2018 CVEs (page 76)
Page 76 of 162 — CVEs published in 2018, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2018-3826 | Medium | 6.5 | 2018-09-19 | In Elasticsearch versions 6.0.0-beta1 to 6.2.4 a disclosure flaw was found in the _snapshot API. When the access_key and security_key parameters are set using… |
CVE-2018-3825 | Medium | 5.9 | 2018-09-19 | In Elastic Cloud Enterprise (ECE) versions prior to 1.1.4 a default master encryption key is used in the process of granting ZooKeeper access to Elasticsearch… |
CVE-2018-3824 | Medium | 6.1 | 2018-09-19 | X-Pack Machine Learning versions before 6.2.4 and 5.6.9 had a cross-site scripting (XSS) vulnerability. If an attacker is able to inject data into an index tha… |
CVE-2018-3823 | Medium | 5.4 | 2018-09-19 | X-Pack Machine Learning versions before 6.2.4 and 5.6.9 had a cross-site scripting (XSS) vulnerability. Users with manage_ml permissions could create jobs cont… |
CVE-2018-17208 | High | 8.8 | 2018-09-19 | Linksys Velop 1.1.2.187020 devices allow unauthenticated command injection, providing an attacker with full root access, via cgi-bin/zbtest.cgi or cgi-bin/zbte… |
CVE-2018-17207 | Critical | 9.8 | 2018-09-19 | An issue was discovered in Snap Creek Duplicator before 1.2.42. By accessing leftover installer files (installer.php and installer-backup.php), an attacker can… |
CVE-2018-17206 | Medium | 4.9 | 2018-09-19 | An issue was discovered in Open vSwitch (OvS) 2.7.x through 2.7.6. The decode_bundle function inside lib/ofp-actions.c is affected by a buffer over-read issue… |
CVE-2018-17205 | High | 7.5 | 2018-09-19 | An issue was discovered in Open vSwitch (OvS) 2.7.x through 2.7.6, affecting ofproto_rule_insert__ in ofproto/ofproto.c. During bundle commit, flows that are a… |
CVE-2018-17204 | Medium | 4.3 | 2018-09-19 | An issue was discovered in Open vSwitch (OvS) 2.7.x through 2.7.6, affecting parse_group_prop_ntr_selection_method in lib/ofp-util.c. When decoding a group mod… |
CVE-2018-1782 | Medium | 6.5 | 2018-09-19 | IBM GPFS (IBM Spectrum Scale 5.0.1.0 and 5.0.1.1) allows a local, unprivileged user to cause a kernel panic on a node running GPFS by accessing a file that is… |
CVE-2018-17183 | High | 7.8 | 2018-09-19 | Artifex Ghostscript before 9.25 allowed a user-writable error exception table, which could be used by remote attackers able to supply crafted PostScript to pot… |
CVE-2018-16785 | High | 8.8 | 2018-09-19 | XML injection vulnerability exists in the file of DedeCMS V5.7 SP2 version, which can be utilized by attackers to create script file to obtain webshell |
CVE-2018-16607 | Medium | 5.4 | 2018-09-19 | Cross-site scripting (XSS) vulnerability in the Orgs Page in Open-AudIT Professional edition in 2.2.7 allows remote attackers to inject arbitrary web script vi… |
CVE-2018-14792 | Medium | 6.3 | 2018-09-19 | WECON PLC Editor version 1.3.3U may allow an attacker to execute code under the current process when processing project files. |
CVE-2018-12243 | High | 8.8 | 2018-09-19 | The Symantec Messaging Gateway product prior to 10.6.6 may be susceptible to a XML external entity (XXE) exploit, which is a type of issue where XML input cont… |
CVE-2018-12242 | Critical | 9.8 | 2018-09-19 | The Symantec Messaging Gateway product prior to 10.6.6 may be susceptible to an authentication bypass exploit, which is a type of issue that can allow attacker… |
CVE-2018-1150 | High | 7.3 | 2018-09-19 | NUUO's NVRMini2 3.8.0 and below contains a backdoor that would allow an unauthenticated remote attacker to take over user accounts if the file /tmp/moses exist… |
CVE-2018-1149 | Critical | 9.8 | 2018-09-19 | cgi_system in NUUO's NVRMini2 3.8.0 and below allows remote attackers to execute arbitrary code via crafted HTTP requests. |
CVE-2018-8017 | Medium | 5.5 | 2018-09-19 | In Apache Tika 1.2 to 1.18, a carefully crafted file can trigger an infinite loop in the IptcAnpaParser. |
CVE-2018-5905 | High | 7.0 | 2018-09-19 | In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, a race condition while accessing num of clients in… |
CVE-2018-3574 | Medium | 5.5 | 2018-09-19 | In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, userspace can request ION cache maintenance on a se… |
CVE-2018-3573 | High | 7.8 | 2018-09-19 | In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, while relocating kernel images with a specially cra… |
CVE-2018-11904 | High | 7.8 | 2018-09-19 | In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, asynchronous callbacks received a pointer to a call… |
CVE-2018-11903 | High | 7.8 | 2018-09-19 | In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, lack of length validation check for value received… |
CVE-2018-11902 | High | 7.8 | 2018-09-19 | In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, lack of length validation check for value received… |
CVE-2018-11898 | High | 7.8 | 2018-09-19 | In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, while processing start bss request from upper layer… |
CVE-2018-11897 | High | 7.8 | 2018-09-19 | In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, while processing diag event after associating to a… |
CVE-2018-11895 | High | 7.8 | 2018-09-19 | In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, improper length check Validation in WLAN function c… |
CVE-2018-11894 | High | 7.8 | 2018-09-19 | In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, while processing preferred network offload scan res… |
CVE-2018-11893 | High | 7.8 | 2018-09-19 | In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, while processing vendor scan request, when input ar… |
CVE-2018-11891 | High | 8.8 | 2018-09-19 | In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, lack of check on the length of array while accessin… |
CVE-2018-11889 | High | 7.8 | 2018-09-19 | In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, when requesting rssi timeout, access invalid memory… |
CVE-2018-11886 | High | 7.8 | 2018-09-19 | In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, lack of check while calculating the MPDU data lengt… |
CVE-2018-11883 | High | 7.8 | 2018-09-19 | In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, in policy mgr unit test if mode parameter in wlan f… |
CVE-2018-11878 | High | 7.8 | 2018-09-19 | In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, possibility of invalid memory access while processi… |
CVE-2018-11762 | Medium | 5.9 | 2018-09-19 | In Apache Tika 0.9 to 1.18, in a rare edge case where a user does not specify an extract directory on the commandline (--extract-dir=) and the input file has a… |
CVE-2018-11761 | High | 7.5 | 2018-09-19 | In Apache Tika 0.1 to 1.18, the XML parsers were not configured to limit entity expansion. They were therefore vulnerable to an entity expansion vulnerability… |
CVE-2018-17182 | High | 7.8 | 2018-09-19 | An issue was discovered in the Linux kernel through 4.18.8. The vmacache_flush_all function in mm/vmacache.c mishandles sequence number overflows. An attacker… |
CVE-2018-17144 | High | 7.5 | 2018-09-19 | Bitcoin Core 0.14.x before 0.14.3, 0.15.x before 0.15.2, and 0.16.x before 0.16.3 and Bitcoin Knots 0.14.x through 0.16.x before 0.16.3 allow a remote denial o… |
CVE-2018-6690 | High | 7.1 | 2018-09-18 | Accessing, modifying, or executing executable files vulnerability in Microsoft Windows client in McAfee Application and Change Control (MACC) 8.0.0 Hotfix 4 an… |
CVE-2018-6693 | Medium | 5.3 | 2018-09-18 | An unprivileged user can delete arbitrary files on a Linux system running ENSLTP 10.5.1, 10.5.0, and 10.2.3 Hotfix 1246778 and earlier. By exploiting a time of… |
CVE-2018-17111 | Critical | 9.8 | 2018-09-18 | The onlyOwner modifier of a smart contract implementation for Coinlancer (CL), an Ethereum ERC20 token, has a potential access control vulnerability. All contr… |
CVE-2018-17071 | High | 7.5 | 2018-09-18 | The fallback function of a simple lottery smart contract implementation for Lucky9io, an Ethereum gambling game, generates a random value with the publicly rea… |
CVE-2018-16820 | High | 7.5 | 2018-09-18 | admin/index.php in Monstra CMS 3.0.4 allows arbitrary directory listing via id=filesmanager&path=uploads/.......//./.......//./ requests. |
CVE-2018-16819 | Medium | 4.9 | 2018-09-18 | admin/index.php in Monstra CMS 3.0.4 allows arbitrary file deletion via id=filesmanager&path=uploads/.......//./.......//./&delete_file= requests. |
CVE-2018-16794 | High | 8.6 | 2018-09-18 | Microsoft ADFS 4.0 Windows Server 2016 and previous (Active Directory Federation Services) has an SSRF vulnerability via the txtBoxEmail parameter in /adfs/ls. |
CVE-2018-16515 | High | 8.8 | 2018-09-18 | Matrix Synapse before 0.33.3.1 allows remote attackers to spoof events and possibly have unspecified other impacts by leveraging improper transaction and event… |
CVE-2018-16225 | Medium | 6.5 | 2018-09-18 | The QBee MultiSensor Camera through 4.16.4 accepts unencrypted network traffic from clients (such as the QBee Cam application through 1.0.5 for Android and the… |
CVE-2018-15546 | Medium | 6.1 | 2018-09-18 | Accusoft PrizmDoc version 13.3 and earlier contains a Stored Cross-Site Scripting issue through a crafted PDF file. |
CVE-2018-13982 | High | 7.5 | 2018-09-18 | Smarty_Security::isTrustedResourceDir() in Smarty before 3.1.33 is prone to a path traversal vulnerability due to insufficient template code sanitization. This… |
CVE-2018-11084 | Medium | 6.8 | 2018-09-18 | Cloud Foundry Garden-runC release, versions prior to 1.16.1, prevents deletion of some app environments based on file attributes. A remote authenticated malici… |
CVE-2018-11071 | High | 7.5 | 2018-09-18 | Dell EMC Isilon OneFS versions 7.1.1.x, 7.2.1.x, 8.0.0.x, 8.0.1.x, 8.1.0.x and 8.1.x prior to 8.1.2 and Dell EMC IsilonSD Edge versions 8.0.0.x, 8.0.1.x, 8.1.0… |
CVE-2018-16671 | Medium | 5.3 | 2018-09-18 | An issue was discovered in CIRCONTROL CirCarLife before 4.3. There is system software information disclosure due to lack of authentication for /html/device-id. |
CVE-2018-16670 | Medium | 5.3 | 2018-09-18 | An issue was discovered in CIRCONTROL CirCarLife before 4.3. There is PLC status disclosure due to lack of authentication for /html/devstat.html. |
CVE-2018-16669 | Critical | 9.8 | 2018-09-18 | An issue was discovered in CIRCONTROL Open Charge Point Protocol (OCPP) before 1.5.0, as used in CirCarLife, PowerStudio, and other products. Due to storage of… |
CVE-2018-16668 | Medium | 5.3 | 2018-09-18 | An issue was discovered in CIRCONTROL CirCarLife before 4.3. There is internal installation path disclosure due to the lack of authentication for /html/reposit… |
CVE-2018-17178 | Medium | 5.3 | 2018-09-18 | An issue was discovered on Neato Botvac Connected 2.2.0 devices. They execute unauthenticated manual drive commands (sent to /bin/webserver on port 8081) if th… |
CVE-2018-17177 | Low | 2.4 | 2018-09-18 | An issue was discovered on Neato Botvac Connected 2.2.0 and Botvac 85 1.2.1 devices. Static encryption is used for the copying of so-called "black box" logs (e… |
CVE-2018-17176 | High | 7.5 | 2018-09-18 | A replay issue was discovered on Neato Botvac Connected 2.2.0 devices. Manual control mode requires authentication, but once recorded, the authentication (alwa… |
CVE-2018-11869 | High | 7.8 | 2018-09-18 | In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, lack of length validation check for value received… |
CVE-2018-11868 | High | 7.8 | 2018-09-18 | In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, lack of length validation check for value received… |
CVE-2018-11863 | High | 7.8 | 2018-09-18 | In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, lack of check of input received from firmware to ca… |
CVE-2018-11860 | High | 7.8 | 2018-09-18 | In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, a potential buffer over flow could occur while proc… |
CVE-2018-11852 | High | 7.8 | 2018-09-18 | In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, improper check In the WMA API for the inputs receiv… |
CVE-2018-11851 | High | 7.8 | 2018-09-18 | In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, lack of check on input received to calculate the bu… |
CVE-2018-11843 | High | 7.8 | 2018-09-18 | In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, lack fo check on return value in WMA response handl… |
CVE-2018-11842 | High | 7.8 | 2018-09-18 | In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, during wlan association, driver allocates memory. I… |
CVE-2018-11840 | High | 7.8 | 2018-09-18 | In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, while processing the WLAN driver command ioctl a te… |
CVE-2018-11836 | High | 7.8 | 2018-09-18 | In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, improper length check can lead to out-of-bounds acc… |
CVE-2018-11832 | High | 7.8 | 2018-09-18 | In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, lack of input size validation before copying to buf… |
CVE-2018-11827 | High | 7.8 | 2018-09-18 | In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, improper validation of array index in WMA roam sync… |
CVE-2018-11826 | High | 7.8 | 2018-09-18 | In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, lack of check on integer overflow while calculating… |
CVE-2018-11818 | High | 7.0 | 2018-09-18 | In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, LUT configuration is passed down to driver from use… |
CVE-2018-11302 | High | 7.8 | 2018-09-18 | In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, lack of check of input received from userspace befo… |
CVE-2018-11301 | High | 7.8 | 2018-09-18 | In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, lack of check on buffer length while processing deb… |
CVE-2018-11300 | High | 7.8 | 2018-09-18 | In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, callback executed from the other thread has freed m… |
CVE-2018-11299 | High | 7.8 | 2018-09-18 | In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, when WLAN FW has not filled the vdev id correctly i… |
CVE-2018-11298 | High | 7.8 | 2018-09-18 | In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, while processing SET_PASSPOINT_LIST vendor command… |
CVE-2018-11297 | High | 7.8 | 2018-09-18 | In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, a buffer over-read can occur In the WMA NDP event h… |
CVE-2018-11296 | High | 7.8 | 2018-09-18 | In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, while processing a message from firmware in WLAN ha… |
CVE-2018-11295 | High | 7.8 | 2018-09-18 | In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, WMA handler carries a fixed event data from the fir… |
CVE-2018-11294 | High | 8.0 | 2018-09-18 | In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, WLAN handler indication from the firmware gets the… |
CVE-2018-11293 | Medium | 5.7 | 2018-09-18 | In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, in wma_ndp_confirm_event_handler and wma_ndp_indica… |
CVE-2018-11286 | High | 7.8 | 2018-09-18 | In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, while accessing global variable "debug_client" in m… |
CVE-2018-11281 | High | 7.8 | 2018-09-18 | In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, while calling IPA_IOC_MDFY_RT_RULE IPA IOCTL, heade… |
CVE-2018-11280 | Medium | 5.5 | 2018-09-18 | In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, while processing user-space there is no size valida… |
CVE-2018-11278 | High | 7.1 | 2018-09-18 | In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, Venus HW searches for start code when decoding inpu… |
CVE-2018-11276 | High | 7.8 | 2018-09-18 | In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, double free of memory allocation is possible in Ker… |
CVE-2018-11275 | Medium | 5.5 | 2018-09-18 | In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, when flashing image using FastbootLib if size is no… |
CVE-2018-11274 | High | 7.8 | 2018-09-18 | In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, buffer overflow may occur when payload size is extr… |
CVE-2018-11273 | High | 7.8 | 2018-09-18 | In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, 'voice_svc_dev' is allocated as a device-managed re… |
CVE-2018-11270 | High | 7.8 | 2018-09-18 | In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, memory allocated with devm_kzalloc is automatically… |
CVE-2018-11265 | High | 7.8 | 2018-09-18 | In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, possible buffer overflow while incrementing the log… |
CVE-2018-17175 | Medium | 5.3 | 2018-09-18 | In the marshmallow library before 2.15.1 and 3.x before 3.0.0b9 for Python, the schema "only" option treats an empty list as implying no "only" option, which a… |
CVE-2018-1000802 | Critical | 9.8 | 2018-09-18 | Python Software Foundation Python (CPython) version 2.7 contains a CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')… |
CVE-2018-17153 | Critical | 9.8 | 2018-09-18 | It was discovered that the Western Digital My Cloud device before 2.30.196 is affected by an authentication bypass vulnerability. An unauthenticated attacker c… |
CVE-2018-13398 | Medium | 6.5 | 2018-09-18 | The administrative smart-commits resource in Atlassian Fisheye and Crucible before version 4.5.4 allows remote attackers to modify smart-commit settings via a… |
CVE-2018-11787 | High | 8.1 | 2018-09-18 | In Apache Karaf version prior to 3.0.9, 4.0.9, 4.1.1, when the webconsole feature is installed in Karaf, it is available at .../system/console and requires aut… |
CVE-2018-11786 | High | 8.8 | 2018-09-18 | In Apache Karaf prior to 4.2.0 release, if the sshd service in Karaf is left on so an administrator can manage the running instance, any user with rights to th… |
CVE-2018-7991 | Medium | 4.6 | 2018-09-18 | Huawei smartphones Mate10 with versions earlier before ALP-AL00B 8.0.0.110(C00) have a Factory Reset Protection (FRP) bypass vulnerability. The system does not… |