTS 4.3.4 to 4.3.6. Caused by improper limitations of a pathname to a restricted direc… |
CVE-2018-19944 | High | 7.5 | 2020-12-31 | A cleartext transmission of sensitive information vulnerability has been reported to affect certain QTS devices. If exploited, this vulnerability allows a remo… |
CVE-2018-19941 | High | 7.5 | 2020-12-31 | A vulnerability has been reported to affect QNAP NAS. If exploited, this vulnerability allows an attacker to access sensitive information stored in cleartext i… |
CVE-2018-25001 | Medium | 6.5 | 2020-12-31 | An issue was discovered in the libpulse-binding crate before 2.5.0 for Rust. proplist::Iterator can cause a use-after-free. |
CVE-2018-16795 | High | 8.8 | 2020-12-31 | OpenEMR 5.0.1.3 allows Cross-Site Request Forgery (CSRF) via library/ajax and interface/super, as demonstrated by use of interface/super/manage_site_files.php… |
CVE-2018-14067 | Critical | 9.8 | 2020-12-31 | Green Packet WiMax DV-360 2.10.14-g1.0.6.1 devices allow Command Injection, with unauthenticated remote command execution, via a crafted payload to the HTTPS p… |
CVE-2018-1000893 | High | 7.5 | 2020-12-23 | Bitcoin SV before 0.1.1 allows uncontrolled resource consumption when deserializing transactions. |
CVE-2018-1000892 | High | 7.5 | 2020-12-23 | Bitcoin SV before 0.1.1 allows uncontrolled resource consumption when receiving sendheaders messages. |
CVE-2018-1000891 | High | 7.5 | 2020-12-23 | Bitcoin SV before 0.1.1 allows uncontrolled resource consumption when receiving messages with invalid checksums. |
CVE-2018-15645 | Medium | 6.5 | 2020-12-22 | Improper access control in message routing in Odoo Community 12.0 and earlier and Odoo Enterprise 12.0 and earlier allows remote authenticated users to create… |
CVE-2018-15641 | Medium | 5.4 | 2020-12-22 | Cross-site scripting (XSS) issue in web module in Odoo Community 11.0 through 14.0 and Odoo Enterprise 11.0 through 14.0, allows remote authenticated internal… |
CVE-2018-15638 | Medium | 5.4 | 2020-12-22 | Cross-site scripting (XSS) issue in mail module in Odoo Community 13.0 and earlier and Odoo Enterprise 13.0 and earlier, allows remote attackers to inject arbi… |
CVE-2018-15634 | Medium | 6.1 | 2020-12-22 | Cross-site scripting (XSS) issue in attachment management in Odoo Community 14.0 and earlier and Odoo Enterprise 14.0 and earlier, allows remote attackers to i… |
CVE-2018-15633 | Medium | 6.1 | 2020-12-22 | Cross-site scripting (XSS) issue in "document" module in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier, allows remote attackers to injec… |
CVE-2018-15632 | Critical | 9.1 | 2020-12-22 | Improper input validation in database creation logic in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier, allows remote attackers to initia… |
CVE-2018-7580 | High | 7.5 | 2020-12-21 | Philips Hue is vulnerable to a Denial of Service attack. Sending a SYN flood on port tcp/80 will freeze Philips Hue's hub and it will stop responding. The "hub… |
CVE-2018-16243 | Medium | 5.4 | 2020-12-15 | SolarWinds Database Performance Analyzer (DPA) 11.1.468 and 12.0.3074 have several persistent XSS vulnerabilities, related to logViewer.iwc, centralManage.cen… |
CVE-2018-21270 | Medium | 6.5 | 2020-12-03 | Versions less than 0.0.6 of the Node.js stringstream module are vulnerable to an out-of-bounds read because of allocation of uninitialized buffers when a numbe… |
CVE-2018-16723 | High | 7.8 | 2020-11-23 | In Jingyun Antivirus v2.4.2.39, the driver file (ZySandbox.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impac… |
CVE-2018-16722 | High | 7.8 | 2020-11-23 | In Jingyun Antivirus v2.4.2.39, the driver file (ZySandbox.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impac… |
CVE-2018-16721 | High | 7.8 | 2020-11-23 | In Jingyun Antivirus v2.4.2.39, the driver file (ZySandbox.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impac… |
CVE-2018-16720 | High | 7.8 | 2020-11-23 | In Jingyun Antivirus v2.4.2.39, the driver file (ZySandbox.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impac… |
CVE-2018-16719 | High | 7.8 | 2020-11-23 | In Jingyun Antivirus v2.4.2.39, the driver file (hookbody.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact… |
CVE-2018-20803 | Medium | 6.5 | 2020-11-23 | A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries, which loop indefinitely in mathematics proces… |
CVE-2018-20805 | Medium | 6.5 | 2020-11-23 | A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries, which perform an $elemMatch . This issue affe… |
CVE-2018-20804 | Medium | 6.5 | 2020-11-23 | A user authorized to perform database queries may trigger denial of service by issuing specially crafted applyOps invocations. This issue affects MongoDB Serve… |
CVE-2018-20802 | Medium | 6.5 | 2020-11-23 | A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries with compound indexes affecting QueryPlanner… |
CVE-2018-1725 | Low | 2.3 | 2020-11-05 | IBM QRadar SIEM 7.3 and 7.4 n a multi tenant configuration could be vulnerable to information disclosure. IBM X-Force ID: 147440. |
CVE-2018-19025 | Critical | 9.8 | 2020-11-02 | In JUUKO K-808, an attacker could specially craft a packet that encodes an arbitrary command, which could be executed on the K-808 (Firmware versions prior to… |
CVE-2018-17932 | Critical | 9.8 | 2020-11-02 | JUUKO K-800 (Firmware versions prior to numbers ending ...9A, ...9B, ...9C, etc.) is vulnerable to a replay attack and command forgery, which could allow attac… |
CVE-2018-19956 | Medium | 6.1 | 2020-11-02 | The cross-site scripting vulnerability has been reported to affect earlier versions of Photo Station. If exploited, the vulnerability could allow remote attack… |
CVE-2018-19955 | Medium | 6.1 | 2020-11-02 | The cross-site scripting vulnerability has been reported to affect earlier versions of Photo Station. If exploited, the vulnerability could allow remote attack… |
CVE-2018-19954 | Medium | 6.1 | 2020-11-02 | The cross-site scripting vulnerability has been reported to affect earlier versions of Photo Station. If exploited, the vulnerability could allow remote attack… |
CVE-2018-19952 | High | 7.5 | 2020-11-02 | If exploited, this SQL injection vulnerability could allow remote attackers to obtain application information. This issue affects: QNAP Systems Inc. Music Stat… |
CVE-2018-19951 | Medium | 6.1 | 2020-11-02 | If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. This issue affects: QNAP Systems Inc. Music Statio… |
CVE-2018-19950 | Critical | 9.8 | 2020-11-02 | If exploited, this command injection vulnerability could allow remote attackers to execute arbitrary commands. This issue affects: QNAP Systems Inc. Music Stat… |
CVE-2018-19953 | Medium | 6.1 | 2020-10-28 | If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. QNAP has already fixed the issue in the following… |
CVE-2018-19949 | Critical | 9.8 | 2020-10-28 | If exploited, this command injection vulnerability could allow remote attackers to run arbitrary commands. QNAP has already fixed the issue in the following QT… |
CVE-2018-19943 | High | 8.0 | 2020-10-28 | If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. QNAP has already fixed these issues in the followi… |
CVE-2018-4474 | High | 7.5 | 2020-10-27 | A memory consumption issue was addressed with improved memory handling. This issue is fixed in iCloud for Windows 7.7, watchOS 5, Safari 12, iOS 12, iTunes 12… |
CVE-2018-4468 | Medium | 5.5 | 2020-10-27 | This issue was addressed by removing additional entitlements. This issue is fixed in macOS Mojave 10.14.1, Security Update 2018-002 High Sierra, Security Updat… |
CVE-2018-4467 | High | 7.8 | 2020-10-27 | A memory corruption issue was addressed with improved state management. This issue is fixed in macOS Mojave 10.14.3, Security Update 2019-001 High Sierra, Secu… |
CVE-2018-4452 | High | 7.8 | 2020-10-27 | A memory consumption issue was addressed with improved memory handling. This issue is fixed in macOS Mojave 10.14.3, Security Update 2019-001 High Sierra, Secu… |
CVE-2018-4451 | High | 7.8 | 2020-10-27 | This issue is fixed in macOS Mojave 10.14. A memory corruption issue was addressed with improved input validation. |
CVE-2018-4448 | Medium | 5.5 | 2020-10-27 | A memory initialization issue was addressed with improved memory handling. This issue is fixed in macOS Mojave 10.14.4, Security Update 2019-002 High Sierra, S… |
CVE-2018-4444 | Medium | 6.5 | 2020-10-27 | A logic issue was addressed with improved state management. This issue is fixed in Safari 12.0.2, iOS 12.1.1, tvOS 12.1.1, iTunes 12.9.2 for Windows. Processin… |
CVE-2018-4433 | Medium | 5.5 | 2020-10-27 | A configuration issue was addressed with additional restrictions. This issue is fixed in macOS Mojave 10.14.4, Security Update 2019-002 High Sierra, Security U… |
CVE-2018-4428 | High | 7.1 | 2020-10-27 | A lock screen issue allowed access to the share function on a locked device. This issue was addressed by restricting options offered on a locked device. This i… |
CVE-2018-4391 | Medium | 5.5 | 2020-10-27 | An inconsistent user interface issue was addressed with improved state management. This issue is fixed in macOS High Sierra 10.13.1, Security Update 2017-001 S… |
CVE-2018-4390 | Medium | 5.5 | 2020-10-27 | An inconsistent user interface issue was addressed with improved state management. This issue is fixed in macOS High Sierra 10.13.1, Security Update 2017-001 S… |
CVE-2018-4381 | Medium | 5.5 | 2020-10-27 | A resource exhaustion issue was addressed with improved input validation. This issue is fixed in tvOS 12.1, iOS 12.1. Processing a maliciously crafted message… |
CVE-2018-4339 | Medium | 5.5 | 2020-10-27 | This issue was addressed with a new entitlement. This issue is fixed in iOS 12.1. A local user may be able to read a persistent device identifier. |
CVE-2018-4296 | Critical | 9.8 | 2020-10-27 | This issue is fixed in macOS Mojave 10.14. A permissions issue existed in DiskArbitration. This was addressed with additional ownership checks. |
CVE-2018-21269 | Medium | 5.5 | 2020-10-27 | checkpath in OpenRC through 0.42.1 might allow local users to take ownership of arbitrary files because a non-terminal path component can be a symlink. |
CVE-2018-8062 | Medium | 5.4 | 2020-10-23 | A cross-site scripting (XSS) vulnerability on Comtrend AR-5387un devices with A731-410JAZ-C04_R02.A2pD035g.d23i firmware allows remote attackers to inject arbi… |
CVE-2018-18508 | Medium | 6.5 | 2020-10-22 | In Network Security Services (NSS) before 3.36.7 and before 3.41.1, a malformed signature can cause a crash due to a null dereference, resulting in a Denial of… |
CVE-2018-11764 | High | 8.8 | 2020-10-21 | Web endpoint authentication check is broken in Apache Hadoop 3.0.0-alpha4, 3.0.0-beta1, and 3.0.0. Authenticated users may impersonate any user even if no prox… |
CVE-2018-20243 | High | 7.5 | 2020-10-13 | The implementation of POST with the username and password in the URL parameters exposed the credentials. More infomration is available in fineract jira issues… |
CVE-2018-5354 | High | 8.8 | 2020-09-30 | The custom GINA/CP module in ANIXIS Password Reset Client before version 3.22 allows remote attackers to execute code and escalate privileges via spoofing. Whe… |
CVE-2018-5353 | Critical | 9.8 | 2020-09-30 | The custom GINA/CP module in Zoho ManageEngine ADSelfService Plus before 5.5 build 5517 allows remote attackers to execute code and escalate privileges via spo… |
CVE-2018-11765 | High | 7.5 | 2020-09-30 | In Apache Hadoop versions 3.0.0-alpha2 to 3.0.0, 2.9.0 to 2.9.2, 2.8.0 to 2.8.5, any users can access some servlets without authentication when Kerberos authen… |
CVE-2018-6449 | Medium | 6.1 | 2020-09-25 | Host Header Injection vulnerability in the http management interface in Brocade Fabric OS versions before v9.0.0 could allow a remote attacker to exploit this… |
CVE-2018-6448 | High | 7.5 | 2020-09-25 | A vulnerability in the management interface in Brocade Fabric OS Versions before Brocade Fabric OS v9.0.0 could allow a remote attacker to perform a denial of… |
CVE-2018-6447 | Medium | 5.4 | 2020-09-25 | A Reflective XSS Vulnerability in HTTP Management Interface in Brocade Fabric OS versions before Brocade Fabric OS v9.0.0, v8.2.2c, v8.2.1e, v8.1.2k, v8.2.0_CB… |
CVE-2018-10585 | High | 7.5 | 2020-09-25 | Pexip Infinity before 18 allows remote Denial of Service (XML parsing). |
CVE-2018-10432 | High | 7.5 | 2020-09-25 | Pexip Infinity before 18 allows Remote Denial of Service (TLS handshakes in RTMP). |
CVE-2018-20432 | Critical | 9.8 | 2020-09-14 | D-Link COVR-2600R and COVR-3902 Kit before 1.01b05Beta01 use hardcoded credentials for telnet connection, which allows unauthenticated attackers to gain privil… |
CVE-2018-19948 | Low | 2.0 | 2020-09-11 | The vulnerability have been reported to affect earlier versions of Helpdesk. If exploited, this cross-site request forgery (CSRF) vulnerability could allow att… |
CVE-2018-19947 | Medium | 4.3 | 2020-09-11 | The vulnerability have been reported to affect earlier versions of Helpdesk. If exploited, this information exposure vulnerability could disclose sensitive inf… |
CVE-2018-19946 | Medium | 4.2 | 2020-09-11 | The vulnerability have been reported to affect earlier versions of Helpdesk. If exploited, this improper certificate validation vulnerability could allow an at… |
CVE-2018-17145 | High | 7.5 | 2020-09-10 | Bitcoin Core 0.16.x before 0.16.2 and Bitcoin Knots 0.16.x before 0.16.2 allow remote denial of service via a flood of multiple transaction inv messages with r… |