2018 CVEs (page 89)
Page 89 of 162 — CVEs published in 2018, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2018-10569 | Medium | 6.1 | 2018-08-13 | An issue was discovered in Edimax EW-7438RPn Mini v2 before version 1.26. There is XSS in an SSID field. |
CVE-2018-11770 | Medium | 4.2 | 2018-08-13 | From version 1.3.0 onward, Apache Spark's standalone master exposes a REST API for job submission, in addition to the submission mechanism used by spark-submit… |
CVE-2018-6414 | Critical | 9.8 | 2018-08-13 | A buffer overflow vulnerability in the web server of some Hikvision IP Cameras allows an attacker to send a specially crafted message to affected devices. Due… |
CVE-2018-5925 | High | 7.8 | 2018-08-13 | A security vulnerability has been identified with certain HP Inkjet printers. A maliciously crafted file sent to an affected device can cause a static buffer o… |
CVE-2018-5924 | Critical | 9.8 | 2018-08-13 | A security vulnerability has been identified with certain HP Inkjet printers. A maliciously crafted file sent to an affected device can cause a stack buffer ov… |
CVE-2018-13392 | Medium | 6.1 | 2018-08-13 | Several resources in Atlassian Fisheye and Crucible before version 4.6.0 allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripti… |
CVE-2018-0714 | Critical | 9.8 | 2018-08-13 | Command injection vulnerability in Helpdesk versions 1.1.21 and earlier in QNAP QTS 4.2.6 build 20180531, QTS 4.3.3 build 20180528, QTS 4.3.4 build 20180528 an… |
CVE-2018-3776 | Medium | 5.3 | 2018-08-12 | Improper input validator in Nextcloud Server prior to 12.0.3 and 11.0.5 could lead to an attacker's actions not being logged in the audit log. |
CVE-2018-3775 | High | 8.8 | 2018-08-12 | Improper Authentication in Nextcloud Server prior to version 12.0.3 would allow an attacker that obtained user credentials to bypass the 2 Factor Authenticatio… |
CVE-2018-3774 | Critical | 10.0 | 2018-08-12 | Incorrect parsing in url-parse <1.4.3 returns wrong hostname which leads to multiple vulnerabilities such as SSRF, Open Redirect, Bypass Authentication Protoco… |
CVE-2018-3110 | Critical | 9.9 | 2018-08-10 | A vulnerability was discovered in the Java VM component of Oracle Database Server. Supported versions that are affected are 11.2.0.4, 12.1.0.2, 12.2.0.1 and 18… |
CVE-2018-3779 | Critical | 9.8 | 2018-08-10 | active-support ruby gem 5.2.0 could allow a remote attacker to execute arbitrary code on the system, caused by containing a malicious backdoor. An attacker cou… |
CVE-2018-11063 | High | 7.8 | 2018-08-10 | Dell WMS versions 1.1 and prior are impacted by multiple unquoted service path vulnerabilities. Affected software installs multiple services incorrectly by spe… |
CVE-2018-11048 | High | 8.1 | 2018-08-10 | Dell EMC Data Protection Advisor, versions 6.2, 6,3, 6.4, 6.5 and Dell EMC Integrated Data Protection Appliance (IDPA) versions 2.0, 2.1 contain a XML External… |
CVE-2018-14785 | High | 7.5 | 2018-08-10 | NetComm Wireless G LTE Light Industrial M2M Router (NWL-25) with firmware 2.0.29.11 and prior. The directory of the device is listed openly without authenticat… |
CVE-2018-14784 | Medium | 6.1 | 2018-08-10 | NetComm Wireless G LTE Light Industrial M2M Router (NWL-25) with firmware 2.0.29.11 and prior. The device is vulnerable to several cross-site scripting attacks… |
CVE-2018-14783 | High | 8.8 | 2018-08-10 | NetComm Wireless G LTE Light Industrial M2M Router (NWL-25) with firmware 2.0.29.11 and prior. A cross-site request forgery condition can occur, allowing an at… |
CVE-2018-14782 | High | 7.5 | 2018-08-10 | NetComm Wireless G LTE Light Industrial M2M Router (NWL-25) with firmware 2.0.29.11 and prior. The device allows access to configuration files and profiles wit… |
CVE-2018-13341 | High | 8.8 | 2018-08-10 | Crestron TSW-X60 all versions prior to 2.001.0037.001 and MC3 all versions prior to 1.502.0047.00, The passwords for special sudo accounts may be calculated us… |
CVE-2018-10630 | Critical | 9.8 | 2018-08-10 | For Crestron TSW-X60 version prior to 2.001.0037.001 and MC3 version prior to 1.502.0047.001, The devices are shipped with authentication disabled, and there i… |
CVE-2018-10626 | Medium | 4.4 | 2018-08-10 | Medtronic MyCareLink Patient Monitor’s update service does not sufficiently verify the authenticity of the data uploaded. An attacker who obtains per-product… |
CVE-2018-10622 | Medium | 5.2 | 2018-08-10 | Medtronic MyCareLink Patient Monitor uses per-product credentials that are stored in a recoverable format. An attacker can use these credentials for network au… |
CVE-2018-15191 | Medium | 6.5 | 2018-08-10 | PHP Scripts Mall hotel-booking-script 2.0.4 allows remote attackers to cause a denial of service via crafted JavaScript code in the First Name, Last Name, or A… |
CVE-2018-15190 | Medium | 5.4 | 2018-08-10 | PHP Scripts Mall hotel-booking-script 2.0.4 allows XSS via the First Name, Last Name, or Address field. |
CVE-2018-7754 | Medium | 5.5 | 2018-08-10 | The aoedisk_debugfs_show function in drivers/block/aoe/aoeblk.c in the Linux kernel through 4.16.4rc4 allows local users to obtain sensitive address informatio… |
CVE-2018-14837 | Medium | 4.8 | 2018-08-10 | Wolf CMS 0.8.3.1 has XSS in the Snippets tab, as demonstrated by a ?/admin/snippet/edit/1 URI. |
CVE-2018-14503 | Medium | 6.1 | 2018-08-10 | Cross-site scripting (XSS) vulnerability in intervalCheck.jsp in Coremail XT 3.0 allows remote attackers to inject arbitrary web script or HTML via the sid par… |
CVE-2018-14028 | High | 7.2 | 2018-08-10 | In WordPress 4.9.7, plugins uploaded via the admin area are not verified as being ZIP files. This allows for PHP files to be uploaded. Once a PHP file is uploa… |
CVE-2018-11492 | High | 7.5 | 2018-08-10 | ASUS HG100 devices allow denial of service via an IPv4 packet flood. |
CVE-2018-6556 | Low | 3.3 | 2018-08-10 | lxc-user-nic when asked to delete a network interface will unconditionally open a user provided path. This code path may be used by an unprivileged user to che… |
CVE-2018-6553 | High | 8.8 | 2018-08-10 | The CUPS AppArmor profile incorrectly confined the dnssd backend due to use of hard links. A local attacker could possibly use this issue to escape confinement… |
CVE-2018-15189 | Medium | 5.4 | 2018-08-10 | PHP Scripts Mall advanced-real-estate-script has XSS via the Name field of a profile. |
CVE-2018-15188 | Medium | 6.5 | 2018-08-10 | PHP Scripts Mall advanced-real-estate-script 4.0.9 allows remote attackers to cause a denial of service (page structure loss) via crafted JavaScript code in th… |
CVE-2018-15187 | High | 8.0 | 2018-08-10 | PHP Scripts Mall advanced-real-estate-script 4.0.9 has CSRF via edit-profile.php. |
CVE-2018-15186 | High | 8.8 | 2018-08-10 | PHP Scripts Mall Chartered Accountant : Auditor Website 2.0.1 has CSRF via client/auditor/updprofile.php. |
CVE-2018-15185 | Medium | 6.5 | 2018-08-10 | PHP Scripts Mall Naukri / Shine / Jobsite Clone Script 3.0.4 allows remote attackers to cause a denial of service (page update outage) via crafted PHP and Java… |
CVE-2018-13390 | Medium | 6.1 | 2018-08-10 | Unauthenticated access to cloudtoken daemon on Linux via network from version 0.1.1 before version 0.1.24 allows attackers on the same subnet to gain temporary… |
CVE-2018-10769 | High | 7.5 | 2018-08-10 | The transferProxy and approveProxy functions of a smart contract implementation for SmartMesh (SMT), an Ethereum ERC20 token, allow attackers to accomplish an… |
CVE-2018-7692 | Medium | 6.1 | 2018-08-09 | Unvalidated redirect vulnerability in in NetIQ eDirectory before 9.1.1 HF1. |
CVE-2018-7686 | High | 7.5 | 2018-08-09 | Information leakage vulnerability in NetIQ eDirectory before 9.1.1 HF1 due to shared memory usage. |
CVE-2018-10925 | High | 8.1 | 2018-08-09 | It was discovered that PostgreSQL versions before 10.5, 9.6.10, 9.5.14, 9.4.19, and 9.3.24 failed to properly check authorization on certain statements involve… |
CVE-2018-14735 | High | 7.5 | 2018-08-09 | An Information Exposure issue was discovered in Hitachi Command Suite 8.5.3. A remote attacker may be able to exploit a flaw in the permission of messaging tha… |
CVE-2018-10931 | Critical | 9.8 | 2018-08-09 | It was found that cobbler 2.6.x exposed all functions from its CobblerXMLRPCInterface class over XMLRPC. A remote, unauthenticated attacker could use this flaw… |
CVE-2018-10915 | High | 8.5 | 2018-08-09 | A vulnerability was found in libpq, the default PostgreSQL client library where libpq failed to properly reset its internal state between connections. If an af… |
CVE-2018-0429 | High | 7.8 | 2018-08-09 | Stack-based buffer overflow in the Cisco Thor decoder before commit 18de8f9f0762c3a542b1122589edb8af859d9813 allows local users to cause a denial of service (s… |
CVE-2018-15184 | Medium | 5.4 | 2018-08-09 | PHP Scripts Mall Naukri / Shine / Jobsite Clone Script 3.0.4 has Stored XSS via the USERNAME field, a related issue to CVE-2018-6795. |
CVE-2018-15183 | Medium | 6.1 | 2018-08-09 | PHP Scripts Mall Myperfectresume / JobHero / Resume Clone Script 2.0.6 has Stored XSS via the Full Name and Title fields. |
CVE-2018-15182 | Medium | 5.4 | 2018-08-09 | PHP Scripts Mall Car Rental Script 2.0.8 has XSS via the FirstName and LastName fields. |
CVE-2018-15181 | Medium | 6.5 | 2018-08-09 | JioFi 4G Hotspot M2S devices allow attackers to cause a denial of service (secure configuration outage) via an XSS payload in the SSID name and Security Key fi… |
CVE-2018-15133 | High | 8.1 | 2018-08-09 | In Laravel Framework through 5.5.40 and 5.6.x through 5.6.29, remote code execution might occur as a result of an unserialize call on a potentially untrusted X… |
CVE-2018-10908 | Medium | 6.5 | 2018-08-09 | It was found that vdsm before version 4.20.37 invokes qemu-img on untrusted inputs without limiting resources. By uploading a specially crafted image, an attac… |
CVE-2018-6922 | Medium | 5.3 | 2018-08-09 | One of the data structures that holds TCP segments in all versions of FreeBSD prior to 11.2-RELEASE-p1, 11.1-RELEASE-p12, and 10.4-RELEASE-p10 uses an ineffici… |
CVE-2018-3778 | Medium | 5.3 | 2018-08-08 | Improper authorization in aedes version <0.35.0 will publish a LWT in a channel when a client is not authorized. |
CVE-2018-14526 | Medium | 6.5 | 2018-08-08 | An issue was discovered in rsn_supp/wpa.c in wpa_supplicant 2.0 through 2.6. Under certain conditions, the integrity of EAPOL-Key messages is not checked, lead… |
CVE-2018-11561 | High | 7.5 | 2018-08-08 | An integer overflow in the unprotected distributeToken function of a smart contract implementation for EETHER (EETHER), an Ethereum ERC20 token, will lead to a… |
CVE-2018-11769 | High | 7.2 | 2018-08-08 | CouchDB administrative users before 2.2.0 can configure the database server via HTTP(S). Due to insufficient validation of administrator-supplied configuration… |
CVE-2018-12408 | High | 7.5 | 2018-08-08 | The BusinessWorks engine component of TIBCO Software Inc.'s TIBCO ActiveMatrix BusinessWorks, TIBCO ActiveMatrix BusinessWorks for z/Linux, and TIBCO ActiveMat… |
CVE-2018-15209 | High | 8.8 | 2018-08-08 | ChopUpSingleUncompressedStrip in tif_dirread.c in LibTIFF 4.0.9 allows remote attackers to cause a denial of service (heap-based buffer overflow and applicatio… |
CVE-2018-15203 | Medium | 6.5 | 2018-08-08 | An issue was discovered in Ignited CMS through 2017-02-19. ign/index.php/admin/pages/add_page allows a CSRF attack to add pages. |
CVE-2018-15202 | Medium | 6.3 | 2018-08-08 | An issue was discovered in Juunan06 eCommerce through 2018-08-05. There is a CSRF vulnerability in ee/eBoutique/app/template/includes/crudTreatment.php that ca… |
CVE-2018-15199 | Medium | 5.4 | 2018-08-08 | AuraCMS 2.3 allows XSS via a Bukutamu -> AddGuestbook action. |
CVE-2018-15198 | High | 8.8 | 2018-08-08 | An issue was discovered in OneThink v1.1. There is a CSRF vulnerability in admin.php?s=/User/add.html that can add a user. |
CVE-2018-15197 | High | 8.8 | 2018-08-08 | An issue was discovered in OneThink v1.1. There is a CSRF vulnerability in admin.php?s=/AuthManager/addToGroup.html that can endow administrator privileges. |
CVE-2018-15193 | High | 8.8 | 2018-08-08 | A CSRF vulnerability in the admin panel in Gogs through 0.11.53 allows remote attackers to execute admin operations via a crafted issue / link. |
CVE-2018-15192 | High | 8.6 | 2018-08-08 | An SSRF vulnerability in webhooks in Gitea through 1.5.0-rc2 and Gogs through 0.11.53 allows remote attackers to access intranet services. |
CVE-2018-15178 | Medium | 6.1 | 2018-08-08 | Open redirect vulnerability in Gogs before 0.12 allows remote attackers to redirect users to arbitrary websites and conduct phishing attacks via an initial /\… |
CVE-2018-15177 | High | 8.8 | 2018-08-08 | In Gxlcms 2.0, a news/index.php?s=Admin-Admin-Insert CSRF attack can add an administrator account. |
CVE-2018-15176 | High | 7.8 | 2018-08-08 | XnView 2.45 allows remote attackers to cause a denial of service (User Mode Write AV starting at MSVCR120!memcpy+0x0000000000000074 and application crash) or p… |
CVE-2018-15175 | High | 7.8 | 2018-08-08 | XnView 2.45 allows remote attackers to cause a denial of service (User Mode Write AV starting at Qt5Core!QVariant::~QVariant+0x0000000000000014 and application… |
CVE-2018-15174 | High | 7.8 | 2018-08-08 | XnView 2.45 allows remote attackers to cause a denial of service (Read Access Violation at the Instruction Pointer and application crash) or possibly have unsp… |
CVE-2018-15173 | High | 7.5 | 2018-08-08 | Nmap through 7.70, when the -sV option is used, allows remote attackers to cause a denial of service (stack consumption and application crash) via a crafted TC… |
CVE-2018-15169 | Medium | 6.1 | 2018-08-08 | A reflected Cross-site scripting (XSS) vulnerability in Zoho ManageEngine Applications Manager 13 before build 13820 allows remote attackers to inject arbitrar… |
CVE-2018-15168 | Critical | 9.8 | 2018-08-08 | A SQL Injection vulnerability exists in the Zoho ManageEngine Applications Manager 13 before build 13820 via the resids parameter in a /editDisplaynames.do?met… |
CVE-2018-15137 | Critical | 9.8 | 2018-08-08 | CeLa Link CLR-M20 devices allow unauthorized users to upload any file (e.g., asp, aspx, cfm, html, jhtml, jsp, or shtml), which causes remote code execution as… |
CVE-2018-5383 | Medium | 6.8 | 2018-08-07 | Bluetooth firmware or operating system software drivers in macOS versions before 10.13, High Sierra and iOS versions before 11.4, and Android versions before t… |
CVE-2018-5995 | Medium | 5.5 | 2018-08-07 | The pcpu_embed_first_chunk function in mm/percpu.c in the Linux kernel through 4.14.14 allows local users to obtain sensitive address information by reading dm… |
CVE-2018-5953 | Medium | 5.5 | 2018-08-07 | The swiotlb_print_info function in lib/swiotlb.c in the Linux kernel through 4.14.14 allows local users to obtain sensitive address information by reading dmes… |
CVE-2018-15132 | High | 7.5 | 2018-08-07 | An issue was discovered in ext/standard/link_win32.c in PHP before 5.6.37, 7.0.x before 7.0.31, 7.1.x before 7.1.20, and 7.2.x before 7.2.8. The linkinfo funct… |
CVE-2018-12885 | Medium | 5.9 | 2018-08-07 | The randMod() function of the smart contract implementation for MyCryptoChamp, an Ethereum game, generates a random value with publicly readable variables such… |
CVE-2018-11456 | Medium | 5.8 | 2018-08-07 | A vulnerability has been identified in Automation License Manager 5 (All versions < 5.3.4.4). An attacker with network access to the device could send speciall… |
CVE-2018-11455 | High | 8.8 | 2018-08-07 | A vulnerability has been identified in Automation License Manager 5 (All versions < 5.3.4.4), Automation License Manager 6 (All versions < 6.0.1). A directory… |
CVE-2018-11454 | High | 8.6 | 2018-08-07 | A vulnerability has been identified in SIMATIC STEP 7 (TIA Portal) and WinCC (TIA Portal) V10, V11, V12 (All versions), SIMATIC STEP 7 (TIA Portal) and WinCC (… |
CVE-2018-11453 | High | 7.8 | 2018-08-07 | A vulnerability has been identified in SIMATIC STEP 7 (TIA Portal) and WinCC (TIA Portal) V10, V11, V12 (All versions), SIMATIC STEP 7 (TIA Portal) and WinCC (… |
CVE-2018-15130 | Medium | 5.4 | 2018-08-07 | ThinkSAAS through 2018-07-25 has XSS via the index.php?app=group&ac=create&ts=do groupdesc parameter. |
CVE-2018-1690 | Medium | 5.4 | 2018-08-07 | IBM Rhapsody Model Manager 6.0.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus a… |
CVE-2018-15129 | Medium | 5.4 | 2018-08-07 | ThinkSAAS through 2018-07-25 has XSS via the index.php?app=article&ac=comment&ts=do content parameter. |
CVE-2018-14869 | Medium | 5.4 | 2018-08-06 | PHP Template Store Script 3.0.6 allows XSS via the Address line 1, Address Line 2, Bank name, or A/C Holder name field in a profile. |
CVE-2018-14857 | High | 8.8 | 2018-08-06 | Unrestricted file upload (with remote code execution) in require/mail/NotificationMail.php in Webconsole in OCS Inventory NG OCS Inventory Server through 2.5 a… |
CVE-2018-7092 | High | 7.5 | 2018-08-06 | A potential security vulnerability has been identified in HPE Intelligent Management Center Platform (IMC Plat) 7.3 E0506P09. The vulnerability could be remote… |
CVE-2018-7091 | Medium | 6.1 | 2018-08-06 | HPE XP P9000 Command View Advanced Edition Software (CVAE) has open URL redirection vulnerability in versions 7.0.0-00 to earlier than 8.60-00 of DevMgr, TSMgr… |
CVE-2018-7090 | Medium | 6.1 | 2018-08-06 | HPE XP P9000 Command View Advanced Edition Software (CVAE) has local and remote cross site scripting vulnerability in versions 7.0.0-00 to earlier than 8.60-00… |
CVE-2018-7078 | High | 7.2 | 2018-08-06 | A remote code execution was identified in HPE Integrated Lights-Out 4 (iLO 4) earlier than version v2.60 and HPE Integrated Lights-Out 5 (iLO 5) earlier than v… |
CVE-2018-7075 | Medium | 6.1 | 2018-08-06 | A remote cross-site scripting (XSS) vulnerability was identified in HPE Intelligent Management Center (iMC) PLAT version v7.3 (E0506). The vulnerability is fix… |
CVE-2018-7074 | Critical | 9.8 | 2018-08-06 | A remote code execution vulnerability was identified in HPE Intelligent Management Center (iMC) PLAT 7.3 E0506P07. The vulnerability was resolved in iMC PLAT 7… |
CVE-2018-7073 | Medium | 5.5 | 2018-08-06 | A local arbitrary file modification vulnerability was identified in HPE Moonshot Provisioning Manager prior to v1.24. |
CVE-2018-7072 | Critical | 9.8 | 2018-08-06 | A remote bypass of security restrictions vulnerability was identified in HPE Moonshot Provisioning Manager prior to v1.24. |
CVE-2018-7071 | Medium | 4.3 | 2018-08-06 | HPE has identified a remote access to sensitive information vulnerability in HPE Network Function Virtualization Director (NFVD) 4.2.1 prior to gui patch 3. |
CVE-2018-7070 | Medium | 5.3 | 2018-08-06 | HPE has identified a remote disclosure of information vulnerability in HPE CentralView Fraud Risk Management earlier than version CV 6.1. This issue is resolve… |
CVE-2018-7069 | High | 7.5 | 2018-08-06 | HPE has identified a remote unauthenticated access to files vulnerability in HPE CentralView Fraud Risk Management earlier than version CV 6.1. This issue is r… |
CVE-2018-7068 | Medium | 6.1 | 2018-08-06 | HPE has identified a remote HOST header attack vulnerability in HPE CentralView Fraud Risk Management earlier than version CV 6.1. This issue is resolved in HF… |