2018 CVEs (page 78)
Page 78 of 162 — CVEs published in 2018, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2018-17036 | Critical | 9.8 | 2018-09-14 | An issue was discovered in UCMS 1.4.6 and 1.6. It allows PHP code injection during installation via the systemdomain parameter to install/index.php, as demonst… |
CVE-2018-17035 | Critical | 9.8 | 2018-09-14 | UCMS 1.4.6 has SQL injection during installation via the install/index.php mysql_dbname parameter. |
CVE-2018-17034 | Medium | 6.1 | 2018-09-14 | UCMS 1.4.6 has XSS via the install/index.php mysql_dbname parameter. |
CVE-2018-17031 | Medium | 6.1 | 2018-09-14 | In Gogs 0.11.53, an attacker can use a crafted .eml file to trigger MIME type sniffing, which leads to XSS, as demonstrated by Internet Explorer, because an "X… |
CVE-2018-17030 | High | 7.5 | 2018-09-14 | BigTree CMS 4.2.23 allows remote authenticated users, if possessing privileges to set hooks, to execute arbitrary code via /core/admin/auto-modules/forms/proce… |
CVE-2018-17026 | Medium | 4.8 | 2018-09-13 | admin/index.php in Monstra CMS 3.0.4 allows XSS via the page_meta_title parameter in an edit_page&name=error404 action, a different vulnerability than CVE-2018… |
CVE-2018-17025 | Medium | 6.1 | 2018-09-13 | admin/index.php in Monstra CMS 3.0.4 allows XSS via the page_meta_title parameter in an edit_page action for a page with no special role. |
CVE-2018-17024 | Medium | 4.8 | 2018-09-13 | admin/index.php in Monstra CMS 3.0.4 allows XSS via the page_meta_title parameter in an add_page action. |
CVE-2018-17023 | High | 8.8 | 2018-09-13 | Cross-site request forgery (CSRF) vulnerability on ASUS GT-AC5300 routers with firmware through 3.0.0.4.384_32738 allows remote attackers to hijack the authent… |
CVE-2018-17022 | High | 7.2 | 2018-09-13 | Stack-based buffer overflow on the ASUS GT-AC5300 router through 3.0.0.4.384_32738 allows remote attackers to cause a denial of service (device crash) or possi… |
CVE-2018-17021 | Medium | 6.1 | 2018-09-13 | Cross-site scripting (XSS) vulnerability on ASUS GT-AC5300 devices with firmware through 3.0.0.4.384_32738 allows remote attackers to inject arbitrary web scri… |
CVE-2018-17020 | High | 7.5 | 2018-09-13 | ASUS GT-AC5300 devices with firmware through 3.0.0.4.384_32738 allow remote attackers to cause a denial of service via a single "GET / HTTP/1.1\r\n" line. |
CVE-2018-17019 | High | 7.5 | 2018-09-13 | In Bro through 2.5.5, there is a DoS in IRC protocol names command parsing in analyzer/protocol/irc/IRC.cc. |
CVE-2018-1330 | High | 7.5 | 2018-09-13 | When parsing a malformed JSON payload, libprocess in Apache Mesos versions 1.4.0 to 1.5.0 might crash due to an uncaught exception. Parsing chunked HTTP reques… |
CVE-2018-10637 | High | 7.8 | 2018-09-13 | A maliciously crafted project file may cause a buffer overflow, which may allow the attacker to execute arbitrary code that affects Fuji Electric V-Server Lite… |
CVE-2018-17018 | Medium | 6.5 | 2018-09-13 | An issue was discovered on TP-Link TL-WR886N 6.0 2.3.4 and TL-WR886N 7.0 1.1.0 devices. Authenticated attackers can crash router services (e.g., inetd, HTTP, D… |
CVE-2018-17017 | Medium | 6.5 | 2018-09-13 | An issue was discovered on TP-Link TL-WR886N 6.0 2.3.4 and TL-WR886N 7.0 1.1.0 devices. Authenticated attackers can crash router services (e.g., inetd, HTTP, D… |
CVE-2018-17016 | Medium | 6.5 | 2018-09-13 | An issue was discovered on TP-Link TL-WR886N 6.0 2.3.4 and TL-WR886N 7.0 1.1.0 devices. Authenticated attackers can crash router services (e.g., inetd, HTTP, D… |
CVE-2018-17015 | Medium | 6.5 | 2018-09-13 | An issue was discovered on TP-Link TL-WR886N 6.0 2.3.4 and TL-WR886N 7.0 1.1.0 devices. Authenticated attackers can crash router services (e.g., inetd, HTTP, D… |
CVE-2018-17014 | Medium | 6.5 | 2018-09-13 | An issue was discovered on TP-Link TL-WR886N 6.0 2.3.4 and TL-WR886N 7.0 1.1.0 devices. Authenticated attackers can crash router services (e.g., inetd, HTTP, D… |
CVE-2018-17013 | Medium | 6.5 | 2018-09-13 | An issue was discovered on TP-Link TL-WR886N 6.0 2.3.4 and TL-WR886N 7.0 1.1.0 devices. Authenticated attackers can crash router services (e.g., inetd, HTTP, D… |
CVE-2018-17012 | Medium | 6.5 | 2018-09-13 | An issue was discovered on TP-Link TL-WR886N 6.0 2.3.4 and TL-WR886N 7.0 1.1.0 devices. Authenticated attackers can crash router services (e.g., inetd, HTTP, D… |
CVE-2018-17011 | Medium | 6.5 | 2018-09-13 | An issue was discovered on TP-Link TL-WR886N 6.0 2.3.4 and TL-WR886N 7.0 1.1.0 devices. Authenticated attackers can crash router services (e.g., inetd, HTTP, D… |
CVE-2018-17010 | Medium | 6.5 | 2018-09-13 | An issue was discovered on TP-Link TL-WR886N 6.0 2.3.4 and TL-WR886N 7.0 1.1.0 devices. Authenticated attackers can crash router services (e.g., inetd, HTTP, D… |
CVE-2018-17009 | Medium | 6.5 | 2018-09-13 | An issue was discovered on TP-Link TL-WR886N 6.0 2.3.4 and TL-WR886N 7.0 1.1.0 devices. Authenticated attackers can crash router services (e.g., inetd, HTTP, D… |
CVE-2018-17008 | Medium | 6.5 | 2018-09-13 | An issue was discovered on TP-Link TL-WR886N 6.0 2.3.4 and TL-WR886N 7.0 1.1.0 devices. Authenticated attackers can crash router services (e.g., inetd, HTTP, D… |
CVE-2018-17007 | Medium | 6.5 | 2018-09-13 | An issue was discovered on TP-Link TL-WR886N 6.0 2.3.4 and TL-WR886N 7.0 1.1.0 devices. Authenticated attackers can crash router services (e.g., inetd, HTTP, D… |
CVE-2018-17006 | Medium | 6.5 | 2018-09-13 | An issue was discovered on TP-Link TL-WR886N 6.0 2.3.4 and TL-WR886N 7.0 1.1.0 devices. Authenticated attackers can crash router services (e.g., inetd, HTTP, D… |
CVE-2018-17005 | Medium | 6.5 | 2018-09-13 | An issue was discovered on TP-Link TL-WR886N 6.0 2.3.4 and TL-WR886N 7.0 1.1.0 devices. Authenticated attackers can crash router services (e.g., inetd, HTTP, D… |
CVE-2018-17004 | Medium | 6.5 | 2018-09-13 | An issue was discovered on TP-Link TL-WR886N 6.0 2.3.4 and TL-WR886N 7.0 1.1.0 devices. Authenticated attackers can crash router services (e.g., inetd, HTTP, D… |
CVE-2018-17000 | Medium | 6.5 | 2018-09-13 | A NULL pointer dereference in the function _TIFFmemcmp at tif_unix.c (called from TIFFWriteDirectoryTagTransferfunction) in LibTIFF 4.0.9 allows an attacker to… |
CVE-2018-16999 | Medium | 5.5 | 2018-09-13 | Netwide Assembler (NASM) 2.14rc15 has an invalid memory write (segmentation fault) in expand_smacro in preproc.c, which allows attackers to cause a denial of s… |
CVE-2018-16796 | High | 8.8 | 2018-09-13 | HiScout GRC Suite before 3.1.5 allows Unrestricted Upload of Files with Dangerous Types. |
CVE-2018-16745 | High | 7.8 | 2018-09-13 | An issue was discovered in mgetty before 1.2.1. In fax_notify_mail() in faxrec.c, the mail_to parameter is not sanitized. It could allow a buffer overflow if l… |
CVE-2018-16744 | High | 7.8 | 2018-09-13 | An issue was discovered in mgetty before 1.2.1. In fax_notify_mail() in faxrec.c, the mail_to parameter is not sanitized. It could allow for command injection… |
CVE-2018-16743 | High | 7.8 | 2018-09-13 | An issue was discovered in mgetty before 1.2.1. In contrib/next-login/login.c, the command-line parameter username is passed unsanitized to strcpy(), which can… |
CVE-2018-16742 | High | 7.8 | 2018-09-13 | An issue was discovered in mgetty before 1.2.1. In contrib/scrts.c, a stack-based buffer overflow can be triggered via a command-line parameter. |
CVE-2018-16741 | High | 7.8 | 2018-09-13 | An issue was discovered in mgetty before 1.2.1. In fax/faxq-helper.c, the function do_activate() does not properly sanitize shell metacharacters to prevent com… |
CVE-2018-16987 | High | 7.2 | 2018-09-13 | Squash TM through 1.18.0 presents the cleartext passwords of external services in the administration panel, as demonstrated by a ta-server-password field in th… |
CVE-2018-1698 | Medium | 5.3 | 2018-09-13 | IBM Maximo Asset Management 7.6 through 7.6.3 could allow an unauthenticated attacker to obtain sensitive information from error messages. IBM X-Force ID: 1459… |
CVE-2018-5549 | High | 7.5 | 2018-09-13 | On BIG-IP APM 11.6.0-11.6.3.1, 12.1.0-12.1.3.3, 13.0.0, and 13.1.0-13.1.0.3, APMD may core when processing SAML Assertion or response containing certain elemen… |
CVE-2018-5548 | Medium | 6.1 | 2018-09-13 | On BIG-IP APM 11.6.0-11.6.3, an insecure AES ECB mode is used for orig_uri parameter in an undisclosed /vdesk link of APM virtual server configured with an acc… |
CVE-2018-5545 | High | 8.8 | 2018-09-13 | On F5 WebSafe Alert Server 1.0.0-4.2.6, a malicious, authenticated user can execute code on the alert server by using a maliciously crafted payload. |
CVE-2018-16985 | High | 7.5 | 2018-09-13 | In Lizard (formerly LZ5) 2.0, use of an invalid memory address was discovered in LZ5_compress_continue in lz5_compress.c, related to LZ5_compress_fastSmall and… |
CVE-2018-15310 | Medium | 4.3 | 2018-09-13 | A vulnerability in BIG-IP APM portal access 11.5.1-11.5.7, 11.6.0-11.6.3, and 12.1.0-12.1.3 discloses the BIG-IP software version in rewritten pages. |
CVE-2018-16983 | Critical | 9.8 | 2018-09-13 | NoScript Classic before 5.1.8.7, as used in Tor Browser 7.x and other products, allows attackers to bypass script blocking via the text/html;/json Content-Type… |
CVE-2018-16982 | Medium | 5.5 | 2018-09-13 | Open Chinese Convert (OpenCC) 1.0.5 allows attackers to cause a denial of service (segmentation fault) because BinaryDict::NewFromFile in BinaryDict.cpp may ha… |
CVE-2018-8479 | Medium | 5.6 | 2018-09-13 | A spoofing vulnerability exists for the Azure IoT Device Provisioning for the C SDK library using the HTTP protocol on Windows platform, aka "Azure IoT SDK Spo… |
CVE-2018-8475 | High | 8.8 | 2018-09-13 | A remote code execution vulnerability exists when Windows does not properly handle specially crafted image files, aka "Windows Remote Code Execution Vulnerabil… |
CVE-2018-8474 | High | 7.5 | 2018-09-13 | A security feature bypass vulnerability exists when Lync for Mac 2011 fails to properly sanitize specially crafted messages, aka "Lync for Mac 2011 Security Fe… |
CVE-2018-8470 | Medium | 6.1 | 2018-09-13 | A security feature bypass vulnerability exists in Internet Explorer due to how scripts are handled that allows a universal cross-site scripting (UXSS) conditio… |
CVE-2018-8469 | High | 7.4 | 2018-09-13 | An elevation of privilege vulnerability exists in Microsoft Edge that could allow an attacker to escape from the AppContainer sandbox in the browser, aka "Micr… |
CVE-2018-8468 | Medium | 4.7 | 2018-09-13 | An elevation of privilege vulnerability exists when Windows, allowing a sandbox escape, aka "Windows Elevation of Privilege Vulnerability." This affects Window… |
CVE-2018-8467 | High | 7.5 | 2018-09-13 | A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Eng… |
CVE-2018-8466 | High | 7.5 | 2018-09-13 | A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Eng… |
CVE-2018-8465 | High | 7.5 | 2018-09-13 | A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Eng… |
CVE-2018-8464 | High | 7.5 | 2018-09-13 | An remote code execution vulnerability exists when Microsoft Edge PDF Reader improperly handles objects in memory, aka "Microsoft Edge PDF Remote Code Executio… |
CVE-2018-8463 | High | 7.4 | 2018-09-13 | An elevation of privilege vulnerability exists in Microsoft Edge that could allow an attacker to escape from the AppContainer sandbox in the browser, aka "Micr… |
CVE-2018-8462 | High | 7.8 | 2018-09-13 | An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory, aka "DirectX Graphics Ke… |
CVE-2018-8461 | High | 7.5 | 2018-09-13 | A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, aka "Internet Explorer Memory Corruption Vulnerabili… |
CVE-2018-8459 | High | 7.5 | 2018-09-13 | A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption… |
CVE-2018-8457 | High | 7.5 | 2018-09-13 | A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers, aka "Scripting Engine Memory Corr… |
CVE-2018-8456 | High | 7.5 | 2018-09-13 | A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption… |
CVE-2018-8455 | High | 7.8 | 2018-09-13 | An elevation of privilege vulnerability exists in the way that the Windows Kernel handles objects in memory, aka "Windows Kernel Elevation of Privilege Vulnera… |
CVE-2018-8452 | Medium | 4.3 | 2018-09-13 | An information disclosure vulnerability exists when the scripting engine does not properly handle objects in memory in Microsoft browsers, aka "Scripting Engin… |
CVE-2018-8449 | Low | 3.3 | 2018-09-13 | A security feature bypass exists when Device Guard incorrectly validates an untrusted file, aka "Device Guard Security Feature Bypass Vulnerability." This affe… |
CVE-2018-8447 | High | 7.5 | 2018-09-13 | A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, aka "Internet Explorer Memory Corruption Vulnerabili… |
CVE-2018-8446 | Medium | 5.5 | 2018-09-13 | An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka "Windows Kernel Information Disclosure Vulnera… |
CVE-2018-8445 | Medium | 5.5 | 2018-09-13 | An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka "Windows Kernel Information Disclosure Vulnera… |
CVE-2018-8444 | Medium | 5.9 | 2018-09-13 | An information disclosure vulnerability exists in the way that the Microsoft Server Message Block 2.0 (SMBv2) server handles certain requests, aka "Windows SMB… |
CVE-2018-8443 | Medium | 5.5 | 2018-09-13 | An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka "Windows Kernel Information Disclosure Vulnera… |
CVE-2018-8442 | Medium | 5.5 | 2018-09-13 | An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka "Windows Kernel Information Disclosure Vulnera… |
CVE-2018-8441 | High | 7.8 | 2018-09-13 | An elevation of privilege vulnerability exists due to an integer overflow in Windows Subsystem for Linux, aka "Windows Subsystem for Linux Elevation of Privile… |
CVE-2018-8440 | High | 7.8 | 2018-09-13 | An elevation of privilege vulnerability exists when Windows improperly handles calls to Advanced Local Procedure Call (ALPC), aka "Windows ALPC Elevation of Pr… |
CVE-2018-8439 | High | 8.4 | 2018-09-13 | A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate input from an authenticated user on a guest opera… |
CVE-2018-8438 | Medium | 6.8 | 2018-09-13 | A denial of service vulnerability exists when Microsoft Hyper-V Network Switch on a host server fails to properly validate input from a privileged user on a gu… |
CVE-2018-8437 | Medium | 6.2 | 2018-09-13 | A denial of service vulnerability exists when Microsoft Hyper-V Network Switch on a host server fails to properly validate input from a privileged user on a gu… |
CVE-2018-8436 | Medium | 6.2 | 2018-09-13 | A denial of service vulnerability exists when Microsoft Hyper-V Network Switch on a host server fails to properly validate input from a privileged user on a gu… |
CVE-2018-8435 | Medium | 4.2 | 2018-09-13 | A security feature bypass vulnerability exists when Windows Hyper-V BIOS loader fails to provide a high-entropy source, aka "Windows Hyper-V Security Feature B… |
CVE-2018-8434 | Medium | 5.4 | 2018-09-13 | An information disclosure vulnerability exists when Windows Hyper-V on a host operating system fails to properly validate input from an authenticated user on a… |
CVE-2018-8433 | Medium | 4.7 | 2018-09-13 | An information disclosure vulnerability exists when the Windows Graphics component improperly handles objects in memory, aka "Microsoft Graphics Component Info… |
CVE-2018-8431 | Medium | 5.4 | 2018-09-13 | An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected Share… |
CVE-2018-8430 | High | 7.8 | 2018-09-13 | A remote code execution vulnerability exists in Microsoft Word if a user opens a specially crafted PDF file, aka "Word PDF Remote Code Execution Vulnerability… |
CVE-2018-8429 | Medium | 5.5 | 2018-09-13 | An information disclosure vulnerability exists when Microsoft Excel improperly discloses the contents of its memory, aka "Microsoft Excel Information Disclosur… |
CVE-2018-8428 | Medium | 5.4 | 2018-09-13 | An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected Share… |
CVE-2018-8426 | Medium | 5.4 | 2018-09-13 | A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected Sh… |
CVE-2018-8425 | Medium | 4.3 | 2018-09-13 | A spoofing vulnerability exists when Microsoft Edge improperly handles specific HTML content, aka "Microsoft Edge Spoofing Vulnerability." This affects Microso… |
CVE-2018-8424 | Medium | 6.5 | 2018-09-13 | An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka "Windows GDI Information Dis… |
CVE-2018-8422 | Medium | 6.5 | 2018-09-13 | An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka "Windows GDI Information Dis… |
CVE-2018-8421 | Critical | 9.8 | 2018-09-13 | A remote code execution vulnerability exists when Microsoft .NET Framework processes untrusted input, aka ".NET Framework Remote Code Execution Vulnerability."… |
CVE-2018-8420 | High | 8.8 | 2018-09-13 | A remote code execution vulnerability exists when the Microsoft XML Core Services MSXML parser processes user input, aka "MS XML Remote Code Execution Vulnerab… |
CVE-2018-8419 | Medium | 5.5 | 2018-09-13 | An information disclosure vulnerability exists when the Windows kernel fails to properly initialize a memory address, aka "Windows Kernel Information Disclosur… |
CVE-2018-8410 | High | 7.8 | 2018-09-13 | An elevation of privilege vulnerability exists when the Windows Kernel API improperly handles registry objects in memory, aka "Windows Registry Elevation of Pr… |
CVE-2018-8409 | High | 7.5 | 2018-09-13 | A denial of service vulnerability exists when System.IO.Pipelines improperly handles requests, aka "System.IO.Pipelines Denial of Service." This affects .NET C… |
CVE-2018-8393 | High | 7.8 | 2018-09-13 | A buffer overflow vulnerability exists in the Microsoft JET Database Engine that could allow remote code execution on an affected system, aka "Microsoft JET Da… |
CVE-2018-8392 | High | 7.8 | 2018-09-13 | A buffer overflow vulnerability exists in the Microsoft JET Database Engine that could allow remote code execution on an affected system, aka "Microsoft JET Da… |
CVE-2018-8391 | High | 7.5 | 2018-09-13 | A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption… |
CVE-2018-8367 | High | 7.5 | 2018-09-13 | A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Eng… |
CVE-2018-8366 | Low | 3.1 | 2018-09-13 | An information disclosure vulnerability exists when the Microsoft Edge Fetch API incorrectly handles a filtered response type, aka "Microsoft Edge Information… |
CVE-2018-8354 | High | 7.5 | 2018-09-13 | A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka "Scripting Engine Memory Cor… |