2018 CVEs (page 94)
Page 94 of 162 — CVEs published in 2018, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2018-5387 | High | 7.5 | 2018-07-24 | Wizkunde SAMLBase may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate t… |
CVE-2018-5386 | High | 7.5 | 2018-07-24 | Some Navarino Infinity functions, up to version 2.2, placed in the URL can bypass any authentication mechanism leading to an information leak. |
CVE-2018-5385 | High | 8.8 | 2018-07-24 | Navarino Infinity is prone to session fixation attacks. The server accepts the session ID as a GET parameter which can lead to bypassing the two factor authent… |
CVE-2018-5384 | Critical | 9.8 | 2018-07-24 | Navarino Infinity web interface up to version 2.2 exposes an unauthenticated script that is prone to blind sql injection. If successfully exploited the user ca… |
CVE-2018-14579 | Critical | 9.8 | 2018-07-24 | GolemCMS through 2008-12-24, if the install/ directory remains active after an installation, allows remote attackers to execute arbitrary PHP code by inserting… |
CVE-2018-14335 | Medium | 6.5 | 2018-07-24 | An issue was discovered in H2 1.4.197. Insecure handling of permissions in the backup function allows attackers to read sensitive files (outside of their permi… |
CVE-2018-13386 | High | 8.1 | 2018-07-24 | There was an argument injection vulnerability in Sourcetree for Windows via filenames in Mercurial repositories. An attacker with permission to commit to a Mer… |
CVE-2018-13385 | Critical | 9.8 | 2018-07-24 | There was an argument injection vulnerability in Sourcetree for macOS via filenames in Mercurial repositories. An attacker with permission to commit to a Mercu… |
CVE-2018-10905 | High | 7.8 | 2018-07-24 | CloudForms Management Engine (cfme) is vulnerable to an improper security setting in the dRuby component of CloudForms. An attacker with access to an unprivile… |
CVE-2018-10608 | High | 7.5 | 2018-07-24 | SEL AcSELerator Architect version 2.2.24.0 and prior can be exploited when the AcSELerator Architect FTP client connects to a malicious FTP server, which may c… |
CVE-2018-10604 | High | 8.8 | 2018-07-24 | SEL Compass version 3.0.5.1 and prior allows all users full access to the SEL Compass directory, which may allow modification or overwriting of files within th… |
CVE-2018-10600 | Critical | 9.8 | 2018-07-24 | SEL AcSELerator Architect version 2.2.24.0 and prior allows unsanitized input to be passed to the XML parser, which may allow disclosure and retrieval of arbit… |
CVE-2018-14573 | Medium | 5.5 | 2018-07-23 | A Local File Inclusion (LFI) vulnerability exists in the Web Interface API of TightRope Media Carousel Digital Signage before 7.3.5. The RenderingFetch API all… |
CVE-2018-8031 | Medium | 6.1 | 2018-07-23 | The Apache TomEE console (tomee-webapp) has a XSS vulnerability which could allow javascript to be executed if the user is given a malicious URL. This web appl… |
CVE-2018-10912 | Medium | 4.9 | 2018-07-23 | keycloak before version 4.0.0.final is vulnerable to a infinite loop in session replacement. A Keycloak cluster with multiple nodes could mishandle an expired… |
CVE-2018-11452 | High | 7.5 | 2018-07-23 | A vulnerability has been identified in Firmware variant IEC 61850 for EN100 Ethernet module (All versions < V4.33), Firmware variant PROFINET IO for EN100 Ethe… |
CVE-2018-11451 | High | 7.5 | 2018-07-23 | A vulnerability has been identified in Firmware variant IEC 61850 for EN100 Ethernet module (All versions < V4.33), Firmware variant PROFINET IO for EN100 Ethe… |
CVE-2018-14570 | High | 8.8 | 2018-07-23 | A file upload vulnerability in application/shop/controller/member.php in Niushop B2B2C Multi-business basic version V1.11 allows any remote member to upload a… |
CVE-2018-14568 | High | 7.5 | 2018-07-23 | Suricata before 4.0.5 stops TCP stream inspection upon a TCP RST from a server. This allows detection bypass because Windows TCP clients proceed with normal pr… |
CVE-2018-14328 | Critical | 9.8 | 2018-07-23 | Brynamics "Online Trade - Online trading and cryptocurrency investment system" allows remote attackers to obtain sensitive information via a direct request for… |
CVE-2018-1999007 | Medium | 5.4 | 2018-07-23 | A cross-site scripting vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in the Stapler web framework's org/kohsuke/stapler/Stapler.java t… |
CVE-2018-1999006 | Medium | 4.3 | 2018-07-23 | A exposure of sensitive information vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in Plugin.java that allows attackers to determine th… |
CVE-2018-1999005 | Medium | 5.4 | 2018-07-23 | A cross-site scripting vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in BuildTimelineWidget.java, BuildTimelineWidget/control.jelly th… |
CVE-2018-1999004 | Medium | 4.3 | 2018-07-23 | A Improper authorization vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in SlaveComputer.java that allows attackers with Overall/Read p… |
CVE-2018-1999003 | Medium | 4.3 | 2018-07-23 | A Improper authorization vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in Queue.java that allows attackers with Overall/Read permissio… |
CVE-2018-1999002 | High | 7.5 | 2018-07-23 | A arbitrary file read vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in the Stapler web framework's org/kohsuke/stapler/Stapler.java th… |
CVE-2018-1999001 | High | 8.8 | 2018-07-23 | A unauthorized modification of configuration vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in User.java that allows attackers to provi… |
CVE-2018-11757 | Critical | 9.8 | 2018-07-23 | In Docker Skeleton Runtime for Apache OpenWhisk, a Docker action inheriting the Docker tag openwhisk/dockerskeleton:1.3.0 (or earlier) may allow an attacker to… |
CVE-2018-11756 | Critical | 9.8 | 2018-07-23 | In PHP Runtime for Apache OpenWhisk, a Docker action inheriting one of the Docker tags openwhisk/action-php-v7.2:1.0.0 or openwhisk/action-php-v7.1:1.0.1 (or e… |
CVE-2018-1999024 | Medium | 5.4 | 2018-07-23 | MathJax version prior to version 2.7.4 contains a Cross Site Scripting (XSS) vulnerability in the \unicode{} macro that can result in Potentially untrusted Jav… |
CVE-2018-1999023 | High | 8.8 | 2018-07-23 | The Battle for Wesnoth Project version 1.7.0 through 1.14.3 contains a Code Injection vulnerability in the Lua scripting engine that can result in code executi… |
CVE-2018-1999022 | Critical | 9.8 | 2018-07-23 | PEAR HTML_QuickForm version 3.2.14 contains an eval injection (CWE-95) vulnerability in HTML_QuickForm's getSubmitValue method, HTML_QuickForm's validate metho… |
CVE-2018-6683 | High | 7.4 | 2018-07-23 | Exploiting Incorrectly Configured Access Control Security Levels vulnerability in McAfee Data Loss Prevention (DLP) for Windows versions prior to 10.0.505 and… |
CVE-2018-1999021 | Medium | 5.4 | 2018-07-23 | Gleezcms Gleez Cms version 1.3.0 contains a Cross Site Scripting (XSS) vulnerability in Profile page that can result in Inject arbitrary web script or HTML via… |
CVE-2018-1999020 | Medium | 5.5 | 2018-07-23 | Open Networking Foundation (ONF) ONOS version 1.13.2 and earlier version contains a Directory Traversal vulnerability in core/common/src/main/java/org/onosproj… |
CVE-2018-1999019 | Critical | 9.8 | 2018-07-23 | Chamilo LMS version 11.x contains an Unserialization vulnerability in the "hash" GET parameter for the api endpoint located at /webservices/api/v2.php that can… |
CVE-2018-1999018 | Medium | 6.6 | 2018-07-23 | Pydio version 8.2.1 and prior contains an Unvalidated user input leading to Remote Code Execution (RCE) vulnerability in plugins/action.antivirus/AntivirusScan… |
CVE-2018-1999017 | Medium | 4.9 | 2018-07-23 | Pydio version 8.2.0 and earlier contains a Server-Side Request Forgery (SSRF) vulnerability in plugins/action.updater/UpgradeManager.php Line: 154, getUpgradeP… |
CVE-2018-1999016 | Medium | 6.1 | 2018-07-23 | Pydio version 8.2.0 and earlier contains a Cross Site Scripting (XSS) vulnerability in ./core/vendor/meenie/javascript-packer/example-inline.php line 48; ./cor… |
CVE-2018-1999015 | Medium | 6.5 | 2018-07-23 | FFmpeg before commit 5aba5b89d0b1d73164d3b81764828bb8b20ff32a contains an out of array read vulnerability in ASF_F format demuxer that can result in heap memor… |
CVE-2018-1999014 | Medium | 6.5 | 2018-07-23 | FFmpeg before commit bab0716c7f4793ec42e05a5aa7e80d82a0dd4e75 contains an out of array access vulnerability in MXF format demuxer that can result in DoS. This… |
CVE-2018-1999013 | Medium | 6.5 | 2018-07-23 | FFmpeg before commit a7e032a277452366771951e29fd0bf2bd5c029f0 contains a use-after-free vulnerability in the realmedia demuxer that can result in vulnerability… |
CVE-2018-1999012 | Medium | 6.5 | 2018-07-23 | FFmpeg before commit 9807d3976be0e92e4ece3b4b1701be894cd7c2e1 contains a CWE-835: Infinite loop vulnerability in pva format demuxer that can result in a Vulner… |
CVE-2018-1999011 | High | 8.8 | 2018-07-23 | FFmpeg before commit 2b46ebdbff1d8dec7a3d8ea280a612b91a582869 contains a Buffer Overflow vulnerability in asf_o format demuxer that can result in heap-buffer-o… |
CVE-2018-1999010 | Critical | 9.8 | 2018-07-23 | FFmpeg before commit cced03dd667a5df6df8fd40d8de0bff477ee02e8 contains multiple out of array access vulnerabilities in the mms protocol that can result in atta… |
CVE-2018-1999009 | High | 8.1 | 2018-07-23 | October CMS version prior to Build 437 contains a Local File Inclusion vulnerability in modules/system/traits/ViewMaker.php#244 (makeFileContents function) tha… |
CVE-2018-1999008 | Medium | 5.4 | 2018-07-23 | October CMS version prior to build 437 contains a Cross Site Scripting (XSS) vulnerability in the Media module and create folder functionality that can result… |
CVE-2018-14565 | Critical | 9.8 | 2018-07-23 | An issue was discovered in libthulac.so in THULAC through 2018-02-25. A heap-based buffer over-read can occur in NGramFeature::find_bases in include/cb_ngram_f… |
CVE-2018-14564 | Critical | 9.8 | 2018-07-23 | An issue was discovered in libthulac.so in THULAC through 2018-02-25. A SEGV can occur in NGramFeature::find_bases in include/cb_ngram_feature.h. |
CVE-2018-14563 | Critical | 9.8 | 2018-07-23 | An issue was discovered in libthulac.so in THULAC through 2018-02-25. "operator delete" is used with "operator new[]" in the TaggingLearner class in include/cb… |
CVE-2018-14562 | Critical | 9.8 | 2018-07-23 | An issue was discovered in libthulac.so in THULAC through 2018-02-25. A NULL pointer dereference can occur in the BasicModel class in include/cb_model.h. |
CVE-2018-6678 | Critical | 9.1 | 2018-07-23 | Configuration/Environment manipulation vulnerability in the administrative interface in McAfee Web Gateway (MWG) MWG 7.8.1.x allows authenticated administrator… |
CVE-2018-6677 | Critical | 9.1 | 2018-07-23 | Directory Traversal vulnerability in the administrative user interface in McAfee Web Gateway (MWG) MWG 7.8.1.x allows authenticated administrator users to gain… |
CVE-2018-1513 | Medium | 5.4 | 2018-07-23 | IBM Sterling B2B Integrator Standard Edition 5.2.0 through 5.2.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary Java… |
CVE-2018-1503 | Medium | 4.3 | 2018-07-23 | IBM WebSphere MQ 7.5, 8.0, and 9.0 could allow a remotely authenticated attacker to to send invalid or malformed headers that could cause messages to no longer… |
CVE-2018-14551 | Critical | 9.8 | 2018-07-23 | The ReadMATImageV4 function in coders/mat.c in ImageMagick 7.0.8-7 uses an uninitialized variable, leading to memory corruption. |
CVE-2018-14549 | Medium | 6.5 | 2018-07-23 | An issue has been found in libwav through 2017-04-20. It is a SEGV in the function wav_write in libwav.c. |
CVE-2018-14545 | Medium | 5.5 | 2018-07-23 | There exists one invalid memory read bug in AP4_SampleDescription::GetType() in Ap4SampleDescription.h in Bento4 1.5.1-624, which can allow attackers to cause… |
CVE-2018-14544 | Medium | 5.5 | 2018-07-23 | There exists one invalid memory read bug in AP4_SampleDescription::GetFormat() in Ap4SampleDescription.h in Bento4 1.5.1-624, which can allow attackers to caus… |
CVE-2018-14543 | Medium | 5.5 | 2018-07-23 | There exists one NULL pointer dereference vulnerability in AP4_JsonInspector::AddField in Ap4Atom.cpp in Bento4 1.5.1-624, which can allow attackers to cause a… |
CVE-2018-14532 | Critical | 9.8 | 2018-07-23 | An issue was discovered in Bento4 1.5.1-624. There is a heap-based buffer over-read in AP4_Mpeg2TsVideoSampleStream::WriteSample in Core/Ap4Mpeg2Ts.cpp after a… |
CVE-2018-14531 | Critical | 9.8 | 2018-07-23 | An issue was discovered in Bento4 1.5.1-624. There is an unspecified "heap-buffer-overflow" crash in the AP4_HvccAtom class in Core/Ap4HvccAtom.cpp. |
CVE-2018-14527 | Medium | 6.1 | 2018-07-23 | Feedback.asp in Xiao5uCompany 1.7 has XSS because the XSS protection mechanism in Safe.asp is insufficient (for example, it considers SCRIPT and IMG elements… |
CVE-2018-14524 | Medium | 6.5 | 2018-07-23 | dwg_decode_eed in decode.c in GNU LibreDWG before 0.6 leads to a double free (in dwg_free_eed in free.c) because it does not properly manage the obj->eed value… |
CVE-2018-14523 | High | 8.8 | 2018-07-23 | An issue was discovered in aubio 0.4.6. A buffer over-read can occur in new_aubio_pitchyinfft in pitch/pitchyinfft.c, as demonstrated by aubionotes. |
CVE-2018-14522 | High | 8.8 | 2018-07-23 | An issue was discovered in aubio 0.4.6. A SEGV signal can occur in aubio_pitch_set_unit in pitch/pitch.c, as demonstrated by aubionotes. |
CVE-2018-14521 | High | 8.8 | 2018-07-23 | An issue was discovered in aubio 0.4.6. A SEGV signal can occur in aubio_source_avcodec_readframe in io/source_avcodec.c, as demonstrated by aubiomfcc. |
CVE-2018-14517 | Medium | 6.1 | 2018-07-23 | SeaCMS 6.61 has two XSS issues in the admin_config.php file via certain form fields. |
CVE-2018-14515 | Critical | 9.8 | 2018-07-23 | A SQL injection was discovered in WUZHI CMS 4.1.0 that allows remote attackers to inject a malicious SQL statement via the index.php?m=promote&f=index&v=search… |
CVE-2018-14514 | Critical | 9.8 | 2018-07-23 | An SSRF vulnerability was discovered in idreamsoft iCMS V7.0.9 that allows attackers to read sensitive files, access an intranet, or possibly have unspecified… |
CVE-2018-14513 | Medium | 6.1 | 2018-07-23 | An XSS vulnerability was discovered in WUZHI CMS 4.1.0. There is persistent XSS that allows remote attackers to inject arbitrary web script or HTML via the for… |
CVE-2018-14512 | Medium | 6.1 | 2018-07-23 | An XSS vulnerability was discovered in WUZHI CMS 4.1.0. There is persistent XSS that allows remote attackers to inject arbitrary web script or HTML via the for… |
CVE-2018-14505 | High | 8.8 | 2018-07-22 | mitmweb in mitmproxy v4.0.3 allows DNS Rebinding attacks, related to tools/web/app.py. |
CVE-2018-14501 | Critical | 9.8 | 2018-07-22 | manager/admin_ajax.php in joyplus-cms 1.6.0 has SQL Injection, as demonstrated by crafted POST data beginning with an "m_id=1 AND SLEEP(5)" substring. |
CVE-2018-14500 | Medium | 6.1 | 2018-07-22 | joyplus-cms 1.6.0 has XSS via the manager/collect/collect_vod_zhuiju.php keyword parameter. |
CVE-2018-14492 | High | 7.5 | 2018-07-21 | Tenda AC7 through V15.03.06.44_CN, AC9 through V15.03.05.19(6318)_CN, and AC10 through V15.03.06.23_CN devices have a Stack-based Buffer Overflow via a long li… |
CVE-2018-3771 | Medium | 6.1 | 2018-07-20 | An XSS in statics-server <= 0.0.9 can be used via injected iframe in the filename when statics-server displays directory index in the browser. |
CVE-2018-3770 | Medium | 5.5 | 2018-07-20 | A path traversal exists in markdown-pdf version <9.0.0 that allows a user to insert a malicious html code that can result in reading the local files. |
CVE-2018-5070 | Critical | 9.8 | 2018-07-20 | Adobe Acrobat and Reader 2018.011.20040 and earlier, 2017.011.30080 and earlier, and 2015.006.30418 and earlier versions have an Out-of-bounds write vulnerabil… |
CVE-2018-5069 | Critical | 9.8 | 2018-07-20 | Adobe Acrobat and Reader 2018.011.20040 and earlier, 2017.011.30080 and earlier, and 2015.006.30418 and earlier versions have an Out-of-bounds write vulnerabil… |
CVE-2018-5068 | High | 7.5 | 2018-07-20 | Adobe Acrobat and Reader 2018.011.20040 and earlier, 2017.011.30080 and earlier, and 2015.006.30418 and earlier versions have an Out-of-bounds read vulnerabili… |
CVE-2018-5067 | High | 8.8 | 2018-07-20 | Adobe Acrobat and Reader 2018.011.20040 and earlier, 2017.011.30080 and earlier, and 2015.006.30418 and earlier versions have a Heap Overflow vulnerability. Su… |
CVE-2018-5066 | High | 7.5 | 2018-07-20 | Adobe Acrobat and Reader 2018.011.20040 and earlier, 2017.011.30080 and earlier, and 2015.006.30418 and earlier versions have an Out-of-bounds read vulnerabili… |
CVE-2018-5065 | High | 8.8 | 2018-07-20 | Adobe Acrobat and Reader 2018.011.20040 and earlier, 2017.011.30080 and earlier, and 2015.006.30418 and earlier versions have a Use-after-free vulnerability. S… |
CVE-2018-5064 | Critical | 9.8 | 2018-07-20 | Adobe Acrobat and Reader 2018.011.20040 and earlier, 2017.011.30080 and earlier, and 2015.006.30418 and earlier versions have an Out-of-bounds write vulnerabil… |
CVE-2018-5063 | Medium | 6.5 | 2018-07-20 | Adobe Acrobat and Reader 2018.011.20040 and earlier, 2017.011.30080 and earlier, and 2015.006.30418 and earlier versions have an Out-of-bounds read vulnerabili… |
CVE-2018-5062 | High | 7.5 | 2018-07-20 | Adobe Acrobat and Reader 2018.011.20040 and earlier, 2017.011.30080 and earlier, and 2015.006.30418 and earlier versions have an Out-of-bounds read vulnerabili… |
CVE-2018-5061 | Medium | 6.5 | 2018-07-20 | Adobe Acrobat and Reader 2018.011.20040 and earlier, 2017.011.30080 and earlier, and 2015.006.30418 and earlier versions have an Out-of-bounds read vulnerabili… |
CVE-2018-5060 | Medium | 6.5 | 2018-07-20 | Adobe Acrobat and Reader 2018.011.20040 and earlier, 2017.011.30080 and earlier, and 2015.006.30418 and earlier versions have an Out-of-bounds read vulnerabili… |
CVE-2018-5059 | High | 8.8 | 2018-07-20 | Adobe Acrobat and Reader 2018.011.20040 and earlier, 2017.011.30080 and earlier, and 2015.006.30418 and earlier versions have an Out-of-bounds write vulnerabil… |
CVE-2018-5058 | High | 8.8 | 2018-07-20 | Adobe Acrobat and Reader 2018.011.20040 and earlier, 2017.011.30080 and earlier, and 2015.006.30418 and earlier versions have a Heap Overflow vulnerability. Su… |
CVE-2018-5057 | High | 8.8 | 2018-07-20 | Adobe Acrobat and Reader 2018.011.20040 and earlier, 2017.011.30080 and earlier, and 2015.006.30418 and earlier versions have a Type Confusion vulnerability. S… |
CVE-2018-5056 | Medium | 6.5 | 2018-07-20 | Adobe Acrobat and Reader 2018.011.20040 and earlier, 2017.011.30080 and earlier, and 2015.006.30418 and earlier versions have an Out-of-bounds read vulnerabili… |
CVE-2018-5055 | Medium | 6.5 | 2018-07-20 | Adobe Acrobat and Reader 2018.011.20040 and earlier, 2017.011.30080 and earlier, and 2015.006.30418 and earlier versions have an Out-of-bounds read vulnerabili… |
CVE-2018-5054 | Medium | 6.5 | 2018-07-20 | Adobe Acrobat and Reader 2018.011.20040 and earlier, 2017.011.30080 and earlier, and 2015.006.30418 and earlier versions have an Out-of-bounds read vulnerabili… |
CVE-2018-5053 | Medium | 6.5 | 2018-07-20 | Adobe Acrobat and Reader 2018.011.20040 and earlier, 2017.011.30080 and earlier, and 2015.006.30418 and earlier versions have an Out-of-bounds read vulnerabili… |
CVE-2018-5052 | High | 8.8 | 2018-07-20 | Adobe Acrobat and Reader 2018.011.20040 and earlier, 2017.011.30080 and earlier, and 2015.006.30418 and earlier versions have a Heap Overflow vulnerability. Su… |
CVE-2018-5051 | Medium | 6.5 | 2018-07-20 | Adobe Acrobat and Reader 2018.011.20040 and earlier, 2017.011.30080 and earlier, and 2015.006.30418 and earlier versions have an Out-of-bounds read vulnerabili… |
CVE-2018-5050 | Medium | 6.5 | 2018-07-20 | Adobe Acrobat and Reader 2018.011.20040 and earlier, 2017.011.30080 and earlier, and 2015.006.30418 and earlier versions have an Out-of-bounds read vulnerabili… |
CVE-2018-5049 | Medium | 6.5 | 2018-07-20 | Adobe Acrobat and Reader 2018.011.20040 and earlier, 2017.011.30080 and earlier, and 2015.006.30418 and earlier versions have an Out-of-bounds read vulnerabili… |