2018 CVEs (page 70)
Page 70 of 162 — CVEs published in 2018, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2018-0472 | High | 8.6 | 2018-10-05 | A vulnerability in the IPsec driver code of multiple Cisco IOS XE Software platforms and the Cisco ASA 5500-X Series Adaptive Security Appliance (ASA) could al… |
CVE-2018-0471 | High | 7.4 | 2018-10-05 | A vulnerability in the Cisco Discovery Protocol (CDP) module of Cisco IOS XE Software Releases 16.6.1 and 16.6.2 could allow an unauthenticated, adjacent attac… |
CVE-2018-0470 | High | 8.6 | 2018-10-05 | A vulnerability in the web framework of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a buffer overflow condition on an affect… |
CVE-2018-0469 | Medium | 6.8 | 2018-10-05 | A vulnerability in the web user interface of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload. The v… |
CVE-2018-0467 | High | 8.6 | 2018-10-05 | A vulnerability in the IPv6 processing code of Cisco IOS and IOS XE Software could allow an unauthenticated, remote attacker to cause the device to reload. The… |
CVE-2018-0466 | Medium | 6.5 | 2018-10-05 | A vulnerability in the Open Shortest Path First version 3 (OSPFv3) implementation in Cisco IOS and IOS XE Software could allow an unauthenticated, adjacent att… |
CVE-2018-0465 | Medium | 6.1 | 2018-10-05 | A vulnerability in the web-based management interface of Cisco Small Business 300 Series Managed Switches could allow an unauthenticated, remote attacker to co… |
CVE-2018-0463 | High | 7.5 | 2018-10-05 | A vulnerability in the Cisco Network Plug and Play server component of Cisco Network Services Orchestrator (NSO) could allow an unauthenticated, remote attacke… |
CVE-2018-0462 | Medium | 4.9 | 2018-10-05 | A vulnerability in the user management functionality of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, remote attacker to p… |
CVE-2018-0460 | Medium | 6.5 | 2018-10-05 | A vulnerability in the REST API of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, remote attacker to read any file on an af… |
CVE-2018-0459 | Medium | 6.5 | 2018-10-05 | A vulnerability in the web-based management interface of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, remote attacker to… |
CVE-2018-0458 | Medium | 6.1 | 2018-10-05 | A vulnerability in the web-based management interface of Cisco Prime Collaboration Assurance could allow an unauthenticated, remote attacker to conduct a cross… |
CVE-2018-0457 | Medium | 5.5 | 2018-10-05 | A vulnerability in the Cisco Webex Player for Webex Recording Format (WRF) files could allow an unauthenticated, remote attacker to cause a denial of service (… |
CVE-2018-0455 | High | 7.5 | 2018-10-05 | A vulnerability in the Server Message Block Version 2 (SMBv2) and Version 3 (SMBv3) protocol implementation for the Cisco Firepower System Software could allow… |
CVE-2018-0454 | High | 8.8 | 2018-10-05 | A vulnerability in the web-based management interface of Cisco Cloud Services Platform 2100 could allow an authenticated, remote attacker to perform command in… |
CVE-2018-0453 | High | 8.2 | 2018-10-05 | A vulnerability in the Sourcefire tunnel control channel protocol in Cisco Firepower System Software running on Cisco Firepower Threat Defense (FTD) sensors co… |
CVE-2018-0452 | Medium | 6.1 | 2018-10-05 | A vulnerability in the web-based management interface of Cisco Tetration Analytics could allow an unauthenticated, remote attacker to conduct a cross-site scri… |
CVE-2018-0451 | High | 8.8 | 2018-10-05 | A vulnerability in the web-based management interface of Cisco Tetration Analytics could allow an authenticated, remote attacker to conduct a cross-site reques… |
CVE-2018-0450 | Medium | 6.1 | 2018-10-05 | A vulnerability in the web-based management interface of Cisco Data Center Network Manager could allow an unauthenticated, remote attacker to conduct a cross-s… |
CVE-2018-0448 | Critical | 9.8 | 2018-10-05 | A vulnerability in the identity management service of Cisco Digital Network Architecture (DNA) Center could allow an unauthenticated, remote attacker to bypass… |
CVE-2018-0447 | Medium | 5.3 | 2018-10-05 | A vulnerability in the anti-spam protection mechanisms of Cisco AsyncOS Software for the Cisco Email Security Appliance (ESA) could allow an unauthenticated, r… |
CVE-2018-0446 | High | 8.8 | 2018-10-05 | A vulnerability in the web-based management interface of Cisco Industrial Network Director could allow an unauthenticated, remote attacker to conduct a cross-s… |
CVE-2018-0445 | High | 8.8 | 2018-10-05 | A vulnerability in the web-based management interface of Cisco Packaged Contact Center Enterprise could allow an unauthenticated, remote attacker to conduct a… |
CVE-2018-0444 | Medium | 6.1 | 2018-10-05 | A vulnerability in the web-based management interface of Cisco Packaged Contact Center Enterprise could allow an unauthenticated, remote attacker to conduct a… |
CVE-2018-0440 | High | 7.2 | 2018-10-05 | A vulnerability in the web interface of Cisco Data Center Network Manager could allow an authenticated application administrator to execute commands on the und… |
CVE-2018-0439 | High | 8.8 | 2018-10-05 | A vulnerability in the web-based management interface of Cisco Meeting Server could allow an unauthenticated, remote attacker to conduct a cross-site request f… |
CVE-2018-0438 | High | 7.8 | 2018-10-05 | A vulnerability in the Cisco Umbrella Enterprise Roaming Client (ERC) could allow an authenticated, local attacker to elevate privileges to Administrator. To e… |
CVE-2018-0437 | High | 7.8 | 2018-10-05 | A vulnerability in the Cisco Umbrella Enterprise Roaming Client (ERC) could allow an authenticated, local attacker to elevate privileges to Administrator. To e… |
CVE-2018-0436 | High | 8.7 | 2018-10-05 | A vulnerability in Cisco Webex Teams, formerly Cisco Spark, could allow an authenticated, remote attacker to view and modify data for an organization other tha… |
CVE-2018-0435 | Critical | 9.1 | 2018-10-05 | A vulnerability in the Cisco Umbrella API could allow an authenticated, remote attacker to view and modify data across their organization and other organizatio… |
CVE-2018-0434 | High | 7.4 | 2018-10-05 | A vulnerability in the Zero Touch Provisioning feature of the Cisco SD-WAN Solution could allow an unauthenticated, remote attacker to gain unauthorized access… |
CVE-2018-0433 | High | 7.8 | 2018-10-05 | A vulnerability in the command-line interface (CLI) in the Cisco SD-WAN Solution could allow an authenticated, local attacker to inject arbitrary commands that… |
CVE-2018-0432 | High | 8.8 | 2018-10-05 | A vulnerability in the error reporting feature of the Cisco SD-WAN Solution could allow an authenticated, remote attacker to gain elevated privileges on an aff… |
CVE-2018-0431 | High | 8.8 | 2018-10-05 | A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) Software could allow an authenticated, remote attacker to… |
CVE-2018-0430 | High | 8.8 | 2018-10-05 | A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) Software could allow an authenticated, remote attacker to… |
CVE-2018-0426 | Critical | 9.8 | 2018-10-05 | A vulnerability in the web-based management interface of the Cisco RV110W Wireless-N VPN Firewall, Cisco RV130W Wireless-N Multifunction VPN Router, and Cisco… |
CVE-2018-0425 | Critical | 9.8 | 2018-10-05 | A vulnerability in the web-based management interface of the Cisco RV110W Wireless-N VPN Firewall, Cisco RV130W Wireless-N Multifunction VPN Router, and Cisco… |
CVE-2018-0424 | High | 8.8 | 2018-10-05 | A vulnerability in the web-based management interface of the Cisco RV110W Wireless-N VPN Firewall, Cisco RV130W Wireless-N Multifunction VPN Router, and Cisco… |
CVE-2018-0423 | High | 8.1 | 2018-10-05 | A vulnerability in the web-based management interface of the Cisco RV110W Wireless-N VPN Firewall, Cisco RV130W Wireless-N Multifunction VPN Router, and Cisco… |
CVE-2018-0422 | High | 7.3 | 2018-10-05 | A vulnerability in the folder permissions of Cisco Webex Meetings client for Windows could allow an authenticated, local attacker to modify locally stored file… |
CVE-2018-0421 | High | 8.6 | 2018-10-05 | A vulnerability in TCP connection management in Cisco Prime Access Registrar could allow an unauthenticated, remote attacker to cause a denial of service (DoS)… |
CVE-2018-0414 | Medium | 5.7 | 2018-10-05 | A vulnerability in the web-based UI of Cisco Secure Access Control Server could allow an authenticated, remote attacker to gain read access to certain informat… |
CVE-2018-0197 | Medium | 6.5 | 2018-10-05 | A vulnerability in the VLAN Trunking Protocol (VTP) subsystem of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, adjacent attacker… |
CVE-2018-1812 | Medium | 5.4 | 2018-10-05 | IBM Robotic Process Automation with Automation Anywhere Enterprise 10 is vulnerable to persistent cross-site scripting, caused by missing escaping of a databas… |
CVE-2018-1795 | Medium | 6.1 | 2018-10-05 | IBM Robotic Process Automation with Automation Anywhere Enterprise 10 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary… |
CVE-2018-1783 | Medium | 5.5 | 2018-10-05 | IBM GPFS (IBM Spectrum Scale 4.1.1.0, 4.1.1.20, 4.2.0.0, 4.2.3.10, 5.0.0 and 5.0.1.2) command line utility allows an unprivileged, authenticated user with acce… |
CVE-2018-1723 | Medium | 6.2 | 2018-10-05 | IBM Spectrum Scale 4.1.1.0, 4.1.1.20, 4.2.0.0, 4.2.3.10, 5.0.0 and 5.0.1.2 could allow an unprivileged, authenticated user with access to a GPFS node to read a… |
CVE-2018-1686 | Medium | 5.4 | 2018-10-05 | IBM Maximo Asset Management 7.6 through 7.6.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the… |
CVE-2018-1649 | High | 7.7 | 2018-10-05 | IBM QRadar Incident Forensics 7.2 and 7.3 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL r… |
CVE-2018-1647 | High | 7.5 | 2018-10-05 | IBM QRadar Incident Forensics 7.2 and 7.3 does not properly restrict the size or amount of resources requested which could allow an unauthenticated user to cau… |
CVE-2018-6979 | High | 7.4 | 2018-10-05 | The VMware Workspace ONE Unified Endpoint Management Console (A/W Console) 9.7.x prior to 9.7.0.3, 9.6.x prior to 9.6.0.7, 9.5.x prior to 9.5.0.16, 9.4.x prior… |
CVE-2018-17986 | High | 8.8 | 2018-10-05 | rars/user/data in razorCMS 3.4.8 allows CSRF for changing the password of an admin user. |
CVE-2018-17985 | Medium | 5.5 | 2018-10-04 | An issue was discovered in cp-demangle.c in GNU libiberty, as distributed in GNU Binutils 2.31. There is a stack consumption problem caused by the cplus_demang… |
CVE-2018-17984 | High | 7.8 | 2018-10-04 | An unanchored /[a-z]{2}/ regular expression in ISPConfig before 3.1.13 makes it possible to include arbitrary files, leading to code execution. This is exploit… |
CVE-2018-17983 | Critical | 9.1 | 2018-10-04 | cext/manifest.c in Mercurial before 4.7.2 has an out-of-bounds read during parsing of a malformed manifest entry. |
CVE-2018-17891 | Low | 3.7 | 2018-10-04 | Carestream Vue RIS, RIS Client Builds: Version 11.2 and prior running on a Windows 8.1 machine with IIS/7.5. When contacting a Carestream server where there is… |
CVE-2018-17849 | Medium | 5.4 | 2018-10-04 | Navigate CMS 2.8 has Stored XSS via a navigate_upload.php (aka File Upload) request with a multipart/form-data JavaScript payload. |
CVE-2018-16457 | Medium | 5.3 | 2018-10-04 | PHP Scripts Mall Open Source Real-estate Script 3.6.2 allows remote attackers to list the wp-content/themes/template_dp_dec2015/img directory. |
CVE-2018-16456 | Medium | 6.1 | 2018-10-04 | PHP Scripts Mall Website Seller Script 2.0.5 has XSS via a keyword. NOTE: This may overlap with CVE-2018-6870 which has XSS via the Listings Search feature. |
CVE-2018-16455 | Medium | 6.1 | 2018-10-04 | PHP Scripts Mall Market Place Script 1.0.1 allows XSS via a keyword. |
CVE-2018-16453 | Medium | 6.1 | 2018-10-04 | PHP Scripts Mall Domain Lookup Script 3.0.5 allows XSS in the search bar. |
CVE-2018-16326 | Medium | 6.1 | 2018-10-04 | PHP Scripts Mall Olx Clone 3.4.2 has XSS. |
CVE-2018-13258 | Medium | 5.3 | 2018-10-04 | Mediawiki 1.31 before 1.31.1 misses .htaccess files in the provided tarball used to protect some directories that shouldn't be web accessible. |
CVE-2018-0505 | Medium | 6.5 | 2018-10-04 | Mediawiki 1.31 before 1.31.1, 1.30.1, 1.29.3 and 1.27.5 contains a flaw where BotPasswords can bypass CentralAuth's account lock |
CVE-2018-0504 | Medium | 6.5 | 2018-10-04 | Mediawiki 1.31 before 1.31.1, 1.30.1, 1.29.3 and 1.27.5 contains an information disclosure flaw in the Special:Redirect/logid |
CVE-2018-0503 | Medium | 4.3 | 2018-10-04 | Mediawiki 1.31 before 1.31.1, 1.30.1, 1.29.3 and 1.27.5 contains a flaw where contrary to the documentation, $wgRateLimits entry for 'user' overrides that for… |
CVE-2018-17876 | Medium | 6.1 | 2018-10-04 | A Stored XSS vulnerability has been discovered in the v5.5.0 version of the Coaster CMS product. |
CVE-2018-17872 | High | 8.8 | 2018-10-04 | Verba Collaboration Compliance and Quality Management Platform before 9.2.1.5545 has Insecure Permissions. |
CVE-2018-17871 | Medium | 6.5 | 2018-10-04 | Verba Collaboration Compliance and Quality Management Platform before 9.2.1.5545 has Incorrect Access Control. |
CVE-2018-1819 | Medium | 6.3 | 2018-10-04 | IBM Financial Transaction Manager for Digital Payments for Multi-Platform 3.0.2, 3.0.4, 3.0.6, and 3.2.0 is vulnerable to SQL injection. A remote attacker coul… |
CVE-2018-1670 | Low | 3.1 | 2018-10-04 | IBM Financial Transaction Manager for ACH Services for Multi-Platform 3.0.2 could allow an authenticated user to obtain sensitive product configuration informa… |
CVE-2018-1604 | Medium | 5.4 | 2018-10-04 | IBM Rational Quality Manager (RQM) 5.0 through 5.02 and 6.0 through 6.0.6 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbi… |
CVE-2018-1603 | Medium | 5.4 | 2018-10-04 | IBM Rational Quality Manager (RQM) 5.0 through 5.02 and 6.0 through 6.0.6 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbi… |
CVE-2018-1602 | Medium | 5.4 | 2018-10-04 | IBM Rational Quality Manager (RQM) 5.0 through 5.02 and 6.0 through 6.0.6 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbi… |
CVE-2018-12472 | High | 7.3 | 2018-10-04 | A improper authentication using the HOST header in SUSE Linux SMT allows remote attackers to spoof a sibling server. Affected releases are SUSE Linux SMT: vers… |
CVE-2018-12471 | Medium | 6.5 | 2018-10-04 | A External Entity Reference ('XXE') vulnerability in SUSE Linux SMT allows remote attackers to read data from the server or cause DoS by referencing blocking e… |
CVE-2018-12470 | Critical | 9.8 | 2018-10-04 | A SQL Injection in the RegistrationSharing module of SUSE Linux SMT allows remote attackers to cause execute arbitrary SQL statements. Affected releases are SU… |
CVE-2018-5492 | Critical | 9.8 | 2018-10-04 | NetApp E-Series SANtricity OS Controller Software 11.30 and later version 11.30.5 is susceptible to unauthenticated remote code execution. |
CVE-2018-11784 | Medium | 4.3 | 2018-10-04 | When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 returned a redirect to a directory (e.g. redirectin… |
CVE-2018-17974 | Medium | 5.5 | 2018-10-03 | An issue was discovered in Tcpreplay 4.3.0 beta1. A heap-based buffer over-read was triggered in the function dlt_en10mb_encode() of the file plugins/dlt_en10m… |
CVE-2018-17972 | Medium | 5.5 | 2018-10-03 | An issue was discovered in the proc_pid_stack function in fs/proc/base.c in the Linux kernel through 4.18.11. It does not ensure that only root may inspect the… |
CVE-2018-6695 | Medium | 5.9 | 2018-10-03 | SSH host keys generation vulnerability in the server in McAfee Threat Intelligence Exchange Server (TIE Server) 1.3.0, 2.0.x, 2.1.x, 2.2.0 allows man-in-the-mi… |
CVE-2018-5921 | High | 8.8 | 2018-10-03 | A potential security vulnerability has been identified with certain HP printers and MFPs in 2405129_000052 and other firmware versions. This vulnerability is k… |
CVE-2018-17881 | Critical | 9.8 | 2018-10-03 | On D-Link DIR-823G 2018-09-19 devices, the GoAhead configuration allows /HNAP1 SetPasswdSettings commands without authentication to trigger an admin password c… |
CVE-2018-17880 | High | 7.5 | 2018-10-03 | On D-Link DIR-823G 2018-09-19 devices, the GoAhead configuration allows /HNAP1 RunReboot commands without authentication to trigger a reboot. |
CVE-2018-17562 | High | 7.5 | 2018-10-03 | Multi-Tech FaxFinder before 5.1.6 has SQL Injection via a status/call_details?oid= URI, allowing an attacker to extract the underlying database schema to furth… |
CVE-2018-17553 | High | 8.8 | 2018-10-03 | An "Unrestricted Upload of File with Dangerous Type" issue with directory traversal in navigate_upload.php in Naviwebs Navigate CMS 2.8 allows authenticated at… |
CVE-2018-17552 | Critical | 9.8 | 2018-10-03 | SQL Injection in login.php in Naviwebs Navigate CMS 2.8 allows remote attackers to bypass authentication via the navigate-user cookie. |
CVE-2018-17540 | High | 7.5 | 2018-10-03 | The gmp plugin in strongSwan before 5.7.1 has a Buffer Overflow via a crafted certificate. |
CVE-2018-17428 | Critical | 9.8 | 2018-10-03 | An issue was discovered in OPAC EasyWeb Five 5.7. There is SQL injection via the w2001/index.php?scelta=campi biblio parameter. |
CVE-2018-17408 | High | 7.8 | 2018-10-03 | Stack-based buffer overflows in Zahir Accounting Enterprise Plus 6 through build 10b allow remote attackers to execute arbitrary code via a crafted CSV file th… |
CVE-2018-17969 | Critical | 9.8 | 2018-10-03 | Samsung SCX-6545X V2.00.03.01 03-23-2012 devices allows remote attackers to discover cleartext credentials via iso.3.6.1.4.1.236.11.5.11.81.10.1.5.0 and iso.3… |
CVE-2018-17967 | Medium | 6.5 | 2018-10-03 | ImageMagick 7.0.7-28 has a memory leak vulnerability in ReadBGRImage in coders/bgr.c. |
CVE-2018-17966 | Medium | 6.5 | 2018-10-03 | ImageMagick 7.0.7-28 has a memory leak vulnerability in WritePDBImage in coders/pdb.c. |
CVE-2018-17965 | Medium | 6.5 | 2018-10-03 | ImageMagick 7.0.7-28 has a memory leak vulnerability in WriteSGIImage in coders/sgi.c. |
CVE-2018-17054 | Medium | 6.1 | 2018-10-03 | Cross-site scripting (XSS) vulnerability in Identity Server in Progress Sitefinity CMS versions 10.0 through 11.0 allows remote attackers to inject arbitrary w… |
CVE-2018-17053 | Medium | 6.1 | 2018-10-03 | Cross-site scripting (XSS) vulnerability in Identity Server in Progress Sitefinity CMS versions 10.0 through 11.0 allows remote attackers to inject arbitrary w… |
CVE-2018-12087 | Medium | 5.3 | 2018-10-03 | Failure to validate certificates in OPC Foundation UA Client Applications communicating without security allows attackers with control over a piece of network… |
CVE-2018-16051 | Medium | 6.5 | 2018-10-03 | An issue was discovered in GitLab Community and Enterprise Edition before 11.0.6, 11.1.x before 11.1.5, and 11.2.x before 11.2.2. There is Orphaned Upload File… |
CVE-2018-16050 | Medium | 6.1 | 2018-10-03 | An issue was discovered in GitLab Community and Enterprise Edition 11.1.x before 11.1.5 and 11.2.x before 11.2.2. There is Persistent XSS in the Merge Request… |