2018 CVEs (page 91)
Page 91 of 162 — CVEs published in 2018, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2018-14851 | Medium | 5.5 | 2018-08-02 | exif_process_IFD_in_MAKERNOTE in ext/exif/exif.c in PHP before 5.6.37, 7.0.x before 7.0.31, 7.1.x before 7.1.20, and 7.2.x before 7.2.8 allows remote attackers… |
CVE-2018-1155 | Medium | 5.4 | 2018-08-02 | In SecurityCenter versions prior to 5.7.0, a cross-site scripting (XSS) issue could allow an authenticated attacker to inject JavaScript code into an image fil… |
CVE-2018-1154 | High | 8.8 | 2018-08-02 | In SecurityCenter versions prior to 5.7.0, a username enumeration issue could allow an unauthenticated attacker to automate the discovery of username aliases v… |
CVE-2018-10922 | High | 7.5 | 2018-08-02 | An input validation flaw exists in ttembed. With a crafted input file, an attacker may be able to trigger a denial of service condition due to ttembed trusting… |
CVE-2018-10921 | Medium | 4.3 | 2018-08-02 | Certain input files may trigger an integer overflow in ttembed input file processing. This overflow could potentially lead to corruption of the input file due… |
CVE-2018-7649 | Medium | 6.1 | 2018-08-02 | Monitorix before 3.10.1 allows XSS via CGI variables. |
CVE-2018-8037 | Medium | 5.9 | 2018-08-02 | If an async request was completed by the application at the same time as the container triggered the async timeout, a race condition existed that could result… |
CVE-2018-1554 | Medium | 5.4 | 2018-08-02 | IBM Maximo Asset Management 7.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus al… |
CVE-2018-1336 | High | 7.5 | 2018-08-02 | An improper handing of overflow in the UTF-8 decoder with supplementary characters can lead to an infinite loop in the decoder causing a Denial of Service. Ver… |
CVE-2018-8032 | Medium | 6.1 | 2018-08-02 | Apache Axis 1.x up to and including 1.4 is vulnerable to a cross-site scripting (XSS) attack in the default servlet/services. |
CVE-2018-12448 | Medium | 5.3 | 2018-08-02 | Whale Browser before 1.3.48.4 displays no URL information but only a title of a web page on the browser's address bar when visiting a non-http page, which allo… |
CVE-2018-10920 | Medium | 6.8 | 2018-08-02 | Improper input validation bug in DNS resolver component of Knot Resolver before 2.4.1 allows remote attacker to poison cache. |
CVE-2018-3109 | Medium | 6.5 | 2018-08-02 | Vulnerability in the Oracle Fusion Middleware MapViewer component of Oracle Fusion Middleware (subcomponent: Map Builder). Supported versions that are affected… |
CVE-2018-3108 | Medium | 6.5 | 2018-08-02 | Vulnerability in the Oracle Fusion Middleware component of Oracle Fusion Middleware (subcomponent: Oracle Notification Service). Supported versions that are af… |
CVE-2018-2933 | Medium | 4.9 | 2018-08-02 | Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Core Components). Supported versions that are affected are… |
CVE-2018-14847 | Critical | 9.1 | 2018-08-02 | MikroTik RouterOS through 6.42 allows unauthenticated remote attackers to read arbitrary files and remote authenticated attackers to write arbitrary files due… |
CVE-2018-14840 | Medium | 6.1 | 2018-08-02 | uploads/.htaccess in Subrion CMS 4.2.1 allows XSS because it does not block .html file uploads (but does block, for example, .htm file uploads). |
CVE-2018-14838 | Medium | 6.1 | 2018-08-02 | rejucms 2.1 has stored XSS via the admin/book.php content parameter. |
CVE-2018-14836 | Medium | 6.5 | 2018-08-02 | Subrion 4.2.1 is vulnerable to Improper Access control because user groups not having access to the Admin panel are able to access it (but not perform actions)… |
CVE-2018-14835 | Medium | 5.4 | 2018-08-02 | Subrion CMS v4.2.1 is vulnerable to Stored XSS because of no escaping added to the tooltip information being displayed in multiple areas. |
CVE-2018-10624 | Medium | 6.5 | 2018-08-01 | In Johnson Controls Metasys System Versions 8.0 and prior and BCPro (BCM) all versions prior to 3.0.2, this vulnerability results from improper error handling… |
CVE-2018-3939 | High | 8.8 | 2018-08-01 | An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Software's PDF Reader, version 9.1.0.5096. A specially crafted PDF documen… |
CVE-2018-3924 | High | 8.8 | 2018-08-01 | An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Software's Foxit PDF Reader version 9.1.5096. A specially crafted PDF docu… |
CVE-2018-3881 | Critical | 9.4 | 2018-08-01 | An exploitable unauthenticated XML external injection vulnerability was identified in FocalScope v2416. A unauthenticated attacker could submit a specially cra… |
CVE-2018-12468 | Critical | 9.1 | 2018-08-01 | A vulnerability in the administration console of Micro Focus GroupWise prior to version 18.0.2 may allow a remote attacker authenticated as an administrator to… |
CVE-2018-0413 | High | 8.8 | 2018-08-01 | A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to conduct a cros… |
CVE-2018-0411 | Medium | 6.1 | 2018-08-01 | A vulnerability in the web-based management interface of Cisco Unified Communications Manager could allow an unauthenticated, remote attacker to conduct a refl… |
CVE-2018-0408 | Medium | 5.4 | 2018-08-01 | A vulnerability in the web-based management interface of Cisco Small Business 300 Series (Sx300) Managed Switches could allow an authenticated, remote attacker… |
CVE-2018-0407 | Medium | 5.4 | 2018-08-01 | A vulnerability in the web-based management interface of Cisco Small Business 300 Series (Sx300) Managed Switches could allow an authenticated, remote attacker… |
CVE-2018-0406 | Medium | 6.1 | 2018-08-01 | A vulnerability in the web-based management interface of Cisco Web Security Appliance (WSA) could allow an unauthenticated, remote attacker to conduct a reflec… |
CVE-2018-0397 | Medium | 5.9 | 2018-08-01 | A vulnerability in Cisco AMP for Endpoints Mac Connector Software installed on Apple macOS 10.12 could allow an unauthenticated, remote attacker to cause a ker… |
CVE-2018-0391 | Medium | 6.5 | 2018-08-01 | A vulnerability in the password change function of Cisco Prime Collaboration Provisioning could allow an authenticated, remote attacker to cause the system to… |
CVE-2018-3847 | High | 8.8 | 2018-08-01 | Multiple exploitable buffer overflow vulnerabilities exist in image parsing functionality of the CFITSIO library version 3.42. Specially crafted images parsed… |
CVE-2018-14777 | Medium | 5.4 | 2018-08-01 | An issue was discovered in DataLife Engine (DLE) through 13.0. An attacker can use XSS (related to the /addnews.html and /index.php?do=addnews URIs) to send a… |
CVE-2018-8034 | High | 7.5 | 2018-08-01 | The host name verification when using TLS with the WebSocket client was missing. It is now enabled by default. Versions Affected: Apache Tomcat 9.0.0.M1 to 9.0… |
CVE-2018-10618 | Critical | 9.8 | 2018-08-01 | Davolink DVW-3200N all version prior to Version 1.00.06. The device generates a weak password hash that is easily cracked, allowing a remote attacker to obtain… |
CVE-2018-1595 | High | 8.8 | 2018-08-01 | IBM Spectrum Symphony and Platform Symphony 7.1.2 and 7.2.0.2 could allow an authenticated user to execute arbitrary commands due to improper handling of user… |
CVE-2018-10897 | High | 8.1 | 2018-08-01 | A directory traversal issue was found in reposync, a part of yum-utils, where reposync fails to sanitize paths in remote repository configuration files. If an… |
CVE-2018-10896 | High | 7.1 | 2018-08-01 | The default cloud-init configuration, in cloud-init 0.6.2 and newer, included "ssh_deletekeys: 0", disabling cloud-init's deletion of ssh host keys. In some en… |
CVE-2018-10894 | Medium | 5.4 | 2018-08-01 | It was found that SAML authentication in Keycloak 3.4.3.Final incorrectly authenticated expired certificates. A malicious user could use this to access unautho… |
CVE-2018-3923 | High | 7.8 | 2018-08-01 | A memory corruption vulnerability exists in the PCX-parsing functionality of Computerinsel Photoline 20.54. A specially crafted PCX image processed via the app… |
CVE-2018-3922 | High | 7.8 | 2018-08-01 | A memory corruption vulnerability exists in the ANI-parsing functionality of Computerinsel Photoline 20.54. A specially crafted ANI image processed via the app… |
CVE-2018-3921 | High | 7.8 | 2018-08-01 | A memory corruption vulnerability exists in the PSD-parsing functionality of Computerinsel Photoline 20.54. A specially crafted PSD image processed via the app… |
CVE-2018-3672 | High | 8.8 | 2018-08-01 | Driver module in Intel Smart Sound Technology before version 9.21.00.3541 potentially allows a local attacker to execute arbitrary code as administrator via a… |
CVE-2018-3671 | Medium | 5.7 | 2018-08-01 | Escalation of privilege in Intel Saffron admin application before 11.4 allows an authenticated user to access unauthorized information. |
CVE-2018-3670 | High | 8.8 | 2018-08-01 | Driver module in Intel Smart Sound Technology before version 9.21.00.3541 potentially allows a local attacker to execute arbitrary code as administrator via a… |
CVE-2018-3666 | High | 8.8 | 2018-08-01 | Driver module in Intel Smart Sound Technology before version 9.21.00.3541 potentially allows a local attacker to execute arbitrary code as administrator via a… |
CVE-2018-3663 | Medium | 5.7 | 2018-08-01 | Escalation of privilege in Intel Saffron MemoryBase before 11.4 allows an authenticated user access to privileged information. |
CVE-2018-3662 | High | 8.0 | 2018-08-01 | Escalation of privilege in Intel Saffron MemoryBase before version 11.4 potentially allows an authorized user of the Saffron application to execute arbitrary c… |
CVE-2018-3650 | High | 7.8 | 2018-08-01 | Insufficient Input Validation in Bleach module in INTEL Distribution for Python versions prior to IDP 2018 Update 2 allows unprivileged user to bypass URI sani… |
CVE-2018-12467 | Medium | 6.0 | 2018-08-01 | Authorized users of the openbuildservice before 2.9.4 could delete packages by using a malicious request against projects having the OBS:InitializeDevelPackage… |
CVE-2018-12466 | Medium | 4.4 | 2018-08-01 | openSUSE openbuildservice before 9.2.4 allowed authenticated users to delete packages on specific projects with project links. |
CVE-2018-10916 | Medium | 5.3 | 2018-08-01 | It has been discovered that lftp up to and including version 4.8.3 does not properly sanitize remote file names, leading to a loss of integrity on the local sy… |
CVE-2018-1999041 | Medium | 5.5 | 2018-08-01 | An exposure of sensitive information vulnerability exists in Jenkins Tinfoil Security Plugin 1.6.1 and earlier in TinfoilScanRecorder.java that allows attacker… |
CVE-2018-1999040 | High | 8.8 | 2018-08-01 | An exposure of sensitive information vulnerability exists in Jenkins Kubernetes Plugin 1.10.1 and earlier in KubernetesCloud.java that allows attackers to capt… |
CVE-2018-1999039 | Medium | 4.3 | 2018-08-01 | A server-side request forgery vulnerability exists in Jenkins Confluence Publisher Plugin 2.0.1 and earlier in ConfluenceSite.java that allows attackers to hav… |
CVE-2018-1999038 | Medium | 4.2 | 2018-08-01 | A confused deputy vulnerability exists in Jenkins Publisher Over CIFS Plugin 0.10 and earlier in CifsPublisherPluginDescriptor.java that allows attackers to ha… |
CVE-2018-1999037 | Medium | 4.3 | 2018-08-01 | A data modification vulnerability exists in Jenkins Resource Disposer Plugin 0.11 and earlier in AsyncResourceDisposer.java that allows attackers to stop track… |
CVE-2018-1999036 | Medium | 6.5 | 2018-08-01 | An exposure of sensitive information vulnerability exists in Jenkins SSH Agent Plugin 1.15 and earlier in SSHAgentStepExecution.java that exposes the SSH priva… |
CVE-2018-1999035 | High | 7.4 | 2018-08-01 | A man in the middle vulnerability exists in Jenkins Inedo BuildMaster Plugin 1.3 and earlier in BuildMasterConfiguration.java, BuildMasterConfig.java, BuildMas… |
CVE-2018-1999034 | High | 7.4 | 2018-08-01 | A man in the middle vulnerability exists in Jenkins Inedo ProGet Plugin 0.8 and earlier in ProGetApi.java, ProGetConfig.java, ProGetConfiguration.java that all… |
CVE-2018-1999033 | Medium | 6.5 | 2018-08-01 | An exposure of sensitive information vulnerability exists in Jenkins Anchore Container Image Scanner Plugin 10.16 and earlier in AnchoreBuilder.java that allow… |
CVE-2018-1999032 | Medium | 6.5 | 2018-08-01 | A data modification vulnerability exists in Jenkins Agiletestware Pangolin Connector for TestRail Plugin 2.1 and earlier in GlobalConfig.java that allows attac… |
CVE-2018-1999031 | Medium | 6.5 | 2018-08-01 | An exposure of sensitive information vulnerability exists in Jenkins meliora-testlab Plugin 1.14 and earlier in TestlabNotifier.java that allows attackers with… |
CVE-2018-1999030 | Medium | 5.4 | 2018-08-01 | An exposure of sensitive information vulnerability exists in Jenkins Maven Artifact ChoiceListProvider (Nexus) Plugin 1.3.1 and earlier in ArtifactoryChoiceLis… |
CVE-2018-1999029 | Medium | 5.4 | 2018-08-01 | A cross-site scripting vulnerability exists in Jenkins Shelve Project Plugin 1.5 and earlier in ShelveProjectAction/index.jelly, ShelvedProjectsAction/index.je… |
CVE-2018-1999028 | High | 8.8 | 2018-08-01 | An exposure of sensitive information vulnerability exists in Jenkins Accurev Plugin 0.7.16 and earlier in AccurevSCM.java that allows attackers to capture cred… |
CVE-2018-1999027 | High | 7.5 | 2018-08-01 | An exposure of sensitive information vulnerability exists in Jenkins SaltStack Plugin 3.1.6 and earlier in SaltAPIBuilder.java, SaltAPIStep.java that allows at… |
CVE-2018-1999026 | Medium | 6.5 | 2018-08-01 | A server-side request forgery vulnerability exists in Jenkins TraceTronic ECU-TEST Plugin 2.3 and earlier in ATXPublisher.java that allows attackers to have Je… |
CVE-2018-1999025 | High | 7.4 | 2018-08-01 | A man in the middle vulnerability exists in Jenkins TraceTronic ECU-TEST Plugin 2.3 and earlier in ATXPublisher.java, ATXValidator.java that allows attackers t… |
CVE-2018-14776 | Medium | 5.4 | 2018-08-01 | Click Studios Passwordstate before 8.3 Build 8397 allows XSS by authenticated users via an uploaded HTML document. |
CVE-2018-14775 | Medium | 5.5 | 2018-08-01 | tss_alloc in sys/arch/i386/i386/gdt.c in OpenBSD 6.2 and 6.3 has a Local Denial of Service (system crash) due to incorrect I/O port access control on the i386… |
CVE-2018-11050 | High | 8.8 | 2018-08-01 | Dell EMC NetWorker versions between 9.0 and 9.1.1.8 through 9.2.1.3, and the version 18.1.0.1 contain a Clear-Text authentication over network vulnerability in… |
CVE-2018-14316 | Medium | 6.5 | 2018-07-31 | This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 9.0.1.5096. User interaction is requir… |
CVE-2018-14315 | High | 8.8 | 2018-07-31 | This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.5096. User interaction is required to ex… |
CVE-2018-14314 | High | 8.8 | 2018-07-31 | This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.5096. User interaction is required to ex… |
CVE-2018-14313 | High | 8.8 | 2018-07-31 | This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.5096. User interaction is required to ex… |
CVE-2018-14312 | High | 8.8 | 2018-07-31 | This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.5096. User interaction is required to ex… |
CVE-2018-14311 | High | 8.8 | 2018-07-31 | This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader. User interaction is required to exploit this… |
CVE-2018-14310 | High | 8.8 | 2018-07-31 | This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.1.0.5096. User interaction is required to ex… |
CVE-2018-14309 | High | 8.8 | 2018-07-31 | This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.1.0.5096. User interaction is required to ex… |
CVE-2018-14308 | High | 8.8 | 2018-07-31 | This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.5096. User interaction is required to ex… |
CVE-2018-14307 | High | 8.8 | 2018-07-31 | This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.5096. User interaction is required to ex… |
CVE-2018-14306 | High | 8.8 | 2018-07-31 | This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.5096. User interaction is required to ex… |
CVE-2018-14305 | High | 8.8 | 2018-07-31 | This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.5096. User interaction is required to ex… |
CVE-2018-14304 | High | 8.8 | 2018-07-31 | This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.5096. User interaction is required to ex… |
CVE-2018-14303 | High | 8.8 | 2018-07-31 | This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.5096. User interaction is required to ex… |
CVE-2018-14302 | High | 8.8 | 2018-07-31 | This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.5096. User interaction is required to ex… |
CVE-2018-14301 | High | 8.8 | 2018-07-31 | This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.5096. User interaction is required to ex… |
CVE-2018-14300 | High | 8.8 | 2018-07-31 | This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.5096. User interaction is required to ex… |
CVE-2018-14299 | High | 8.8 | 2018-07-31 | This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.5096. User interaction is required to ex… |
CVE-2018-14298 | High | 8.8 | 2018-07-31 | This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.5096. User interaction is required to ex… |
CVE-2018-14297 | High | 8.8 | 2018-07-31 | This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.5096. User interaction is required to ex… |
CVE-2018-14296 | High | 8.8 | 2018-07-31 | This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.5096. User interaction is required to ex… |
CVE-2018-14295 | High | 8.8 | 2018-07-31 | This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit PhantomPDF Phantom PDF 9.1.5096. User interaction is… |
CVE-2018-14294 | High | 8.8 | 2018-07-31 | This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.5096. User interaction is required to ex… |
CVE-2018-14293 | High | 8.8 | 2018-07-31 | This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.1.0.5096. User interaction is required to ex… |
CVE-2018-14292 | High | 8.8 | 2018-07-31 | This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.5096. User interaction is required to ex… |
CVE-2018-14291 | High | 8.8 | 2018-07-31 | This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.5096. User interaction is required to ex… |
CVE-2018-14290 | High | 8.8 | 2018-07-31 | This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.1.5096. User interaction is required to ex… |