2018 CVEs (page 87)
Page 87 of 162 — CVEs published in 2018, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2018-15491 | High | 7.5 | 2018-08-18 | A vulnerability in the permission and encryption implementation of Zemana Anti-Logger 1.9.3.527 and prior (fixed in 1.9.3.602) allows an attacker to take contr… |
CVE-2018-15482 | Critical | 9.8 | 2018-08-17 | Certain LG devices based on Android 6.0 through 8.1 have incorrect access control for MLT application intents. The LG ID is LVE-SMP-180006. |
CVE-2018-14982 | Critical | 9.8 | 2018-08-17 | Certain LG devices based on Android 6.0 through 8.1 have incorrect access control in the GNSS application. The LG ID is LVE-SMP-180004. |
CVE-2018-14981 | Critical | 9.8 | 2018-08-17 | Certain LG devices based on Android 6.0 through 8.1 have incorrect access control for SystemUI application intents. The LG ID is LVE-SMP-180005. |
CVE-2018-15473 | Medium | 5.3 | 2018-08-17 | OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticating user until after the packet containi… |
CVE-2018-6622 | High | 7.1 | 2018-08-17 | An issue was discovered that affects all producers of BIOS firmware who make a certain realistic interpretation of an obscure portion of the Trusted Computing… |
CVE-2018-15471 | High | 7.8 | 2018-08-17 | An issue was discovered in xenvif_set_hash_mapping in drivers/net/xen-netback/hash.c in the Linux kernel through 4.18.1, as used in Xen through 4.11.x and othe… |
CVE-2018-15470 | Medium | 6.5 | 2018-08-17 | An issue was discovered in Xen through 4.11.x. The logic in oxenstored for handling writes depended on the order of evaluation of expressions making up a tuple… |
CVE-2018-15469 | Medium | 6.5 | 2018-08-17 | An issue was discovered in Xen through 4.11.x. ARM never properly implemented grant table v2, either in the hypervisor or in Linux. Unfortunately, an ARM guest… |
CVE-2018-15468 | Medium | 6.0 | 2018-08-17 | An issue was discovered in Xen through 4.11.x. The DEBUGCTL MSR contains several debugging features, some of which virtualise cleanly, but some do not. In part… |
CVE-2018-14058 | Medium | 6.5 | 2018-08-17 | Pimcore before 5.3.0 allows SQL Injection via the REST web service API. |
CVE-2018-14057 | High | 8.8 | 2018-08-17 | Pimcore before 5.3.0 allows remote attackers to conduct cross-site request forgery (CSRF) attacks by leveraging validation of the X-pimcore-csrf-token anti-CSR… |
CVE-2018-15360 | High | 7.3 | 2018-08-17 | An attacker without authentication can login with default credentials for privileged users in Eltex ESP-200 firmware version 1.2.0. |
CVE-2018-15359 | High | 8.8 | 2018-08-17 | An authenticated attacker with low privileges can use insecure sudo configuration to expand attack surface in Eltex ESP-200 firmware version 1.2.0. |
CVE-2018-15358 | High | 8.8 | 2018-08-17 | An authenticated attacker with low privileges can activate high privileged user and use it to expand attack surface in Eltex ESP-200 firmware version 1.2.0. |
CVE-2018-15357 | Medium | 6.5 | 2018-08-17 | An authenticated attacker with low privileges can extract password hash information for all users in Eltex ESP-200 firmware version 1.2.0. |
CVE-2018-15356 | High | 8.8 | 2018-08-17 | An authenticated attacker can execute arbitrary code using command ejection in Eltex ESP-200 firmware version 1.2.0. |
CVE-2018-15355 | Medium | 5.9 | 2018-08-17 | Usage of SSLv2 and SSLv3 leads to transmitted data decryption in Kraftway 24F2XG Router firmware 3.5.30.1118. |
CVE-2018-15354 | High | 7.5 | 2018-08-17 | A Buffer Overflow exploited through web interface by remote attacker can cause denial of service in Kraftway 24F2XG Router firmware 3.5.30.1118. |
CVE-2018-15353 | Critical | 9.8 | 2018-08-17 | A Buffer Overflow exploited through web interface by remote attacker can cause remote code execution in Kraftway 24F2XG Router firmware 3.5.30.1118. |
CVE-2018-15352 | Medium | 6.5 | 2018-08-17 | An attacker with low privileges can cause denial of service in Kraftway 24F2XG Router firmware version 3.5.30.1118. |
CVE-2018-15351 | Medium | 6.5 | 2018-08-17 | Denial of service via crafting malicious link and sending it to a privileged user can cause Denial of Service in Kraftway 24F2XG Router firmware version 3.5.30… |
CVE-2018-15350 | Critical | 9.8 | 2018-08-17 | Router Default Credentials in Kraftway 24F2XG Router firmware version 3.5.30.1118 allow remote attackers to get privileged access to the router. |
CVE-2018-3785 | Critical | 9.8 | 2018-08-17 | A command injection in git-dummy-commit v1.3.0 allows os level commands to be executed due to an unescaped parameter. |
CVE-2018-3784 | Critical | 9.8 | 2018-08-17 | A code injection in cryo 0.0.6 allows an attacker to arbitrarily execute code due to insecure implementation of deserialization. |
CVE-2018-3783 | Critical | 9.8 | 2018-08-17 | A privilege escalation detected in flintcms versions <= 1.1.9 allows account takeover due to blind MongoDB injection in password reset. |
CVE-2018-5547 | High | 7.8 | 2018-08-17 | Windows Logon Integration feature of F5 BIG-IP APM client prior to version 7.1.7.1 for Windows by default uses Legacy logon mode which uses a SYSTEM account to… |
CVE-2018-5546 | High | 7.8 | 2018-08-17 | The svpn and policyserver components of the F5 BIG-IP APM client prior to version 7.1.7.1 for Linux and macOS runs as a privileged process and can allow an unp… |
CVE-2018-10873 | High | 8.3 | 2018-08-17 | A vulnerability was discovered in SPICE before version 0.14.1 where the generated code used for demarshalling messages lacked sufficient bounds checks. A malic… |
CVE-2018-15122 | High | 7.8 | 2018-08-16 | An issue found in Progress Telerik JustAssembly through 2018.1.323.2 and JustDecompile through 2018.2.605.0 makes it possible to execute code by decompiling a… |
CVE-2018-14567 | Medium | 6.5 | 2018-08-16 | libxml2 2.9.8, if --with-lzma is used, allows remote attackers to cause a denial of service (infinite loop) via a crafted XML file that triggers LZMA_MEMLIMIT_… |
CVE-2018-13446 | High | 7.0 | 2018-08-16 | An issue was discovered in the LINE jp.naver.line application 8.8.1 for Android. The Passcode feature allows authentication bypass via runtime manipulation tha… |
CVE-2018-13435 | High | 7.0 | 2018-08-16 | An issue was discovered in the LINE jp.naver.line application 8.8.0 for iOS. The Passcode feature allows authentication bypass via runtime manipulation that fo… |
CVE-2018-13434 | Medium | 6.3 | 2018-08-16 | An issue was discovered in the LINE jp.naver.line application 8.8.0 for iOS. The LAContext class for Biometric (TouchID) validation allows authentication bypas… |
CVE-2018-12256 | High | 8.8 | 2018-08-16 | admin/vqmods.app/vqmods.inc.php in LiteCart before 2.1.3 allows remote authenticated attackers to upload a malicious file (resulting in remote code execution)… |
CVE-2018-11511 | Critical | 9.8 | 2018-08-16 | The tree list functionality in the photo gallery application in ASUSTOR ADM 3.1.0.RFQ3 has a SQL injection vulnerability that affects the 'album_id' or 'scope'… |
CVE-2018-11509 | Critical | 9.8 | 2018-08-16 | ASUSTOR ADM 3.1.0.RFQ3 uses the same default root:admin username and password as it does for the NAS itself for applications that are installed from the online… |
CVE-2018-1712 | High | 8.6 | 2018-08-16 | IBM API Connect's Developer Portal 5.0.0.0 through 5.0.8.3 is vulnerable to Server Side Request Forgery. An attacker, using specially crafted input parameters… |
CVE-2018-10140 | Medium | 4.3 | 2018-08-16 | The PAN-OS Management Web Interface in Palo Alto Networks PAN-OS 8.1.2 and earlier may allow an authenticated user to shut down all management sessions, result… |
CVE-2018-10139 | Medium | 6.1 | 2018-08-16 | The PAN-OS response for GlobalProtect Gateway in Palo Alto Networks PAN-OS 6.1.21 and earlier, PAN-OS 7.1.18 and earlier, PAN-OS 8.0.11 and earlier may allow a… |
CVE-2018-11771 | Medium | 5.5 | 2018-08-16 | When reading a specially crafted ZIP archive, the read method of Apache Commons Compress 1.7 to 1.17's ZipArchiveInputStream can fail to return the correct EOF… |
CVE-2018-1715 | Medium | 5.4 | 2018-08-16 | IBM Maximo Asset Management 7.6 through 7.6.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the… |
CVE-2018-0428 | Medium | 6.7 | 2018-08-15 | A vulnerability in the account management subsystem of Cisco Web Security Appliance (WSA) could allow an authenticated, local attacker to elevate privileges to… |
CVE-2018-0427 | High | 8.8 | 2018-08-15 | A vulnerability in the CronJob scheduler API of Cisco Digital Network Architecture (DNA) Center could allow an authenticated, remote attacker to perform a comm… |
CVE-2018-0419 | High | 7.5 | 2018-08-15 | A vulnerability in certain attachment detection mechanisms of Cisco Email Security Appliances (ESA) could allow an unauthenticated, remote attacker to bypass t… |
CVE-2018-0418 | High | 8.6 | 2018-08-15 | A vulnerability in the Local Packet Transport Services (LPTS) feature set of Cisco ASR 9000 Series Aggregation Services Router Software could allow an unauthen… |
CVE-2018-0415 | Medium | 6.8 | 2018-08-15 | A vulnerability in the implementation of Extensible Authentication Protocol over LAN (EAPOL) functionality in Cisco Small Business 100 Series Wireless Access P… |
CVE-2018-0412 | Medium | 5.3 | 2018-08-15 | A vulnerability in the implementation of Extensible Authentication Protocol over LAN (EAPOL) functionality in Cisco Small Business 100 Series Wireless Access P… |
CVE-2018-0410 | High | 8.6 | 2018-08-15 | A vulnerability in the web proxy functionality of Cisco AsyncOS Software for Cisco Web Security Appliances could allow an unauthenticated, remote attacker to e… |
CVE-2018-0409 | High | 7.5 | 2018-08-15 | A vulnerability in the XCP Router service of the Cisco Unified Communications Manager IM & Presence Service (CUCM IM&P) and the Cisco TelePresence Video Commun… |
CVE-2018-0386 | Medium | 6.1 | 2018-08-15 | A vulnerability in Cisco Unified Communications Domain Manager Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS)… |
CVE-2018-0367 | Medium | 5.4 | 2018-08-15 | A vulnerability in the web-based management interface of the Cisco Registered Envelope Service could allow an authenticated, remote attacker to conduct a cross… |
CVE-2018-10512 | High | 7.5 | 2018-08-15 | A vulnerability in Trend Micro Control Manager (versions 6.0 and 7.0) could allow an attacker to manipulate a reverse proxy .dll on vulnerable installations, w… |
CVE-2018-10511 | Critical | 10.0 | 2018-08-15 | A vulnerability in Trend Micro Control Manager (versions 6.0 and 7.0) could allow an attacker to conduct a server-side request forgery (SSRF) attack on vulnera… |
CVE-2018-10510 | Critical | 9.8 | 2018-08-15 | A Directory Traversal Remote Code Execution vulnerability in Trend Micro Control Manager (versions 6.0 and 7.0) could allow an attacker to execute arbitrary co… |
CVE-2018-9129 | Medium | 5.9 | 2018-08-15 | ZyXEL ZyWALL/USG series devices have a Bleichenbacher vulnerability in their Internet Key Exchange (IKE) handshake implementation used for IPsec based VPN conn… |
CVE-2018-8753 | Medium | 5.9 | 2018-08-15 | The IKEv1 implementation in Clavister cOS Core before 11.00.11, 11.20.xx before 11.20.06, and 12.00.xx before 12.00.09 allows remote attackers to decrypt RSA-e… |
CVE-2018-14780 | Medium | 4.6 | 2018-08-15 | An out-of-bounds read issue was discovered in the Yubico-Piv 1.5.0 smartcard driver. The file lib/ykpiv.c contains the following code in the function `_ykpiv_f… |
CVE-2018-14779 | Medium | 6.8 | 2018-08-15 | A buffer overflow issue was discovered in the Yubico-Piv 1.5.0 smartcard driver. The file lib/ykpiv.c contains the following code in the function `ykpiv_transf… |
CVE-2018-14722 | High | 8.1 | 2018-08-15 | An issue was discovered in evaluate_auto_mountpoint in btrfsmaintenance-functions in btrfsmaintenance through 0.4.1. Code execution as root can occur via a spe… |
CVE-2018-14007 | Critical | 9.8 | 2018-08-15 | Citrix XenServer 7.1 and newer allows Directory Traversal. |
CVE-2018-11247 | Critical | 9.8 | 2018-08-15 | The JMX/RMI interface in Nasdaq BWise 5.0 does not require authentication for an SAP BO Component, which allows remote attackers to execute arbitrary code via… |
CVE-2018-8414 | High | 8.8 | 2018-08-15 | A remote code execution vulnerability exists when the Windows Shell does not properly validate file paths, aka "Windows Shell Remote Code Execution Vulnerabili… |
CVE-2018-8412 | High | 7.8 | 2018-08-15 | An elevation of privilege vulnerability exists when the Microsoft AutoUpdate (MAU) application for Mac improperly validates updates before executing them, aka… |
CVE-2018-8406 | High | 7.8 | 2018-08-15 | An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory, aka "DirectX Graphics Ke… |
CVE-2018-8405 | High | 7.8 | 2018-08-15 | An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory, aka "DirectX Graphics Ke… |
CVE-2018-8404 | High | 7.0 | 2018-08-15 | An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka "Win32k Elevation of Privil… |
CVE-2018-8403 | High | 7.5 | 2018-08-15 | A remote code execution vulnerability exists in the way that Microsoft browsers access objects in memory, aka "Microsoft Browser Memory Corruption Vulnerabilit… |
CVE-2018-8401 | High | 7.8 | 2018-08-15 | An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory, aka "DirectX Graphics Ke… |
CVE-2018-8400 | High | 7.8 | 2018-08-15 | An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory, aka "DirectX Graphics Ke… |
CVE-2018-8399 | High | 7.0 | 2018-08-15 | An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka "Win32k Elevation of Privil… |
CVE-2018-8398 | Medium | 6.5 | 2018-08-15 | An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka "Windows GDI Information Dis… |
CVE-2018-8397 | High | 8.8 | 2018-08-15 | A remote code execution vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in the memory, aka "GDI+ Remote Code E… |
CVE-2018-8396 | Medium | 4.7 | 2018-08-15 | An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka "Windows GDI Information Dis… |
CVE-2018-8394 | Medium | 6.5 | 2018-08-15 | An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka "Windows GDI Information Dis… |
CVE-2018-8390 | High | 7.5 | 2018-08-15 | A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption… |
CVE-2018-8389 | High | 7.5 | 2018-08-15 | A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "Scripting Engine Memory… |
CVE-2018-8388 | Medium | 4.3 | 2018-08-15 | A spoofing vulnerability exists when Microsoft Edge improperly handles specific HTML content, aka "Microsoft Edge Spoofing Vulnerability." This affects Microso… |
CVE-2018-8387 | High | 7.5 | 2018-08-15 | A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka "Microsoft Edge Memory Corruption Vulnerability." T… |
CVE-2018-8385 | High | 7.5 | 2018-08-15 | A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers, aka "Scripting Engine Memory Corr… |
CVE-2018-8384 | High | 7.5 | 2018-08-15 | A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Eng… |
CVE-2018-8383 | Medium | 4.3 | 2018-08-15 | A spoofing vulnerability exists when Microsoft Edge does not properly parse HTTP content, aka "Microsoft Edge Spoofing Vulnerability." This affects Microsoft E… |
CVE-2018-8382 | Medium | 5.5 | 2018-08-15 | An information disclosure vulnerability exists when Microsoft Excel improperly discloses the contents of its memory, aka "Microsoft Excel Information Disclosur… |
CVE-2018-8381 | High | 7.5 | 2018-08-15 | A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Eng… |
CVE-2018-8380 | High | 7.5 | 2018-08-15 | A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Eng… |
CVE-2018-8379 | High | 7.8 | 2018-08-15 | A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka "Microsoft Excel Rem… |
CVE-2018-8378 | Medium | 5.5 | 2018-08-15 | An information disclosure vulnerability exists when Microsoft Office software reads out of bound memory due to an uninitialized variable, which could disclose… |
CVE-2018-8377 | High | 7.5 | 2018-08-15 | A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka "Microsoft Edge Memory Corruption Vulnerability." T… |
CVE-2018-8376 | High | 8.8 | 2018-08-15 | A remote code execution vulnerability exists in Microsoft PowerPoint software when the software fails to properly handle objects in memory, aka "Microsoft Powe… |
CVE-2018-8375 | High | 7.8 | 2018-08-15 | A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka "Microsoft Excel Rem… |
CVE-2018-8374 | Medium | 4.3 | 2018-08-15 | A tampering vulnerability exists when Microsoft Exchange Server fails to properly handle profile data, aka "Microsoft Exchange Server Tampering Vulnerability."… |
CVE-2018-8373 | High | 7.5 | 2018-08-15 | A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "Scripting Engine Memory… |
CVE-2018-8372 | High | 7.5 | 2018-08-15 | A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers, aka "Scripting Engine Memory Corr… |
CVE-2018-8371 | High | 7.5 | 2018-08-15 | A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "Scripting Engine Memory… |
CVE-2018-8370 | Low | 3.1 | 2018-08-15 | A information disclosure vulnerability exists when WebAudio Library improperly handles audio requests, aka "Microsoft Edge Information Disclosure Vulnerability… |
CVE-2018-8360 | High | 7.5 | 2018-08-15 | An information disclosure vulnerability exists in Microsoft .NET Framework that could allow an attacker to access information in multi-tenant environments, aka… |
CVE-2018-8359 | High | 7.5 | 2018-08-15 | A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption… |
CVE-2018-8358 | Medium | 4.3 | 2018-08-15 | A security feature bypass vulnerability exists when Microsoft Edge improperly handles redirect requests, aka "Microsoft Edge Security Feature Bypass Vulnerabil… |
CVE-2018-8357 | High | 8.3 | 2018-08-15 | An elevation of privilege vulnerability exists in Microsoft browsers allowing sandbox escape, aka "Microsoft Browser Elevation of Privilege Vulnerability." Thi… |
CVE-2018-8355 | High | 7.5 | 2018-08-15 | A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers, aka "Scripting Engine Memory Corr… |