2018 CVEs (page 74)
Page 74 of 162 — CVEs published in 2018, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2018-6053 | Low | 3.3 | 2018-09-25 | Inappropriate implementation in New Tab Page in Google Chrome prior to 64.0.3282.119 allowed a local attacker to view website thumbnail images after clearing b… |
CVE-2018-6052 | Medium | 4.3 | 2018-09-25 | Lack of support for a non standard no-referrer policy value in Blink in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to obtain referrer detai… |
CVE-2018-6051 | Medium | 4.3 | 2018-09-25 | XSS Auditor in Google Chrome prior to 64.0.3282.119, did not ensure the reporting URL was in the same origin as the page it was on, which allowed a remote atta… |
CVE-2018-6050 | Medium | 6.5 | 2018-09-25 | Incorrect security UI in Omnibox in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted… |
CVE-2018-6049 | Medium | 6.5 | 2018-09-25 | Incorrect security UI in permissions prompt in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to spoof the origin to which permission is grante… |
CVE-2018-6048 | Medium | 4.3 | 2018-09-25 | Insufficient policy enforcement in Blink in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially leak referrer information via a craft… |
CVE-2018-6047 | Medium | 4.3 | 2018-09-25 | Insufficient policy enforcement in WebGL in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially leak user redirect URL via a crafted… |
CVE-2018-6046 | Medium | 6.1 | 2018-09-25 | Insufficient data validation in DevTools in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially leak user cross-origin data via a cra… |
CVE-2018-6045 | Medium | 6.5 | 2018-09-25 | Insufficient policy enforcement in DevTools in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially leak user local file data via a cr… |
CVE-2018-6043 | High | 8.8 | 2018-09-25 | Insufficient data validation in External Protocol Handler in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially execute arbitrary pr… |
CVE-2018-6042 | Medium | 4.3 | 2018-09-25 | Incorrect security UI in Omnibox in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted… |
CVE-2018-6041 | Medium | 4.3 | 2018-09-25 | Incorrect security UI in navigation in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a craf… |
CVE-2018-6040 | Medium | 6.5 | 2018-09-25 | Insufficient policy enforcement in Blink in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially bypass content security policy via a… |
CVE-2018-6039 | Medium | 6.1 | 2018-09-25 | Insufficient data validation in DevTools in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially leak user cross-origin data via a cra… |
CVE-2018-6038 | Medium | 6.5 | 2018-09-25 | Heap buffer overflow in WebGL in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. |
CVE-2018-6037 | Medium | 6.5 | 2018-09-25 | Inappropriate implementation in autofill in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to obtain autofill data with insufficient user gestu… |
CVE-2018-6036 | Medium | 6.5 | 2018-09-25 | Insufficient data validation in V8 in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially leak user data via a crafted HTML page. |
CVE-2018-6035 | High | 8.8 | 2018-09-25 | Insufficient policy enforcement in DevTools in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially leak user local file data via a cr… |
CVE-2018-6034 | High | 8.1 | 2018-09-25 | Insufficient data validation in WebGL in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to perform an out of bounds memory read via a crafted H… |
CVE-2018-6033 | High | 8.8 | 2018-09-25 | Insufficient data validation in Downloads in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially run arbitrary code outside sandbox v… |
CVE-2018-6032 | Medium | 6.5 | 2018-09-25 | Insufficient policy enforcement in Blink in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially leak user cross-origin data via a cra… |
CVE-2018-6031 | High | 8.8 | 2018-09-25 | Use after free in PDFium in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file. |
CVE-2018-15967 | High | 7.5 | 2018-09-25 | Adobe Flash Player versions 30.0.0.154 and earlier have a privilege escalation vulnerability. Successful exploitation could lead to information disclosure. |
CVE-2018-15965 | Critical | 9.8 | 2018-09-25 | Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have a deserialization of untrusted data vulnerabi… |
CVE-2018-15964 | High | 7.5 | 2018-09-25 | Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have a use of a component with a known vulnerabili… |
CVE-2018-15963 | Medium | 5.3 | 2018-09-25 | Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have a security bypass vulnerability. Successful e… |
CVE-2018-15962 | Medium | 5.3 | 2018-09-25 | Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have a directory listing vulnerability. Successful… |
CVE-2018-15961 | Critical | 9.8 | 2018-09-25 | Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have an unrestricted file upload vulnerability. Su… |
CVE-2018-15960 | High | 7.5 | 2018-09-25 | Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have a use of a component with a known vulnerabili… |
CVE-2018-15959 | Critical | 9.8 | 2018-09-25 | Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have a deserialization of untrusted data vulnerabi… |
CVE-2018-15958 | Critical | 9.8 | 2018-09-25 | Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have a deserialization of untrusted data vulnerabi… |
CVE-2018-15957 | Critical | 9.8 | 2018-09-25 | Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have a deserialization of untrusted data vulnerabi… |
CVE-2018-12850 | High | 7.5 | 2018-09-25 | Adobe Acrobat and Reader versions 2018.011.20058 and earlier, 2017.011.30099 and earlier, and 2015.006.30448 and earlier have an out-of-bounds read vulnerabili… |
CVE-2018-12849 | High | 7.5 | 2018-09-25 | Adobe Acrobat and Reader versions 2018.011.20058 and earlier, 2017.011.30099 and earlier, and 2015.006.30448 and earlier have an out-of-bounds read vulnerabili… |
CVE-2018-12848 | Critical | 9.8 | 2018-09-25 | Adobe Acrobat and Reader versions 2018.011.20058 and earlier, 2017.011.30099 and earlier, and 2015.006.30448 and earlier have an out-of-bounds write vulnerabil… |
CVE-2018-12840 | High | 7.5 | 2018-09-25 | Adobe Acrobat and Reader versions 2018.011.20058 and earlier, 2017.011.30099 and earlier, and 2015.006.30448 and earlier have an out-of-bounds read vulnerabili… |
CVE-2018-12801 | High | 7.5 | 2018-09-25 | Adobe Acrobat and Reader versions 2018.011.20058 and earlier, 2017.011.30099 and earlier, and 2015.006.30448 and earlier have an out-of-bounds read vulnerabili… |
CVE-2018-12778 | High | 7.5 | 2018-09-25 | Adobe Acrobat and Reader versions 2018.011.20058 and earlier, 2017.011.30099 and earlier, and 2015.006.30448 and earlier have an out-of-bounds read vulnerabili… |
CVE-2018-12775 | High | 7.5 | 2018-09-25 | Adobe Acrobat and Reader versions 2018.011.20058 and earlier, 2017.011.30099 and earlier, and 2015.006.30448 and earlier have an out-of-bounds read vulnerabili… |
CVE-2018-14647 | High | 7.5 | 2018-09-25 | Python's elementtree C accelerator failed to initialise Expat's hash salt during initialization. This could make it easy to conduct denial of service attacks a… |
CVE-2018-14633 | High | 7.0 | 2018-09-25 | A security flaw was found in the chap_server_compute_md5() function in the ISCSI target code in the Linux kernel in a way an authentication request from an ISC… |
CVE-2018-14318 | High | 8.8 | 2018-09-24 | This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Samsung Galaxy S8 G950FXXU1AQL5. User interaction is requir… |
CVE-2018-11614 | High | 8.8 | 2018-09-24 | This vulnerability allows remote attackers to escalate privileges on vulnerable installations of Samsung Members Fixed in version 2.4.25. An attacker must firs… |
CVE-2018-10502 | High | 7.8 | 2018-09-24 | This vulnerability allows local attackers to escalate privileges on vulnerable installations of Samsung Galaxy Apps Fixed in version 4.2.18.2. An attacker must… |
CVE-2018-10501 | High | 7.0 | 2018-09-24 | This vulnerability allows local attackers to escalate privileges on vulnerable installations of Samsung Notes Fixed in version 2.0.02.31. An attacker must firs… |
CVE-2018-10500 | High | 7.0 | 2018-09-24 | This vulnerability allows local attackers to escalate privileges on vulnerable installations of Samsung Galaxy Apps Fixed in version 6.4.0.15. An attacker must… |
CVE-2018-10499 | High | 7.0 | 2018-09-24 | This vulnerability allows local attackers to execute arbitrary code on vulnerable installations of Samsung Galaxy Apps Fixed in version 6.4.0.15. An attacker m… |
CVE-2018-10498 | Medium | 5.5 | 2018-09-24 | This vulnerability allows local attackers to disclose sensitive information on vulnerable installations of Samsung Email Fixed in version 5.0.02.16. An attacke… |
CVE-2018-10497 | High | 7.8 | 2018-09-24 | This vulnerability allows local attackers to escalate privileges on vulnerable installations of Samsung Email Fixed in version 5.0.02.16. An attacker must firs… |
CVE-2018-10496 | High | 8.8 | 2018-09-24 | This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Samsung Internet Browser Fixed in version 6.4.0.15. User in… |
CVE-2018-17281 | High | 7.5 | 2018-09-24 | There is a stack consumption vulnerability in the res_http_websocket.so module of Asterisk through 13.23.0, 14.7.x through 14.7.7, and 15.x through 15.6.0 and… |
CVE-2018-17107 | Critical | 9.8 | 2018-09-24 | In Tgstation tgstation-server 3.2.4.0 through 3.2.1.0 (fixed in 3.2.5.0), active logins would be cached, allowing subsequent logins to succeed with any usernam… |
CVE-2018-16299 | High | 7.5 | 2018-09-24 | The Localize My Post plugin 1.0 for WordPress allows Directory Traversal via the ajax/include.php file parameter. |
CVE-2018-16283 | Critical | 9.8 | 2018-09-24 | The Wechat Broadcast plugin 1.2.0 and earlier for WordPress allows Directory Traversal via the Image.php url parameter. |
CVE-2018-13140 | High | 8.1 | 2018-09-24 | Druide Antidote through 9.5.1 on Windows and Linux allows remote code execution through the update mechanism by leveraging use of HTTP to download installation… |
CVE-2018-12975 | High | 7.5 | 2018-09-24 | The random() function of the smart contract implementation for CryptoSaga, an Ethereum game, generates a random value with publicly readable variables such as… |
CVE-2018-14825 | Medium | 5.8 | 2018-09-24 | On Honeywell Mobile Computers (CT60 running Android OS 7.1, CN80 running Android OS 7.1, CT40 running Android OS 7.1, CK75 running Android OS 6.0, CN75 running… |
CVE-2018-17439 | Medium | 6.5 | 2018-09-24 | An issue was discovered in the HDF HDF5 1.10.3 library. There is a stack-based buffer overflow in the function H5S_extent_get_dims() in H5S.c. Specifically, th… |
CVE-2018-17438 | Medium | 6.5 | 2018-09-24 | A SIGFPE signal is raised in the function H5D__select_io() of H5Dselect.c in the HDF HDF5 through 1.10.3 library during an attempted parse of a crafted HDF fil… |
CVE-2018-17437 | Medium | 6.5 | 2018-09-24 | Memory leak in the H5O_dtype_decode_helper() function in H5Odtype.c in the HDF HDF5 through 1.10.3 library allows attackers to cause a denial of service (memor… |
CVE-2018-17436 | Medium | 6.5 | 2018-09-24 | ReadCode() in decompress.c in the HDF HDF5 through 1.10.3 library allows attackers to cause a denial of service (invalid write access) via a crafted HDF5 file… |
CVE-2018-17435 | Medium | 6.5 | 2018-09-24 | A heap-based buffer over-read in H5O_attr_decode() in H5Oattr.c in the HDF HDF5 through 1.10.3 library allows attackers to cause a denial of service via a craf… |
CVE-2018-17434 | Medium | 6.5 | 2018-09-24 | A SIGFPE signal is raised in the function apply_filters() of h5repack_filters.c in the HDF HDF5 through 1.10.3 library during an attempted parse of a crafted H… |
CVE-2018-17433 | Medium | 6.5 | 2018-09-24 | A heap-based buffer overflow in ReadGifImageDesc() in gifread.c in the HDF HDF5 through 1.10.3 library allows attackers to cause a denial of service via a craf… |
CVE-2018-17432 | Medium | 6.5 | 2018-09-24 | A NULL pointer dereference in H5O_sdspace_encode() in H5Osdspace.c in the HDF HDF5 through 1.10.3 library allows attackers to cause a denial of service via a c… |
CVE-2018-6700 | High | 7.8 | 2018-09-24 | DLL Search Order Hijacking vulnerability in Microsoft Windows Client in McAfee True Key (TK) before 5.1.165 allows local users to execute arbitrary code via sp… |
CVE-2018-6682 | Medium | 6.1 | 2018-09-24 | Cross Site Scripting Exposure in McAfee True Key (TK) 4.0.0.0 and earlier allows local users to expose confidential data via a crafted web site. |
CVE-2018-15615 | High | 7.2 | 2018-09-24 | A vulnerability in the Supervisor component of Avaya Call Management System allows local administrative user to extract sensitive information from users connec… |
CVE-2018-17404 | Medium | 5.3 | 2018-09-23 | The SBIbuddy (aka com.sbi.erupee) application 1.41 and 1.42 for Android might allow an attacker to sniff private information such as mobile number, PAN number… |
CVE-2018-17403 | High | 8.8 | 2018-09-23 | The PhonePe wallet (aka com.PhonePe.app) application 3.0.6 through 3.3.26 for Android might allow attackers to impersonate a user and set up their account with… |
CVE-2018-17402 | Medium | 5.3 | 2018-09-23 | The PhonePe wallet (aka com.PhonePe.app) application 3.0.6 through 3.3.26 for Android might allow attackers to discover the Credit/Debit card number, expiratio… |
CVE-2018-17401 | High | 8.8 | 2018-09-23 | The PhonePe wallet (aka com.PhonePe.app) application 3.0.6 through 3.3.26 for Android might allow attackers to perform Account Takeover attacks by exploiting i… |
CVE-2018-17400 | High | 7.0 | 2018-09-23 | The PhonePe wallet (aka com.PhonePe.app) application 3.0.6 through 3.3.26 for Android might allow attackers to perform Account Takeover attacks by intercepting… |
CVE-2018-17369 | Medium | 4.8 | 2018-09-23 | An issue was discovered in springboot_authority through 2017-03-06. There is stored XSS via the admin/role/edit roleKey, name, or description parameter. |
CVE-2018-17368 | Medium | 5.3 | 2018-09-23 | An issue was discovered in PublicCMS V4.0.180825. For an invalid login attempt, the response length is different depending on whether the username is valid, wh… |
CVE-2018-17407 | High | 7.8 | 2018-09-23 | An issue was discovered in t1_check_unusual_charstring functions in writet1.c files in TeX Live before 2018-09-21. A buffer overflow in the handling of Type 1… |
CVE-2018-17366 | High | 8.8 | 2018-09-23 | An issue was discovered in MCMS 4.6.5. There is a CSRF vulnerability that can add an administrator account via ms/basic/manager/save.do. |
CVE-2018-17364 | High | 8.1 | 2018-09-23 | OTCMS 3.61 allows remote attackers to execute arbitrary PHP code via the accBackupDir parameter. |
CVE-2018-17361 | Medium | 6.1 | 2018-09-23 | Multiple XSS vulnerabilities in WeaselCMS v0.3.6 allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to index.php because $_SERVER[… |
CVE-2018-17360 | Medium | 5.5 | 2018-09-23 | An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.31. a heap-based buffer over-read in bfd_get… |
CVE-2018-17359 | Medium | 5.5 | 2018-09-23 | An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.31. An invalid memory access exists in bfd_z… |
CVE-2018-17358 | Medium | 5.5 | 2018-09-23 | An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.31. An invalid memory access exists in _bfd_… |
CVE-2018-17341 | High | 8.1 | 2018-09-23 | BigTree 4.2.23 on Windows, when Advanced or Simple Rewrite routing is enabled, allows remote attackers to bypass authentication via a ..\ substring, as demonst… |
CVE-2018-17338 | High | 7.8 | 2018-09-23 | An issue has been found in pdfalto through 0.2. It is a heap-based buffer overflow in the function TextPage::dump in XmlAltoOutputDev.cc. |
CVE-2018-17336 | High | 7.8 | 2018-09-22 | UDisks 2.8.0 has a format string vulnerability in udisks_log in udiskslogging.c, allowing attackers to obtain sensitive information (stack contents), cause a d… |
CVE-2018-17334 | Critical | 9.8 | 2018-09-22 | An issue was discovered in libsvg2 through 2012-10-19. A stack-based buffer overflow in the svgGetNextPathField function in svg_string.c allows remote attacker… |
CVE-2018-17333 | Critical | 9.8 | 2018-09-22 | An issue was discovered in libsvg2 through 2012-10-19. A stack-based buffer overflow in svgStringToLength in svg_types.c allows remote attackers to cause a den… |
CVE-2018-17332 | High | 7.5 | 2018-09-22 | An issue was discovered in libsvg2 through 2012-10-19. The svgGetNextPathField function in svg_string.c returns its input pointer in certain circumstances, whi… |
CVE-2018-17322 | Medium | 6.1 | 2018-09-22 | Cross-site scripting (XSS) vulnerability in index.php/index/category/index in YUNUCMS 1.1.4 allows remote attackers to inject arbitrary web script or HTML via… |
CVE-2018-17321 | Medium | 6.1 | 2018-09-22 | An issue was discovered in SeaCMS 6.64. XSS exists in admin_datarelate.php via the time or maxHit parameter in a dorandomset action. |
CVE-2018-14891 | High | 7.8 | 2018-09-21 | Management Console in Vectra Networks Cognito Brain and Sensor before 4.3 contains a local privilege escalation vulnerability. |
CVE-2018-14890 | Medium | 5.4 | 2018-09-21 | Vectra Networks Cognito Brain and Sensor before 4.2 contains a cross-site scripting (XSS) vulnerability in the Web Management Console. |
CVE-2018-14889 | High | 7.8 | 2018-09-21 | CouchDB in Vectra Networks Cognito Brain and Sensor before 4.3 contains a local code execution vulnerability. |
CVE-2018-12169 | High | 7.6 | 2018-09-21 | Platform sample code firmware in 4th Generation Intel Core Processor, 5th Generation Intel Core Processor, 6th Generation Intel Core Processor, 7th Generation… |
CVE-2018-17320 | Medium | 6.1 | 2018-09-21 | An issue was discovered in UCMS 1.4.6. aaddpost.php has stored XSS via the sadmin/aindex.php minfo parameter in a sadmin_aaddpost action. |
CVE-2018-17317 | Critical | 9.8 | 2018-09-21 | FruityWifi (aka PatatasFritas/PatataWifi) 2.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the io_mode, ap_mode, io_action… |
CVE-2018-17174 | Critical | 9.8 | 2018-09-21 | A stack-based buffer overflow was discovered in the xtimor NMEA library (aka nmealib) 0.5.3. nmea_parse() in parser.c allows an attacker to trigger denial of s… |
CVE-2018-17173 | Critical | 9.8 | 2018-09-21 | LG SuperSign CMS allows remote attackers to execute arbitrary code via the sourceUri parameter to qsr_server/device/getThumbnail. |
CVE-2018-17141 | Critical | 9.8 | 2018-09-21 | HylaFAX 6.0.6 and HylaFAX+ 5.6.0 allow remote attackers to execute arbitrary code via a dial-in session that provides a FAX page with the JPEG bit enabled, whi… |
CVE-2018-17050 | High | 7.5 | 2018-09-21 | The mintToken function of a smart contract implementation for PolyAi (AI), an Ethereum token, has an integer overflow that allows the owner of the contract to… |